1019 files changed, 27670 insertions, 18058 deletions

diff --git a/.mailmap b/.mailmap
index 4e83e7b52d1..a62e6a84fd1 100644
--- a/.mailmap
+++ b/.mailmap
@@ -92,6 +92,7 @@ Rudolf Marek <R.Marek@sh.cvut.cz>
 Rui Saraiva <rmps@joel.ist.utl.pt>
 Sachin P Sant <ssant@in.ibm.com>
 Sam Ravnborg <sam@mars.ravnborg.org>
+Sascha Hauer <s.hauer@pengutronix.de>
 S.Çağlar Onur <caglar@pardus.org.tr>
 Simon Kelley <simon@thekelleys.org.uk>
 Stéphane Witzmann <stephane.witzmann@ubpmes.univ-bpclermont.fr>
@@ -100,6 +101,7 @@ Tejun Heo <htejun@gmail.com>
 Thomas Graf <tgraf@suug.ch>
 Tony Luck <tony.luck@intel.com>
 Tsuneo Yoshioka <Tsuneo.Yoshioka@f-secure.com>
-Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
 Uwe Kleine-König <ukleinek@informatik.uni-freiburg.de>
+Uwe Kleine-König <ukl@pengutronix.de>
+Uwe Kleine-König <Uwe.Kleine-Koenig@digi.com>
 Valdis Kletnieks <Valdis.Kletnieks@vt.edu>
diff --git a/Documentation/block/biodoc.txt b/Documentation/block/biodoc.txt
index 5d2480d33b4..ecad6ee7570 100644
--- a/Documentation/block/biodoc.txt
+++ b/Documentation/block/biodoc.txt
@@ -954,14 +954,14 @@ elevator_allow_merge_fn		called whenever the block layer determines
                                 results in some sort of conflict internally,
                                 this hook allows it to do that.
 
-elevator_dispatch_fn            fills the dispatch queue with ready requests.
+elevator_dispatch_fn*           fills the dispatch queue with ready requests.
                                 I/O schedulers are free to postpone requests by
                                 not filling the dispatch queue unless @force
                                 is non-zero.  Once dispatched, I/O schedulers
                                 are not allowed to manipulate the requests -
                                 they belong to generic dispatch queue.
 
-elevator_add_req_fn             called to add a new request into the scheduler
+elevator_add_req_fn*            called to add a new request into the scheduler
 
 elevator_queue_empty_fn         returns true if the merge queue is empty.
                                 Drivers shouldn't use this, but rather check
@@ -991,7 +991,7 @@ elevator_activate_req_fn	Called when device driver first sees a request.
 elevator_deactivate_req_fn      Called when device driver decides to delay
                                 a request by requeueing it.
 
-elevator_init_fn
+elevator_init_fn*
 elevator_exit_fn                Allocate and free any elevator specific storage
                                 for a queue.
 
diff --git a/Documentation/block/queue-sysfs.txt b/Documentation/block/queue-sysfs.txt
new file mode 100644
index 00000000000..e164403f60e
--- /dev/null
+++ b/Documentation/block/queue-sysfs.txt
@@ -0,0 +1,63 @@
+Queue sysfs files
+=================
+
+This text file will detail the queue files that are located in the sysfs tree
+for each block device. Note that stacked devices typically do not export
+any settings, since their queue merely functions are a remapping target.
+These files are the ones found in the /sys/block/xxx/queue/ directory.
+
+Files denoted with a RO postfix are readonly and the RW postfix means
+read-write.
+
+hw_sector_size (RO)
+-------------------
+This is the hardware sector size of the device, in bytes.
+
+max_hw_sectors_kb (RO)
+----------------------
+This is the maximum number of kilobytes supported in a single data transfer.
+
+max_sectors_kb (RW)
+-------------------
+This is the maximum number of kilobytes that the block layer will allow
+for a filesystem request. Must be smaller than or equal to the maximum
+size allowed by the hardware.
+
+nomerges (RW)
+-------------
+This enables the user to disable the lookup logic involved with IO merging
+requests in the block layer. Merging may still occur through a direct
+1-hit cache, since that comes for (almost) free. The IO scheduler will not
+waste cycles doing tree/hash lookups for merges if nomerges is 1. Defaults
+to 0, enabling all merges.
+
+nr_requests (RW)
+----------------
+This controls how many requests may be allocated in the block layer for
+read or write requests. Note that the total allocated number may be twice
+this amount, since it applies only to reads or writes (not the accumulated
+sum).
+
+read_ahead_kb (RW)
+------------------
+Maximum number of kilobytes to read-ahead for filesystems on this block
+device.
+
+rq_affinity (RW)
+----------------
+If this option is enabled, the block layer will migrate request completions
+to the CPU that originally submitted the request. For some workloads
+this provides a significant reduction in CPU cycles due to caching effects.
+
+scheduler (RW)
+--------------
+When read, this file will display the current and available IO schedulers
+for this block device. The currently active IO scheduler will be enclosed
+in [] brackets. Writing an IO scheduler name to this file will switch
+control of this block device to that new IO scheduler. Note that writing
+an IO scheduler name to this file will attempt to load that IO scheduler
+module, if it isn't already present in the system.
+
+
+
+Jens Axboe <jens.axboe@oracle.com>, February 2009
diff --git a/Documentation/cpu-freq/user-guide.txt b/Documentation/cpu-freq/user-guide.txt
index e3443ddcfb8..917918f84fc 100644
--- a/Documentation/cpu-freq/user-guide.txt
+++ b/Documentation/cpu-freq/user-guide.txt
@@ -195,19 +195,3 @@ scaling_setspeed.		By "echoing" a new frequency into this
                                 you can change the speed of the CPU,
                                 but only within the limits of
                                 scaling_min_freq and scaling_max_freq.
-                                
-
-3.2 Deprecated Interfaces
--------------------------
-
-Depending on your kernel configuration, you might find the following 
-cpufreq-related files:
-/proc/cpufreq
-/proc/sys/cpu/*/speed
-/proc/sys/cpu/*/speed-min
-/proc/sys/cpu/*/speed-max
-
-These are files for deprecated interfaces to cpufreq, which offer far
-less functionality. Because of this, these interfaces aren't described
-here.
-
diff --git a/Documentation/cputopology.txt b/Documentation/cputopology.txt
index 45932ec21ce..b41f3e58aef 100644
--- a/Documentation/cputopology.txt
+++ b/Documentation/cputopology.txt
@@ -18,11 +18,11 @@ For an architecture to support this feature, it must define some of
 these macros in include/asm-XXX/topology.h:
 #define topology_physical_package_id(cpu)
 #define topology_core_id(cpu)
-#define topology_thread_siblings(cpu)
-#define topology_core_siblings(cpu)
+#define topology_thread_cpumask(cpu)
+#define topology_core_cpumask(cpu)
 
 The type of **_id is int.
-The type of siblings is cpumask_t.
+The type of siblings is (const) struct cpumask *.
 
 To be consistent on all architectures, include/linux/topology.h
 provides default definitions for any of the above macros that are
diff --git a/Documentation/filesystems/sysfs-pci.txt b/Documentation/filesystems/sysfs-pci.txt
index 68ef48839c0..9f8740ca3f3 100644
--- a/Documentation/filesystems/sysfs-pci.txt
+++ b/Documentation/filesystems/sysfs-pci.txt
@@ -9,6 +9,7 @@ that support it.  For example, a given bus might look like this:
      |   |-- class
      |   |-- config
      |   |-- device
+     |   |-- enable
      |   |-- irq
      |   |-- local_cpus
      |   |-- resource
@@ -32,6 +33,7 @@ files, each with their own function.
        class               PCI class (ascii, ro)
        config              PCI config space (binary, rw)
        device              PCI device (ascii, ro)
+       enable              Whether the device is enabled (ascii, rw)
        irq                 IRQ number (ascii, ro)
        local_cpus          nearby CPU mask (cpumask, ro)
        resource            PCI resource host addresses (ascii, ro)
@@ -57,10 +59,19 @@ used to do actual device programming from userspace.  Note that some platforms
 don't support mmapping of certain resources, so be sure to check the return
 value from any attempted mmap.
 
+The 'enable' file provides a counter that indicates how many times the device 
+has been enabled.  If the 'enable' file currently returns '4', and a '1' is
+echoed into it, it will then return '5'.  Echoing a '0' into it will decrease
+the count.  Even when it returns to 0, though, some of the initialisation
+may not be reversed.  
+
 The 'rom' file is special in that it provides read-only access to the device's
 ROM file, if available.  It's disabled by default, however, so applications
 should write the string "1" to the file to enable it before attempting a read
-call, and disable it following the access by writing "0" to the file.
+call, and disable it following the access by writing "0" to the file.  Note
+that the device must be enabled for a rom read to return data succesfully.
+In the event a driver is not bound to the device, it can be enabled using the
+'enable' file, documented above.
 
 Accessing legacy resources through sysfs
 ----------------------------------------
diff --git a/Documentation/filesystems/ubifs.txt b/Documentation/filesystems/ubifs.txt
index 84da2a4ba25..12fedb7834c 100644
--- a/Documentation/filesystems/ubifs.txt
+++ b/Documentation/filesystems/ubifs.txt
@@ -79,13 +79,6 @@ Mount options
 
 (*) == default.
 
-norm_unmount (*)        commit on unmount; the journal is committed
-                        when the file-system is unmounted so that the
-                        next mount does not have to replay the journal
-                        and it becomes very fast;
-fast_unmount            do not commit on unmount; this option makes
-                        unmount faster, but the next mount slower
-                        because of the need to replay the journal.
 bulk_read               read more in one go to take advantage of flash
                         media that read faster sequentially
 no_bulk_read (*)        do not bulk-read
diff --git a/Documentation/kernel-doc-nano-HOWTO.txt b/Documentation/kernel-doc-nano-HOWTO.txt
index d73fbd2b2b4..026ec7d5738 100644
--- a/Documentation/kernel-doc-nano-HOWTO.txt
+++ b/Documentation/kernel-doc-nano-HOWTO.txt
@@ -43,7 +43,8 @@ Only comments so marked will be considered by the kernel-doc scripts,
 and any comment so marked must be in kernel-doc format.  Do not use
 "/**" to be begin a comment block unless the comment block contains
 kernel-doc formatted comments.  The closing comment marker for
-kernel-doc comments can be either "*/" or "**/".
+kernel-doc comments can be either "*/" or "**/", but "*/" is
+preferred in the Linux kernel tree.
 
 Kernel-doc comments should be placed just before the function
 or data structure being described.
@@ -63,7 +64,7 @@ Example kernel-doc function comment:
  * comment lines.
  *
  * The longer description can have multiple paragraphs.
- **/
+ */
 
 The first line, with the short description, must be on a single line.
 
@@ -85,7 +86,7 @@ Example kernel-doc data structure comment.
  *              perhaps with more lines and words.
  *
  * Longer description of this structure.
- **/
+ */
 
 The kernel-doc function comments describe each parameter to the
 function, in order, with the @name lines.
diff --git a/Documentation/kernel-parameters.txt b/Documentation/kernel-parameters.txt
index d8362cf9909..b182626739e 100644
--- a/Documentation/kernel-parameters.txt
+++ b/Documentation/kernel-parameters.txt
@@ -937,6 +937,8 @@ and is between 256 and 4096 characters. It is defined in the file
 
 
         intel_iommu=    [DMAR] Intel IOMMU driver (DMAR) option
+                on
+                        Enable intel iommu driver.
                 off
                         Disable intel iommu driver.
                 igfx_off [Default Off]
diff --git a/Documentation/networking/alias.txt b/Documentation/networking/alias.txt
index cd12c2ff518..85046f53fcf 100644
--- a/Documentation/networking/alias.txt
+++ b/Documentation/networking/alias.txt
@@ -2,13 +2,13 @@
 IP-Aliasing:
 ============
 
-IP-aliases are additional IP-addresses/masks hooked up to a base 
-interface by adding a colon and a string when running ifconfig. 
-This string is usually numeric, but this is not a must.
-
-IP-Aliases are avail if CONFIG_INET (`standard' IPv4 networking) 
-is configured in the kernel.
+IP-aliases are an obsolete way to manage multiple IP-addresses/masks
+per interface. Newer tools such as iproute2 support multiple
+address/prefixes per interface, but aliases are still supported
+for backwards compatibility.
 
+An alias is formed by adding a colon and a string when running ifconfig.
+This string is usually numeric, but this is not a must.
 
 o Alias creation.
   Alias creation is done by 'magic' interface naming: eg. to create a
@@ -38,16 +38,3 @@ o Relationship with main device
 
   If the base device is shut down the added aliases will be deleted 
   too.
-
-
-Contact
--------
-Please finger or e-mail me:
-   Juan Jose Ciarlante <jjciarla@raiz.uncu.edu.ar>
-
-Updated by Erik Schoenfelder <schoenfr@gaertner.DE>
-
-; local variables:
-; mode: indented-text
-; mode: auto-fill
-; end:
diff --git a/Documentation/powerpc/dts-bindings/fsl/mpc5200.txt b/Documentation/powerpc/dts-bindings/fsl/mpc5200.txt
new file mode 100644
index 00000000000..8447fd7090d
--- /dev/null
+++ b/Documentation/powerpc/dts-bindings/fsl/mpc5200.txt
@@ -0,0 +1,180 @@
+MPC5200 Device Tree Bindings
+----------------------------
+
+(c) 2006-2009 Secret Lab Technologies Ltd
+Grant Likely <grant.likely@secretlab.ca>
+
+Naming conventions
+------------------
+For mpc5200 on-chip devices, the format for each compatible value is
+<chip>-<device>[-<mode>].  The OS should be able to match a device driver
+to the device based solely on the compatible value.  If two drivers
+match on the compatible list; the 'most compatible' driver should be
+selected.
+
+The split between the MPC5200 and the MPC5200B leaves a bit of a
+conundrum.  How should the compatible property be set up to provide
+maximum compatibility information; but still accurately describe the
+chip?  For the MPC5200; the answer is easy.  Most of the SoC devices
+originally appeared on the MPC5200.  Since they didn't exist anywhere
+else; the 5200 compatible properties will contain only one item;
+"fsl,mpc5200-<device>".
+
+The 5200B is almost the same as the 5200, but not quite.  It fixes
+silicon bugs and it adds a small number of enhancements.  Most of the
+devices either provide exactly the same interface as on the 5200.  A few
+devices have extra functions but still have a backwards compatible mode.
+To express this information as completely as possible, 5200B device trees
+should have two items in the compatible list:
+        compatible = "fsl,mpc5200b-<device>","fsl,mpc5200-<device>";
+
+It is *strongly* recommended that 5200B device trees follow this convention
+(instead of only listing the base mpc5200 item).
+
+ie. ethernet on mpc5200: compatible = "fsl,mpc5200-fec";
+    ethernet on mpc5200b: compatible = "fsl,mpc5200b-fec", "fsl,mpc5200-fec";
+
+Modal devices, like PSCs, also append the configured function to the
+end of the compatible field.  ie. A PSC in i2s mode would specify
+"fsl,mpc5200-psc-i2s", not "fsl,mpc5200-i2s".  This convention is chosen to
+avoid naming conflicts with non-psc devices providing the same
+function.  For example, "fsl,mpc5200-spi" and "fsl,mpc5200-psc-spi" describe
+the mpc5200 simple spi device and a PSC spi mode respectively.
+
+At the time of writing, exact chip may be either 'fsl,mpc5200' or
+'fsl,mpc5200b'.
+
+The soc node
+------------
+This node describes the on chip SOC peripherals.  Every mpc5200 based
+board will have this node, and as such there is a common naming
+convention for SOC devices.
+
+Required properties:
+name                    description
+----                    -----------
+ranges                  Memory range of the internal memory mapped registers.
+                        Should be <0 [baseaddr] 0xc000>
+reg                     Should be <[baseaddr] 0x100>
+compatible              mpc5200: "fsl,mpc5200-immr"
+                        mpc5200b: "fsl,mpc5200b-immr"
+system-frequency        'fsystem' frequency in Hz; XLB, IPB, USB and PCI
+                        clocks are derived from the fsystem clock.
+bus-frequency           IPB bus frequency in Hz.  Clock rate
+                        used by most of the soc devices.
+
+soc child nodes
+---------------
+Any on chip SOC devices available to Linux must appear as soc5200 child nodes.
+
+Note: The tables below show the value for the mpc5200.  A mpc5200b device
+tree should use the "fsl,mpc5200b-<device>","fsl,mpc5200-<device>" form.
+
+Required soc5200 child nodes:
+name                            compatible              Description
+----                            ----------              -----------
+cdm@<addr>                      fsl,mpc5200-cdm         Clock Distribution
+interrupt-controller@<addr>     fsl,mpc5200-pic         need an interrupt
+                                                        controller to boot
+bestcomm@<addr>                 fsl,mpc5200-bestcomm    Bestcomm DMA controller
+
+Recommended soc5200 child nodes; populate as needed for your board
+name            compatible              Description
+----            ----------              -----------
+timer@<addr>    fsl,mpc5200-gpt          General purpose timers
+gpio@<addr>     fsl,mpc5200-gpio         MPC5200 simple gpio controller
+gpio@<addr>     fsl,mpc5200-gpio-wkup    MPC5200 wakeup gpio controller
+rtc@<addr>      fsl,mpc5200-rtc          Real time clock
+mscan@<addr>    fsl,mpc5200-mscan        CAN bus controller
+pci@<addr>      fsl,mpc5200-pci          PCI bridge
+serial@<addr>   fsl,mpc5200-psc-uart     PSC in serial mode
+i2s@<addr>      fsl,mpc5200-psc-i2s      PSC in i2s mode
+ac97@<addr>     fsl,mpc5200-psc-ac97     PSC in ac97 mode
+spi@<addr>      fsl,mpc5200-psc-spi      PSC in spi mode
+irda@<addr>     fsl,mpc5200-psc-irda     PSC in IrDA mode
+spi@<addr>      fsl,mpc5200-spi          MPC5200 spi device
+ethernet@<addr> fsl,mpc5200-fec          MPC5200 ethernet device
+ata@<addr>      fsl,mpc5200-ata          IDE ATA interface
+i2c@<addr>      fsl,mpc5200-i2c          I2C controller
+usb@<addr>      fsl,mpc5200-ohci,ohci-be USB controller
+xlb@<addr>      fsl,mpc5200-xlb          XLB arbitrator
+
+fsl,mpc5200-gpt nodes
+---------------------
+On the mpc5200 and 5200b, GPT0 has a watchdog timer function.  If the board
+design supports the internal wdt, then the device node for GPT0 should
+include the empty property 'fsl,has-wdt'.
+
+An mpc5200-gpt can be used as a single line GPIO controller.  To do so,
+add the following properties to the gpt node:
+        gpio-controller;
+        #gpio-cells = <2>;
+When referencing the GPIO line from another node, the first cell must always
+be zero and the second cell represents the gpio flags and described in the
+gpio device tree binding.
+
+An mpc5200-gpt can be used as a single line edge sensitive interrupt
+controller.  To do so, add the following properties to the gpt node:
+        interrupt-controller;
+        #interrupt-cells = <1>;
+When referencing the IRQ line from another node, the cell represents the
+sense mode; 1 for edge rising, 2 for edge falling.
+
+fsl,mpc5200-psc nodes
+---------------------
+The PSCs should include a cell-index which is the index of the PSC in
+hardware.  cell-index is used to determine which shared SoC registers to
+use when setting up PSC clocking.  cell-index number starts at '0'.  ie:
+        PSC1 has 'cell-index = <0>'
+        PSC4 has 'cell-index = <3>'
+
+PSC in i2s mode:  The mpc5200 and mpc5200b PSCs are not compatible when in
+i2s mode.  An 'mpc5200b-psc-i2s' node cannot include 'mpc5200-psc-i2s' in the
+compatible field.
+
+
+fsl,mpc5200-gpio and fsl,mpc5200-gpio-wkup nodes
+------------------------------------------------
+Each GPIO controller node should have the empty property gpio-controller and
+#gpio-cells set to 2. First cell is the GPIO number which is interpreted
+according to the bit numbers in the GPIO control registers. The second cell
+is for flags which is currently unused.
+
+fsl,mpc5200-fec nodes
+---------------------
+The FEC node can specify one of the following properties to configure
+the MII link:
+- fsl,7-wire-mode - An empty property that specifies the link uses 7-wire
+                    mode instead of MII
+- current-speed   - Specifies that the MII should be configured for a fixed
+                    speed.  This property should contain two cells.  The
+                    first cell specifies the speed in Mbps and the second
+                    should be '0' for half duplex and '1' for full duplex
+- phy-handle      - Contains a phandle to an Ethernet PHY.
+
+Interrupt controller (fsl,mpc5200-pic) node
+-------------------------------------------
+The mpc5200 pic binding splits hardware IRQ numbers into two levels.  The
+split reflects the layout of the PIC hardware itself, which groups
+interrupts into one of three groups; CRIT, MAIN or PERP.  Also, the
+Bestcomm dma engine has it's own set of interrupt sources which are
+cascaded off of peripheral interrupt 0, which the driver interprets as a
+fourth group, SDMA.
+
+The interrupts property for device nodes using the mpc5200 pic consists
+of three cells; <L1 L2 level>
+
+    L1 := [CRIT=0, MAIN=1, PERP=2, SDMA=3]
+    L2 := interrupt number; directly mapped from the value in the
+          "ICTL PerStat, MainStat, CritStat Encoded Register"
+    level := [LEVEL_HIGH=0, EDGE_RISING=1, EDGE_FALLING=2, LEVEL_LOW=3]
+
+For external IRQs, use the following interrupt property values (how to
+specify external interrupts is a frequently asked question):
+External interrupts:
+        external irq0:  interrupts = <0 0 n>;
+        external irq1:  interrupts = <1 1 n>;
+        external irq2:  interrupts = <1 2 n>;
+        external irq3:  interrupts = <1 3 n>;
+'n' is sense (0: level high, 1: edge rising, 2: edge falling 3: level low)
+
diff --git a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt b/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
deleted file mode 100644
index 6f12f1c79c0..00000000000
--- a/Documentation/powerpc/mpc52xx-device-tree-bindings.txt
+++ /dev/null
@@ -1,277 +0,0 @@
-MPC5200 Device Tree Bindings
-----------------------------
-
-(c) 2006-2007 Secret Lab Technologies Ltd
-Grant Likely <grant.likely at secretlab.ca>
-
-********** DRAFT ***********
-* WARNING: Do not depend on the stability of these bindings just yet.
-* The MPC5200 device tree conventions are still in flux
-* Keep an eye on the linuxppc-dev mailing list for more details
-********** DRAFT ***********
-
-I - Introduction
-================
-Boards supported by the arch/powerpc architecture require device tree be
-passed by the boot loader to the kernel at boot time.  The device tree
-describes what devices are present on the board and how they are
-connected.  The device tree can either be passed as a binary blob (as
-described in Documentation/powerpc/booting-without-of.txt), or passed
-by Open Firmware (IEEE 1275) compatible firmware using an OF compatible
-client interface API.
-
-This document specifies the requirements on the device-tree for mpc5200
-based boards.  These requirements are above and beyond the details
-specified in either the Open Firmware spec or booting-without-of.txt
-
-All new mpc5200-based boards are expected to match this document.  In
-cases where this document is not sufficient to support a new board port,
-this document should be updated as part of adding the new board support.
-
-II - Philosophy
-===============
-The core of this document is naming convention.  The whole point of
-defining this convention is to reduce or eliminate the number of
-special cases required to support a 5200 board.  If all 5200 boards
-follow the same convention, then generic 5200 support code will work
-rather than coding special cases for each new board.
-
-This section tries to capture the thought process behind why the naming
-convention is what it is.
-
-1.  names
----------
-There is strong convention/requirements already established for children
-of the root node.  'cpus' describes the processor cores, 'memory'
-describes memory, and 'chosen' provides boot configuration.  Other nodes
-are added to describe devices attached to the processor local bus.
-
-Following convention already established with other system-on-chip
-processors, 5200 device trees should use the name 'soc5200' for the
-parent node of on chip devices, and the root node should be its parent.
-
-Child nodes are typically named after the configured function.  ie.
-the FEC node is named 'ethernet', and a PSC in uart mode is named 'serial'.
-
-2. device_type property
------------------------
-similar to the node name convention above; the device_type reflects the
-configured function of a device.  ie. 'serial' for a uart and 'spi' for
-an spi controller.  However, while node names *should* reflect the
-configured function, device_type *must* match the configured function
-exactly.
-
-3. compatible property
-----------------------
-Since device_type isn't enough to match devices to drivers, there also
-needs to be a naming convention for the compatible property.  Compatible
-is an list of device descriptions sorted from specific to generic.  For
-the mpc5200, the required format for each compatible value is
-<chip>-<device>[-<mode>].  The OS should be able to match a device driver
-to the device based solely on the compatible value.  If two drivers
-match on the compatible list; the 'most compatible' driver should be
-selected.
-
-The split between the MPC5200 and the MPC5200B leaves a bit of a
-conundrum.  How should the compatible property be set up to provide
-maximum compatibility information; but still accurately describe the
-chip?  For the MPC5200; the answer is easy.  Most of the SoC devices
-originally appeared on the MPC5200.  Since they didn't exist anywhere
-else; the 5200 compatible properties will contain only one item;
-"mpc5200-<device>".
-
-The 5200B is almost the same as the 5200, but not quite.  It fixes
-silicon bugs and it adds a small number of enhancements.  Most of the
-devices either provide exactly the same interface as on the 5200.  A few
-devices have extra functions but still have a backwards compatible mode.
-To express this information as completely as possible, 5200B device trees
-should have two items in the compatible list;
-"mpc5200b-<device>\0mpc5200-<device>".  It is *strongly* recommended
-that 5200B device trees follow this convention (instead of only listing
-the base mpc5200 item).
-
-If another chip appear on the market with one of the mpc5200 SoC
-devices, then the compatible list should include mpc5200-<device>.
-
-ie. ethernet on mpc5200: compatible = "mpc5200-ethernet"
-    ethernet on mpc5200b: compatible = "mpc5200b-ethernet\0mpc5200-ethernet"
-
-Modal devices, like PSCs, also append the configured function to the
-end of the compatible field.  ie. A PSC in i2s mode would specify
-"mpc5200-psc-i2s", not "mpc5200-i2s".  This convention is chosen to
-avoid naming conflicts with non-psc devices providing the same
-function.  For example, "mpc5200-spi" and "mpc5200-psc-spi" describe
-the mpc5200 simple spi device and a PSC spi mode respectively.
-
-If the soc device is more generic and present on other SOCs, the
-compatible property can specify the more generic device type also.
-
-ie. mscan: compatible = "mpc5200-mscan\0fsl,mscan";
-
-At the time of writing, exact chip may be either 'mpc5200' or
-'mpc5200b'.
-
-Device drivers should always try to match as generically as possible.
-
-III - Structure
-===============
-The device tree for an mpc5200 board follows the structure defined in
-booting-without-of.txt with the following additional notes:
-
-0) the root node
-----------------
-Typical root description node; see booting-without-of
-
-1) The cpus node
-----------------
-The cpus node follows the basic layout described in booting-without-of.
-The bus-frequency property holds the XLB bus frequency
-The clock-frequency property holds the core frequency
-
-2) The memory node
-------------------
-Typical memory description node; see booting-without-of.
-
-3) The soc5200 node
--------------------
-This node describes the on chip SOC peripherals.  Every mpc5200 based
-board will have this node, and as such there is a common naming
-convention for SOC devices.
-
-Required properties:
-name                    type            description
-----                    ----            -----------
-device_type             string          must be "soc"
-ranges                  int             should be <0 baseaddr baseaddr+10000>
-reg                     int             must be <baseaddr 10000>
-compatible              string          mpc5200: "mpc5200-soc"
-                                        mpc5200b: "mpc5200b-soc\0mpc5200-soc"
-system-frequency        int             Fsystem frequency; source of all
-                                        other clocks.
-bus-frequency           int             IPB bus frequency in HZ.  Clock rate
-                                        used by most of the soc devices.
-#interrupt-cells        int             must be <3>.
-
-Recommended properties:
-name                    type            description
-----                    ----            -----------
-model                   string          Exact model of the chip;
-                                        ie: model="fsl,mpc5200"
-revision                string          Silicon revision of chip
-                                        ie: revision="M08A"
-
-The 'model' and 'revision' properties are *strongly* recommended.  Having
-them presence acts as a bit of a safety net for working around as yet
-undiscovered bugs on one version of silicon.  For example, device drivers
-can use the model and revision properties to decide if a bug fix should
-be turned on.
-
-4) soc5200 child nodes
-----------------------
-Any on chip SOC devices available to Linux must appear as soc5200 child nodes.
-
-Note: The tables below show the value for the mpc5200.  A mpc5200b device
-tree should use the "mpc5200b-<device>\0mpc5200-<device> form.
-
-Required soc5200 child nodes:
-name            device_type             compatible      Description
-----            -----------             ----------      -----------
-cdm@<addr>      cdm                     mpc5200-cmd     Clock Distribution
-pic@<addr>      interrupt-controller    mpc5200-pic     need an interrupt
-                                                        controller to boot
-bestcomm@<addr> dma-controller          mpc5200-bestcomm 5200 pic also requires
-                                                         the bestcomm device
-
-Recommended soc5200 child nodes; populate as needed for your board
-name            device_type     compatible        Description
-----            -----------     ----------        -----------
-gpt@<addr>      gpt             fsl,mpc5200-gpt   General purpose timers
-gpt@<addr>      gpt             fsl,mpc5200-gpt-gpio    General purpose
-                                                        timers in GPIO mode
-gpio@<addr>                     fsl,mpc5200-gpio        MPC5200 simple gpio
-                                                        controller
-gpio@<addr>                     fsl,mpc5200-gpio-wkup   MPC5200 wakeup gpio
-                                                        controller
-rtc@<addr>      rtc             mpc5200-rtc       Real time clock
-mscan@<addr>    mscan           mpc5200-mscan     CAN bus controller
-pci@<addr>      pci             mpc5200-pci       PCI bridge
-serial@<addr>   serial          mpc5200-psc-uart  PSC in serial mode
-i2s@<addr>      sound           mpc5200-psc-i2s   PSC in i2s mode
-ac97@<addr>     sound           mpc5200-psc-ac97  PSC in ac97 mode
-spi@<addr>      spi             mpc5200-psc-spi   PSC in spi mode
-irda@<addr>     irda            mpc5200-psc-irda  PSC in IrDA mode
-spi@<addr>      spi             mpc5200-spi       MPC5200 spi device
-ethernet@<addr> network         mpc5200-fec       MPC5200 ethernet device
-ata@<addr>      ata             mpc5200-ata       IDE ATA interface
-i2c@<addr>      i2c             mpc5200-i2c       I2C controller
-usb@<addr>      usb-ohci-be     mpc5200-ohci,ohci-be    USB controller
-xlb@<addr>      xlb             mpc5200-xlb       XLB arbitrator
-
-Important child node properties
-name            type            description
-----            ----            -----------
-cell-index      int             When multiple devices are present, is the
-                                index of the device in the hardware (ie. There
-                                are 6 PSC on the 5200 numbered PSC1 to PSC6)
-                                    PSC1 has 'cell-index = <0>'
-                                    PSC4 has 'cell-index = <3>'
-
-5) General Purpose Timer nodes (child of soc5200 node)
-On the mpc5200 and 5200b, GPT0 has a watchdog timer function.  If the board
-design supports the internal wdt, then the device node for GPT0 should
-include the empty property 'fsl,has-wdt'.
-
-6) PSC nodes (child of soc5200 node)
-PSC nodes can define the optional 'port-number' property to force assignment
-order of serial ports.  For example, PSC5 might be physically connected to
-the port labeled 'COM1' and PSC1 wired to 'COM1'.  In this case, PSC5 would
-have a "port-number = <0>" property, and PSC1 would have "port-number = <1>".
-
-PSC in i2s mode:  The mpc5200 and mpc5200b PSCs are not compatible when in
-i2s mode.  An 'mpc5200b-psc-i2s' node cannot include 'mpc5200-psc-i2s' in the
-compatible field.
-
-7) GPIO controller nodes
-Each GPIO controller node should have the empty property gpio-controller and
-#gpio-cells set to 2. First cell is the GPIO number which is interpreted
-according to the bit numbers in the GPIO control registers. The second cell
-is for flags which is currently unsused.
-
-8) FEC nodes
-The FEC node can specify one of the following properties to configure
-the MII link:
-"fsl,7-wire-mode" - An empty property that specifies the link uses 7-wire
-                    mode instead of MII
-"current-speed"   - Specifies that the MII should be configured for a fixed
-                    speed.  This property should contain two cells.  The
-                    first cell specifies the speed in Mbps and the second
-                    should be '0' for half duplex and '1' for full duplex
-"phy-handle"      - Contains a phandle to an Ethernet PHY.
-
-IV - Extra Notes
-================
-
-1. Interrupt mapping
---------------------
-The mpc5200 pic driver splits hardware IRQ numbers into two levels.  The
-split reflects the layout of the PIC hardware itself, which groups
-interrupts into one of three groups; CRIT, MAIN or PERP.  Also, the
-Bestcomm dma engine has it's own set of interrupt sources which are
-cascaded off of peripheral interrupt 0, which the driver interprets as a
-fourth group, SDMA.
-
-The interrupts property for device nodes using the mpc5200 pic consists
-of three cells; <L1 L2 level>
-
-    L1 := [CRIT=0, MAIN=1, PERP=2, SDMA=3]
-    L2 := interrupt number; directly mapped from the value in the
-          "ICTL PerStat, MainStat, CritStat Encoded Register"
-    level := [LEVEL_HIGH=0, EDGE_RISING=1, EDGE_FALLING=2, LEVEL_LOW=3]
-
-2. Shared registers
--------------------
-Some SoC devices share registers between them.  ie. the i2c devices use
-a single clock control register, and almost all device are affected by
-the port_config register.  Devices which need to manipulate shared regs
-should look to the parent SoC node.  The soc node is responsible
-for arbitrating all shared register access.
diff --git a/Documentation/video4linux/v4lgrab.c b/Documentation/video4linux/v4lgrab.c
index 079b628481c..d6e70bef8ad 100644
--- a/Documentation/video4linux/v4lgrab.c
+++ b/Documentation/video4linux/v4lgrab.c
@@ -4,12 +4,21 @@
  *
  *      Compile with:
  *              gcc -s -Wall -Wstrict-prototypes v4lgrab.c -o v4lgrab
- *      Use as:
- *              v4lgrab >image.ppm
+ *      Use as:
+ *              v4lgrab >image.ppm
  *
  *      Copyright (C) 1998-05-03, Phil Blundell <philb@gnu.org>
- *      Copied from http://www.tazenda.demon.co.uk/phil/vgrabber.c
- *      with minor modifications (Dave Forrest, drf5n@virginia.edu).
+ *      Copied from http://www.tazenda.demon.co.uk/phil/vgrabber.c
+ *      with minor modifications (Dave Forrest, drf5n@virginia.edu).
+ *
+ *
+ *      For some cameras you may need to pre-load libv4l to perform
+ *      the necessary decompression, e.g.:
+ *
+ *      export LD_PRELOAD=/usr/lib/libv4l/v4l1compat.so
+ *      ./v4lgrab >image.ppm
+ *
+ *      see http://hansdegoede.livejournal.com/3636.html for details.
  *
  */
 
@@ -24,7 +33,7 @@
 #include <linux/types.h>
 #include <linux/videodev.h>
 
-#define FILE "/dev/video0"
+#define VIDEO_DEV "/dev/video0"
 
 /* Stole this from tvset.c */
 
@@ -90,7 +99,7 @@ int get_brightness_adj(unsigned char *image, long size, int *brightness) {
 
 int main(int argc, char ** argv)
 {
-  int fd = open(FILE, O_RDONLY), f;
+  int fd = open(VIDEO_DEV, O_RDONLY), f;
   struct video_capability cap;
   struct video_window win;
   struct video_picture vpic;
@@ -100,13 +109,13 @@ int main(int argc, char ** argv)
   unsigned int i, src_depth;
 
   if (fd < 0) {
-    perror(FILE);
+    perror(VIDEO_DEV);
     exit(1);
   }
 
   if (ioctl(fd, VIDIOCGCAP, &cap) < 0) {
     perror("VIDIOGCAP");
-    fprintf(stderr, "(" FILE " not a video4linux device?)\n");
+    fprintf(stderr, "(" VIDEO_DEV " not a video4linux device?)\n");
     close(fd);
     exit(1);
   }
diff --git a/Documentation/x86/boot.txt b/Documentation/x86/boot.txt
index 7b4596ac412..12299697b7c 100644
--- a/Documentation/x86/boot.txt
+++ b/Documentation/x86/boot.txt
@@ -158,7 +158,7 @@ Offset	Proto	Name		Meaning
 0202/4  2.00+   header          Magic signature "HdrS"
 0206/2  2.00+   version         Boot protocol version supported
 0208/4  2.00+   realmode_swtch  Boot loader hook (see below)
-020C/2  2.00+   start_sys       The load-low segment (0x1000) (obsolete)
+020C/2  2.00+   start_sys_seg   The load-low segment (0x1000) (obsolete)
 020E/2  2.00+   kernel_version  Pointer to kernel version string
 0210/1  2.00+   type_of_loader  Boot loader identifier
 0211/1  2.00+   loadflags       Boot protocol option flags
@@ -170,10 +170,11 @@ Offset	Proto	Name		Meaning
 0224/2  2.01+   heap_end_ptr    Free memory after setup end
 0226/2  N/A     pad1            Unused
 0228/4  2.02+   cmd_line_ptr    32-bit pointer to the kernel command line
-022C/4  2.03+   initrd_addr_max Highest legal initrd address
+022C/4  2.03+   ramdisk_max     Highest legal initrd address
 0230/4  2.05+   kernel_alignment Physical addr alignment required for kernel
 0234/1  2.05+   relocatable_kernel Whether kernel is relocatable or not
-0235/3  N/A     pad2            Unused
+0235/1  N/A     pad2            Unused
+0236/2  N/A     pad3            Unused
 0238/4  2.06+   cmdline_size    Maximum size of the kernel command line
 023C/4  2.07+   hardware_subarch Hardware subarchitecture
 0240/8  2.07+   hardware_subarch_data Subarchitecture-specific data
@@ -299,14 +300,14 @@ Protocol:	2.00+
   e.g. 0x0204 for version 2.04, and 0x0a11 for a hypothetical version
   10.17.
 
-Field name:     readmode_swtch
+Field name:     realmode_swtch
 Type:           modify (optional)
 Offset/size:    0x208/4
 Protocol:       2.00+
 
   Boot loader hook (see ADVANCED BOOT LOADER HOOKS below.)
 
-Field name:     start_sys
+Field name:     start_sys_seg
 Type:           read
 Offset/size:    0x20c/2
 Protocol:       2.00+
@@ -468,7 +469,7 @@ Protocol:	2.02+
   zero, the kernel will assume that your boot loader does not support
   the 2.02+ protocol.
 
-Field name:     initrd_addr_max
+Field name:     ramdisk_max
 Type:           read
 Offset/size:    0x22c/4
 Protocol:       2.03+
diff --git a/MAINTAINERS b/MAINTAINERS
index d992d407197..db65b4e6d13 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -911,7 +911,7 @@ S:	Maintained
 BLACKFIN ARCHITECTURE
 P:      Bryan Wu
 M:      cooloney@kernel.org
-L:      uclinux-dist-devel@blackfin.uclinux.org (subscribers-only)
+L:      uclinux-dist-devel@blackfin.uclinux.org
 W:      http://blackfin.uclinux.org
 S:      Supported
 
@@ -1021,6 +1021,14 @@ M:	mb@bu3sch.de
 W:      http://bu3sch.de/btgpio.php
 S:      Maintained
 
+BTRFS FILE SYSTEM
+P:      Chris Mason
+M:      chris.mason@oracle.com
+L:      linux-btrfs@vger.kernel.org
+W:      http://btrfs.wiki.kernel.org/
+T:      git kernel.org:/pub/scm/linux/kernel/git/mason/btrfs-unstable.git
+S:      Maintained
+
 BTTV VIDEO4LINUX DRIVER
 P:      Mauro Carvalho Chehab
 M:      mchehab@infradead.org
@@ -1194,6 +1202,8 @@ S:	Supported
 CONTROL GROUPS (CGROUPS)
 P:      Paul Menage
 M:      menage@google.com
+P:      Li Zefan
+M:      lizf@cn.fujitsu.com
 L:      containers@lists.linux-foundation.org
 S:      Maintained
 
@@ -2212,7 +2222,7 @@ P:	Sean Hefty
 M:      sean.hefty@intel.com
 P:      Hal Rosenstock
 M:      hal.rosenstock@gmail.com
-L:      general@lists.openfabrics.org
+L:      general@lists.openfabrics.org (moderated for non-subscribers)
 W:      http://www.openib.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/roland/infiniband.git
 S:      Supported
@@ -2836,8 +2846,6 @@ S:	Maintained
 MAC80211
 P:      Johannes Berg
 M:      johannes@sipsolutions.net
-P:      Michael Wu
-M:      flamingice@sourmilk.net
 L:      linux-wireless@vger.kernel.org
 W:      http://linuxwireless.org/
 T:      git kernel.org:/pub/scm/linux/kernel/git/linville/wireless-2.6.git
@@ -3531,6 +3539,12 @@ S:	Maintained
 PXA MMCI DRIVER
 S:      Orphan
 
+PXA RTC DRIVER
+P:      Robert Jarzmik
+M:      robert.jarzmik@free.fr
+L:      rtc-linux@googlegroups.com
+S:      Maintained
+
 QLOGIC QLA2XXX FC-SCSI DRIVER
 P:      Andrew Vasquez
 M:      linux-driver@qlogic.com
@@ -4279,8 +4293,8 @@ P:	Rajiv Andrade
 M:      srajiv@linux.vnet.ibm.com
 W:      http://tpmdd.sourceforge.net
 P:      Marcel Selhorst
-M:      tpm@selhorst.net
-W:      http://www.prosec.rub.de/tpm/
+M:      m.selhorst@sirrix.com
+W:      http://www.sirrix.com
 L:      tpmdd-devel@lists.sourceforge.net (moderated for non-subscribers)
 S:      Maintained
 
@@ -4843,6 +4857,7 @@ P:	Ingo Molnar
 M:      mingo@redhat.com
 P:      H. Peter Anvin
 M:      hpa@zytor.com
+M:      x86@kernel.org
 L:      linux-kernel@vger.kernel.org
 T:      git://git.kernel.org/pub/scm/linux/kernel/git/x86/linux-2.6-x86.git
 S:      Maintained
diff --git a/Makefile b/Makefile
index 7715b2c14fb..77a006dae2d 100644
--- a/Makefile
+++ b/Makefile
@@ -1,7 +1,7 @@
 VERSION = 2
 PATCHLEVEL = 6
 SUBLEVEL = 29
-EXTRAVERSION = -rc3
+EXTRAVERSION = -rc4
 NAME = Erotic Pickled Herring
 
 # *DOCUMENTATION*
@@ -532,8 +532,9 @@ KBUILD_CFLAGS += $(call cc-option,-Wframe-larger-than=${CONFIG_FRAME_WARN})
 endif
 
 # Force gcc to behave correct even for buggy distributions
-# Arch Makefiles may override this setting
+ifndef CONFIG_CC_STACKPROTECTOR
 KBUILD_CFLAGS += $(call cc-option, -fno-stack-protector)
+endif
 
 ifdef CONFIG_FRAME_POINTER
 KBUILD_CFLAGS   += -fno-omit-frame-pointer -fno-optimize-sibling-calls
diff --git a/arch/alpha/include/asm/bug.h b/arch/alpha/include/asm/bug.h
index 7b85b7c9370..1720c8ad86f 100644
--- a/arch/alpha/include/asm/bug.h
+++ b/arch/alpha/include/asm/bug.h
@@ -8,12 +8,12 @@
 
 /* ??? Would be nice to use .gprel32 here, but we can't be sure that the
    function loaded the GP, so this could fail in modules.  */
-#define BUG()   {                                                       \
+#define BUG()   do {                                                    \
         __asm__ __volatile__(                                           \
                 "call_pal %0  # bugchk\n\t"                             \
                 ".long %1\n\t.8byte %2"                                 \
                 : : "i"(PAL_bugchk), "i"(__LINE__), "i"(__FILE__));     \
-        for ( ; ; ); }
+        for ( ; ; ); } while (0)
 
 #define HAVE_ARCH_BUG
 #endif
diff --git a/arch/alpha/kernel/irq.c b/arch/alpha/kernel/irq.c
index 703731accda..7bc7489223f 100644
--- a/arch/alpha/kernel/irq.c
+++ b/arch/alpha/kernel/irq.c
@@ -55,7 +55,7 @@ int irq_select_affinity(unsigned int irq)
                 cpu = (cpu < (NR_CPUS-1) ? cpu + 1 : 0);
         last_cpu = cpu;
 
-        irq_desc[irq].affinity = cpumask_of_cpu(cpu);
+        cpumask_copy(irq_desc[irq].affinity, cpumask_of(cpu));
         irq_desc[irq].chip->set_affinity(irq, cpumask_of(cpu));
         return 0;
 }
diff --git a/arch/arm/kernel/entry-armv.S b/arch/arm/kernel/entry-armv.S
index 77b04747553..85040cfeb5e 100644
--- a/arch/arm/kernel/entry-armv.S
+++ b/arch/arm/kernel/entry-armv.S
@@ -650,6 +650,7 @@ ENTRY(fp_enter)
 no_fp:  mov     pc, lr
 
 __und_usr_unknown:
+        enable_irq
         mov     r0, sp
         adr     lr, ret_from_exception
         b       do_undefinstr
diff --git a/arch/arm/kernel/entry-common.S b/arch/arm/kernel/entry-common.S
index 06269ea375c..49a6ba926c2 100644
--- a/arch/arm/kernel/entry-common.S
+++ b/arch/arm/kernel/entry-common.S
@@ -136,7 +136,7 @@ ENTRY(mcount)
         ldmia sp!, {r0-r3, pc}
 
 trace:
-        ldr r1, [fp, #-4]
+        ldr r1, [fp, #-4]                       @ lr of instrumented routine
         mov r0, lr
         sub r0, r0, #MCOUNT_INSN_SIZE
         mov lr, pc
diff --git a/arch/arm/kernel/irq.c b/arch/arm/kernel/irq.c
index 7141cee1fab..45eacb5a2ec 100644
--- a/arch/arm/kernel/irq.c
+++ b/arch/arm/kernel/irq.c
@@ -101,9 +101,14 @@ unlock:
 /* Handle bad interrupts */
 static struct irq_desc bad_irq_desc = {
         .handle_irq = handle_bad_irq,
-        .lock = SPIN_LOCK_UNLOCKED
+        .lock = __SPIN_LOCK_UNLOCKED(bad_irq_desc.lock),
 };
 
+#ifdef CONFIG_CPUMASK_OFFSTACK
+/* We are not allocating bad_irq_desc.affinity or .pending_mask */
+#error "ARM architecture does not support CONFIG_CPUMASK_OFFSTACK."
+#endif
+
 /*
  * do_IRQ handles all hardware IRQ's.  Decoded IRQs should not
  * come via this function.  Instead, they should provide their
@@ -161,7 +166,7 @@ void __init init_IRQ(void)
                 irq_desc[irq].status |= IRQ_NOREQUEST | IRQ_NOPROBE;
 
 #ifdef CONFIG_SMP
-        bad_irq_desc.affinity = CPU_MASK_ALL;
+        cpumask_setall(bad_irq_desc.affinity);
         bad_irq_desc.cpu = smp_processor_id();
 #endif
         init_arch_irq();
@@ -191,15 +196,16 @@ void migrate_irqs(void)
                 struct irq_desc *desc = irq_desc + i;
 
                 if (desc->cpu == cpu) {
-                        unsigned int newcpu = any_online_cpu(desc->affinity);
-
-                        if (newcpu == NR_CPUS) {
+                        unsigned int newcpu = cpumask_any_and(desc->affinity,
+                                                              cpu_online_mask);
+                        if (newcpu >= nr_cpu_ids) {
                                 if (printk_ratelimit())
                                         printk(KERN_INFO "IRQ%u no longer affine to CPU%u\n",
                                                i, cpu);
 
-                                cpus_setall(desc->affinity);
-                                newcpu = any_online_cpu(desc->affinity);
+                                cpumask_setall(desc->affinity);
+                                newcpu = cpumask_any_and(desc->affinity,
+                                                         cpu_online_mask);
                         }
 
                         route_irq(desc, i, newcpu);
diff --git a/arch/arm/kernel/machine_kexec.c b/arch/arm/kernel/machine_kexec.c
index 440dc62cdc3..598ca61e7bc 100644
--- a/arch/arm/kernel/machine_kexec.c
+++ b/arch/arm/kernel/machine_kexec.c
@@ -13,8 +13,8 @@
 #include <asm/cacheflush.h>
 #include <asm/mach-types.h>
 
-const extern unsigned char relocate_new_kernel[];
-const extern unsigned int relocate_new_kernel_size;
+extern const unsigned char relocate_new_kernel[];
+extern const unsigned int relocate_new_kernel_size;
 
 extern void setup_mm_for_reboot(char mode);
 
diff --git a/arch/arm/kernel/vmlinux.lds.S b/arch/arm/kernel/vmlinux.lds.S
index 00216071eaf..85598f7da40 100644
--- a/arch/arm/kernel/vmlinux.lds.S
+++ b/arch/arm/kernel/vmlinux.lds.S
@@ -65,6 +65,7 @@ SECTIONS
 #endif
                 . = ALIGN(4096);
                 __per_cpu_start = .;
+                        *(.data.percpu.page_aligned)
                         *(.data.percpu)
                         *(.data.percpu.shared_aligned)
                 __per_cpu_end = .;
diff --git a/arch/arm/mach-msm/board-halibut.c b/arch/arm/mach-msm/board-halibut.c
index c2a96e3965a..e61967dde9a 100644
--- a/arch/arm/mach-msm/board-halibut.c
+++ b/arch/arm/mach-msm/board-halibut.c
@@ -27,6 +27,7 @@
 #include <asm/mach/map.h>
 #include <asm/mach/flash.h>
 
+#include <mach/irqs.h>
 #include <mach/board.h>
 #include <mach/msm_iomap.h>
 
diff --git a/arch/arm/mach-omap1/devices.c b/arch/arm/mach-omap1/devices.c
index 77382d8b6b2..ba5d7c08dc1 100644
--- a/arch/arm/mach-omap1/devices.c
+++ b/arch/arm/mach-omap1/devices.c
@@ -181,7 +181,7 @@ void __init omap1_init_mmc(struct omap_mmc_platform_data **mmc_data,
                 }
                 size = OMAP1_MMC_SIZE;
 
-                omap_mmc_add(i, base, size, irq, mmc_data[i]);
+                omap_mmc_add("mmci-omap", i, base, size, irq, mmc_data[i]);
         };
 }
 
diff --git a/arch/arm/mach-omap1/mcbsp.c b/arch/arm/mach-omap1/mcbsp.c
index ca7a0cc1707..575ba31295c 100644
--- a/arch/arm/mach-omap1/mcbsp.c
+++ b/arch/arm/mach-omap1/mcbsp.c
@@ -28,81 +28,8 @@
 #define DPS_RSTCT2_PER_EN       (1 << 0)
 #define DSP_RSTCT2_WD_PER_EN    (1 << 1)
 
-struct mcbsp_internal_clk {
-        struct clk clk;
-        struct clk **childs;
-        int n_childs;
-};
-
 #if defined(CONFIG_ARCH_OMAP15XX) || defined(CONFIG_ARCH_OMAP16XX)
-static void omap_mcbsp_clk_init(struct mcbsp_internal_clk *mclk)
-{
-        const char *clk_names[] = { "dsp_ck", "api_ck", "dspxor_ck" };
-        int i;
-
-        mclk->n_childs = ARRAY_SIZE(clk_names);
-        mclk->childs = kzalloc(mclk->n_childs * sizeof(struct clk *),
-                                GFP_KERNEL);
-
-        for (i = 0; i < mclk->n_childs; i++) {
-                /* We fake a platform device to get correct device id */
-                struct platform_device pdev;
-
-                pdev.dev.bus = &platform_bus_type;
-                pdev.id = mclk->clk.id;
-                mclk->childs[i] = clk_get(&pdev.dev, clk_names[i]);
-                if (IS_ERR(mclk->childs[i]))
-                        printk(KERN_ERR "Could not get clock %s (%d).\n",
-                                clk_names[i], mclk->clk.id);
-        }
-}
-
-static int omap_mcbsp_clk_enable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_enable(mclk->childs[i]);
-        return 0;
-}
-
-static void omap_mcbsp_clk_disable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_disable(mclk->childs[i]);
-}
-
-static struct mcbsp_internal_clk omap_mcbsp_clks[] = {
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 1,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 3,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-};
-
-#define omap_mcbsp_clks_size    ARRAY_SIZE(omap_mcbsp_clks)
-#else
-#define omap_mcbsp_clks_size    0
-static struct mcbsp_internal_clk __initdata *omap_mcbsp_clks;
-static inline void omap_mcbsp_clk_init(struct mcbsp_internal_clk *mclk)
-{ }
+const char *clk_names[] = { "dsp_ck", "api_ck", "dspxor_ck" };
 #endif
 
 static void omap1_mcbsp_request(unsigned int id)
@@ -167,8 +94,9 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_McBSP1RX,
                 .tx_irq         = INT_McBSP1TX,
                 .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
-                },
+                .clk_names      = clk_names,
+                .num_clks       = 3,
+        },
         {
                 .phys_base      = OMAP1510_MCBSP2_BASE,
                 .dma_rx_sync    = OMAP_DMA_MCBSP2_RX,
@@ -184,7 +112,8 @@ static struct omap_mcbsp_platform_data omap15xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_McBSP3RX,
                 .tx_irq         = INT_McBSP3TX,
                 .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 3,
         },
 };
 #define OMAP15XX_MCBSP_PDATA_SZ         ARRAY_SIZE(omap15xx_mcbsp_pdata)
@@ -202,7 +131,8 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_McBSP1RX,
                 .tx_irq         = INT_McBSP1TX,
                 .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 3,
         },
         {
                 .phys_base      = OMAP1610_MCBSP2_BASE,
@@ -219,7 +149,8 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_McBSP3RX,
                 .tx_irq         = INT_McBSP3TX,
                 .ops            = &omap1_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 3,
         },
 };
 #define OMAP16XX_MCBSP_PDATA_SZ         ARRAY_SIZE(omap16xx_mcbsp_pdata)
@@ -230,15 +161,6 @@ static struct omap_mcbsp_platform_data omap16xx_mcbsp_pdata[] = {
 
 int __init omap1_mcbsp_init(void)
 {
-        int i;
-
-        for (i = 0; i < omap_mcbsp_clks_size; i++) {
-                if (cpu_is_omap15xx() || cpu_is_omap16xx()) {
-                        omap_mcbsp_clk_init(&omap_mcbsp_clks[i]);
-                        clk_register(&omap_mcbsp_clks[i].clk);
-                }
-        }
-
         if (cpu_is_omap730())
                 omap_mcbsp_count = OMAP730_MCBSP_PDATA_SZ;
         if (cpu_is_omap15xx())
diff --git a/arch/arm/mach-omap2/devices.c b/arch/arm/mach-omap2/devices.c
index 9d7216ff6c9..ce03fa75077 100644
--- a/arch/arm/mach-omap2/devices.c
+++ b/arch/arm/mach-omap2/devices.c
@@ -421,6 +421,7 @@ void __init omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                         int nr_controllers)
 {
         int i;
+        char *name;
 
         for (i = 0; i < nr_controllers; i++) {
                 unsigned long base, size;
@@ -450,12 +451,14 @@ void __init omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                         continue;
                 }
 
-                if (cpu_is_omap2420())
+                if (cpu_is_omap2420()) {
                         size = OMAP2420_MMC_SIZE;
-                else
+                        name = "mmci-omap";
+                } else {
                         size = HSMMC_SIZE;
-
-                omap_mmc_add(i, base, size, irq, mmc_data[i]);
+                        name = "mmci-omap-hs";
+                }
+                omap_mmc_add(name, i, base, size, irq, mmc_data[i]);
         };
 }
 
diff --git a/arch/arm/mach-omap2/id.c b/arch/arm/mach-omap2/id.c
index b0f8e7d6279..b52a02fc7cd 100644
--- a/arch/arm/mach-omap2/id.c
+++ b/arch/arm/mach-omap2/id.c
@@ -172,9 +172,13 @@ void __init omap34xx_check_revision(void)
                         omap_revision = OMAP3430_REV_ES3_0;
                         rev_name = "ES3.0";
                         break;
+                case 4:
+                        omap_revision = OMAP3430_REV_ES3_1;
+                        rev_name = "ES3.1";
+                        break;
                 default:
                         /* Use the latest known revision as default */
-                        omap_revision = OMAP3430_REV_ES3_0;
+                        omap_revision = OMAP3430_REV_ES3_1;
                         rev_name = "Unknown revision\n";
                 }
         }
diff --git a/arch/arm/mach-omap2/irq.c b/arch/arm/mach-omap2/irq.c
index 636e2821af7..9ba20d985dd 100644
--- a/arch/arm/mach-omap2/irq.c
+++ b/arch/arm/mach-omap2/irq.c
@@ -134,6 +134,7 @@ static struct irq_chip omap_irq_chip = {
         .ack    = omap_mask_ack_irq,
         .mask   = omap_mask_irq,
         .unmask = omap_unmask_irq,
+        .disable = omap_mask_irq,
 };
 
 static void __init omap_irq_bank_init_one(struct omap_irq_bank *bank)
diff --git a/arch/arm/mach-omap2/mcbsp.c b/arch/arm/mach-omap2/mcbsp.c
index e20023c9d15..a9e631fc113 100644
--- a/arch/arm/mach-omap2/mcbsp.c
+++ b/arch/arm/mach-omap2/mcbsp.c
@@ -24,106 +24,7 @@
 #include <mach/cpu.h>
 #include <mach/mcbsp.h>
 
-struct mcbsp_internal_clk {
-        struct clk clk;
-        struct clk **childs;
-        int n_childs;
-};
-
-#if defined(CONFIG_ARCH_OMAP24XX) || defined(CONFIG_ARCH_OMAP34XX)
-static void omap_mcbsp_clk_init(struct mcbsp_internal_clk *mclk)
-{
-        const char *clk_names[] = { "mcbsp_ick", "mcbsp_fck" };
-        int i;
-
-        mclk->n_childs = ARRAY_SIZE(clk_names);
-        mclk->childs = kzalloc(mclk->n_childs * sizeof(struct clk *),
-                                GFP_KERNEL);
-
-        for (i = 0; i < mclk->n_childs; i++) {
-                /* We fake a platform device to get correct device id */
-                struct platform_device pdev;
-
-                pdev.dev.bus = &platform_bus_type;
-                pdev.id = mclk->clk.id;
-                mclk->childs[i] = clk_get(&pdev.dev, clk_names[i]);
-                if (IS_ERR(mclk->childs[i]))
-                        printk(KERN_ERR "Could not get clock %s (%d).\n",
-                                clk_names[i], mclk->clk.id);
-        }
-}
-
-static int omap_mcbsp_clk_enable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_enable(mclk->childs[i]);
-        return 0;
-}
-
-static void omap_mcbsp_clk_disable(struct clk *clk)
-{
-        struct mcbsp_internal_clk *mclk = container_of(clk,
-                                        struct mcbsp_internal_clk, clk);
-        int i;
-
-        for (i = 0; i < mclk->n_childs; i++)
-                clk_disable(mclk->childs[i]);
-}
-
-static struct mcbsp_internal_clk omap_mcbsp_clks[] = {
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 1,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 2,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 3,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 4,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-        {
-                .clk = {
-                        .name           = "mcbsp_clk",
-                        .id             = 5,
-                        .enable         = omap_mcbsp_clk_enable,
-                        .disable        = omap_mcbsp_clk_disable,
-                },
-        },
-};
-
-#define omap_mcbsp_clks_size    ARRAY_SIZE(omap_mcbsp_clks)
-#else
-#define omap_mcbsp_clks_size    0
-static struct mcbsp_internal_clk __initdata *omap_mcbsp_clks;
-static inline void omap_mcbsp_clk_init(struct clk *clk)
-{ }
-#endif
+const char *clk_names[] = { "mcbsp_ick", "mcbsp_fck" };
 
 static void omap2_mcbsp2_mux_setup(void)
 {
@@ -156,7 +57,8 @@ static struct omap_mcbsp_platform_data omap2420_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP1_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP1_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP24XX_MCBSP2_BASE,
@@ -165,7 +67,8 @@ static struct omap_mcbsp_platform_data omap2420_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP2_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP2_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
 };
 #define OMAP2420_MCBSP_PDATA_SZ         ARRAY_SIZE(omap2420_mcbsp_pdata)
@@ -183,7 +86,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP1_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP1_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP24XX_MCBSP2_BASE,
@@ -192,7 +96,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP2_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP2_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP2430_MCBSP3_BASE,
@@ -201,7 +106,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP3_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP3_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP2430_MCBSP4_BASE,
@@ -210,7 +116,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP4_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP4_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP2430_MCBSP5_BASE,
@@ -219,7 +126,8 @@ static struct omap_mcbsp_platform_data omap2430_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP5_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP5_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
 };
 #define OMAP2430_MCBSP_PDATA_SZ         ARRAY_SIZE(omap2430_mcbsp_pdata)
@@ -237,7 +145,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP1_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP1_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP34XX_MCBSP2_BASE,
@@ -246,7 +155,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP2_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP2_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP34XX_MCBSP3_BASE,
@@ -255,7 +165,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP3_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP3_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP34XX_MCBSP4_BASE,
@@ -264,7 +175,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP4_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP4_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
         {
                 .phys_base      = OMAP34XX_MCBSP5_BASE,
@@ -273,7 +185,8 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
                 .rx_irq         = INT_24XX_MCBSP5_IRQ_RX,
                 .tx_irq         = INT_24XX_MCBSP5_IRQ_TX,
                 .ops            = &omap2_mcbsp_ops,
-                .clk_name       = "mcbsp_clk",
+                .clk_names      = clk_names,
+                .num_clks       = 2,
         },
 };
 #define OMAP34XX_MCBSP_PDATA_SZ         ARRAY_SIZE(omap34xx_mcbsp_pdata)
@@ -284,14 +197,6 @@ static struct omap_mcbsp_platform_data omap34xx_mcbsp_pdata[] = {
 
 static int __init omap2_mcbsp_init(void)
 {
-        int i;
-
-        for (i = 0; i < omap_mcbsp_clks_size; i++) {
-                /* Once we call clk_get inside init, we do not register it */
-                omap_mcbsp_clk_init(&omap_mcbsp_clks[i]);
-                clk_register(&omap_mcbsp_clks[i].clk);
-        }
-
         if (cpu_is_omap2420())
                 omap_mcbsp_count = OMAP2420_MCBSP_PDATA_SZ;
         if (cpu_is_omap2430())
diff --git a/arch/arm/mach-omap2/sleep24xx.S b/arch/arm/mach-omap2/sleep24xx.S
index 43336b93b21..bf9e96105e1 100644
--- a/arch/arm/mach-omap2/sleep24xx.S
+++ b/arch/arm/mach-omap2/sleep24xx.S
@@ -93,9 +93,8 @@ ENTRY(omap24xx_cpu_suspend)
         orr     r4, r4, #0x40           @ enable self refresh on idle req
         mov     r5, #0x2000             @ set delay (DPLL relock + DLL relock)
         str     r4, [r2]                @ make it so
-        mov     r2, #0
         nop
-        mcr     p15, 0, r2, c7, c0, 4   @ wait for interrupt
+        mcr     p15, 0, r3, c7, c0, 4   @ wait for interrupt
         nop
 loop:
         subs    r5, r5, #0x1            @ awake, wait just a bit
diff --git a/arch/arm/mach-omap2/timer-gp.c b/arch/arm/mach-omap2/timer-gp.c
index ae6036300f6..9fc13a2cc3f 100644
--- a/arch/arm/mach-omap2/timer-gp.c
+++ b/arch/arm/mach-omap2/timer-gp.c
@@ -118,7 +118,8 @@ static void __init omap2_gp_clockevent_init(void)
         clockevent_gpt.max_delta_ns =
                 clockevent_delta2ns(0xffffffff, &clockevent_gpt);
         clockevent_gpt.min_delta_ns =
-                clockevent_delta2ns(1, &clockevent_gpt);
+                clockevent_delta2ns(3, &clockevent_gpt);
+                /* Timer internal resynch latency. */
 
         clockevent_gpt.cpumask = cpumask_of(0);
         clockevents_register_device(&clockevent_gpt);
diff --git a/arch/arm/mach-pxa/dma.c b/arch/arm/mach-pxa/dma.c
index b1514fb20d3..7de17fc5d54 100644
--- a/arch/arm/mach-pxa/dma.c
+++ b/arch/arm/mach-pxa/dma.c
@@ -121,20 +121,22 @@ int __init pxa_init_dma(int num_ch)
         if (dma_channels == NULL)
                 return -ENOMEM;
 
-        ret = request_irq(IRQ_DMA, dma_irq_handler, IRQF_DISABLED, "DMA", NULL);
-        if (ret) {
-                printk (KERN_CRIT "Wow!  Can't register IRQ for DMA\n");
-                kfree(dma_channels);
-                return ret;
-        }
-
         /* dma channel priorities on pxa2xx processors:
          * ch 0 - 3,  16 - 19  <--> (0) DMA_PRIO_HIGH
          * ch 4 - 7,  20 - 23  <--> (1) DMA_PRIO_MEDIUM
          * ch 8 - 15, 24 - 31  <--> (2) DMA_PRIO_LOW
          */
-        for (i = 0; i < num_ch; i++)
+        for (i = 0; i < num_ch; i++) {
+                DCSR(i) = 0;
                 dma_channels[i].prio = min((i & 0xf) >> 2, DMA_PRIO_LOW);
+        }
+
+        ret = request_irq(IRQ_DMA, dma_irq_handler, IRQF_DISABLED, "DMA", NULL);
+        if (ret) {
+                printk (KERN_CRIT "Wow!  Can't register IRQ for DMA\n");
+                kfree(dma_channels);
+                return ret;
+        }
 
         num_dma_channels = num_ch;
         return 0;
diff --git a/arch/arm/mach-pxa/include/mach/regs-ac97.h b/arch/arm/mach-pxa/include/mach/regs-ac97.h
index e41b9d202b8..b8d14bd9ae5 100644
--- a/arch/arm/mach-pxa/include/mach/regs-ac97.h
+++ b/arch/arm/mach-pxa/include/mach/regs-ac97.h
@@ -1,6 +1,8 @@
 #ifndef __ASM_ARCH_REGS_AC97_H
 #define __ASM_ARCH_REGS_AC97_H
 
+#include <mach/hardware.h>
+
 /*
  * AC97 Controller registers
  */
diff --git a/arch/arm/mach-pxa/include/mach/regs-ssp.h b/arch/arm/mach-pxa/include/mach/regs-ssp.h
index 3c04cde2cf1..cf31986f6f0 100644
--- a/arch/arm/mach-pxa/include/mach/regs-ssp.h
+++ b/arch/arm/mach-pxa/include/mach/regs-ssp.h
@@ -41,6 +41,9 @@
 #elif defined(CONFIG_PXA27x) || defined(CONFIG_PXA3xx)
 #define SSCR0_SCR       (0x000fff00)    /* Serial Clock Rate (mask) */
 #define SSCR0_SerClkDiv(x) (((x) - 1) << 8) /* Divisor [1..4096] */
+#endif
+
+#if defined(CONFIG_PXA27x) || defined(CONFIG_PXA3xx)
 #define SSCR0_EDSS      (1 << 20)       /* Extended data size select */
 #define SSCR0_NCS       (1 << 21)       /* Network clock select */
 #define SSCR0_RIM       (1 << 22)       /* Receive FIFO overrrun interrupt mask */
diff --git a/arch/arm/mach-pxa/pxa300.c b/arch/arm/mach-pxa/pxa300.c
index f735e58e666..83fb609b6eb 100644
--- a/arch/arm/mach-pxa/pxa300.c
+++ b/arch/arm/mach-pxa/pxa300.c
@@ -88,13 +88,13 @@ static struct pxa3xx_mfp_addr_map pxa310_mfp_addr_map[] __initdata = {
 static DEFINE_PXA3_CKEN(common_nand, NAND, 156000000, 0);
 
 static struct clk_lookup common_clkregs[] = {
-        INIT_CLKREG(&clk_common_nand, "pxa3xx-nand", "NANDCLK"),
+        INIT_CLKREG(&clk_common_nand, "pxa3xx-nand", NULL),
 };
 
 static DEFINE_PXA3_CKEN(pxa310_mmc3, MMC3, 19500000, 0);
 
 static struct clk_lookup pxa310_clkregs[] = {
-        INIT_CLKREG(&clk_pxa310_mmc3, "pxa2xx-mci.2", "MMCCLK"),
+        INIT_CLKREG(&clk_pxa310_mmc3, "pxa2xx-mci.2", NULL),
 };
 
 static int __init pxa300_init(void)
diff --git a/arch/arm/mach-pxa/pxa320.c b/arch/arm/mach-pxa/pxa320.c
index effe408c186..36f066196fa 100644
--- a/arch/arm/mach-pxa/pxa320.c
+++ b/arch/arm/mach-pxa/pxa320.c
@@ -83,7 +83,7 @@ static struct pxa3xx_mfp_addr_map pxa320_mfp_addr_map[] __initdata = {
 static DEFINE_PXA3_CKEN(pxa320_nand, NAND, 104000000, 0);
 
 static struct clk_lookup pxa320_clkregs[] = {
-        INIT_CLKREG(&clk_pxa320_nand, "pxa3xx-nand", "NANDCLK"),
+        INIT_CLKREG(&clk_pxa320_nand, "pxa3xx-nand", NULL),
 };
 
 static int __init pxa320_init(void)
diff --git a/arch/arm/mach-sa1100/generic.c b/arch/arm/mach-sa1100/generic.c
index c1fbd5b5f9c..23cfdd59395 100644
--- a/arch/arm/mach-sa1100/generic.c
+++ b/arch/arm/mach-sa1100/generic.c
@@ -289,7 +289,7 @@ static struct platform_device sa11x0pcmcia_device = {
 };
 
 static struct platform_device sa11x0mtd_device = {
-        .name           = "flash",
+        .name           = "sa1100-mtd",
         .id             = -1,
 };
 
diff --git a/arch/arm/mm/fault-armv.c b/arch/arm/mm/fault-armv.c
index 81d0b8772de..bc0099d5ae8 100644
--- a/arch/arm/mm/fault-armv.c
+++ b/arch/arm/mm/fault-armv.c
@@ -66,7 +66,10 @@ static int adjust_pte(struct vm_area_struct *vma, unsigned long address)
          * fault (ie, is old), we can safely ignore any issues.
          */
         if (ret && (pte_val(entry) & L_PTE_MT_MASK) != shared_pte_mask) {
-                flush_cache_page(vma, address, pte_pfn(entry));
+                unsigned long pfn = pte_pfn(entry);
+                flush_cache_page(vma, address, pfn);
+                outer_flush_range((pfn << PAGE_SHIFT),
+                                  (pfn << PAGE_SHIFT) + PAGE_SIZE);
                 pte_val(entry) &= ~L_PTE_MT_MASK;
                 pte_val(entry) |= shared_pte_mask;
                 set_pte_at(vma->vm_mm, address, pte, entry);
diff --git a/arch/arm/oprofile/op_model_mpcore.c b/arch/arm/oprofile/op_model_mpcore.c
index 6d6bd589924..853d42bb868 100644
--- a/arch/arm/oprofile/op_model_mpcore.c
+++ b/arch/arm/oprofile/op_model_mpcore.c
@@ -263,7 +263,7 @@ static void em_route_irq(int irq, unsigned int cpu)
         const struct cpumask *mask = cpumask_of(cpu);
 
         spin_lock_irq(&desc->lock);
-        desc->affinity = *mask;
+        cpumask_copy(desc->affinity, mask);
         desc->chip->set_affinity(irq, mask);
         spin_unlock_irq(&desc->lock);
 }
diff --git a/arch/arm/plat-mxc/include/mach/mmc.h b/arch/arm/plat-mxc/include/mach/mmc.h
new file mode 100644
index 00000000000..de2128dada5
--- /dev/null
+++ b/arch/arm/plat-mxc/include/mach/mmc.h
@@ -0,0 +1,36 @@
+#ifndef ASMARM_ARCH_MMC_H
+#define ASMARM_ARCH_MMC_H
+
+#include <linux/mmc/host.h>
+
+struct device;
+
+/* board specific SDHC data, optional.
+ * If not present, a writable card with 3,3V is assumed.
+ */
+struct imxmmc_platform_data {
+        /* Return values for the get_ro callback should be:
+         *   0 for a read/write card
+         *   1 for a read-only card
+         *   -ENOSYS when not supported (equal to NULL callback)
+         *   or a negative errno value when something bad happened
+         */
+        int (*get_ro)(struct device *);
+
+        /* board specific hook to (de)initialize the SD slot.
+         * The board code can call 'handler' on a card detection
+         * change giving data as argument.
+         */
+        int (*init)(struct device *dev, irq_handler_t handler, void *data);
+        void (*exit)(struct device *dev, void *data);
+
+        /* available voltages. If not given, assume
+         * MMC_VDD_32_33 | MMC_VDD_33_34
+         */
+        unsigned int ocr_avail;
+
+        /* adjust slot voltage */
+        void (*setpower)(struct device *, unsigned int vdd);
+};
+
+#endif
diff --git a/arch/arm/plat-omap/devices.c b/arch/arm/plat-omap/devices.c
index ac15c23fd5d..208dbb121f4 100644
--- a/arch/arm/plat-omap/devices.c
+++ b/arch/arm/plat-omap/devices.c
@@ -200,14 +200,15 @@ void omap_mcbsp_register_board_cfg(struct omap_mcbsp_platform_data *config,
 /*
  * Register MMC devices. Called from mach-omap1 and mach-omap2 device init.
  */
-int __init omap_mmc_add(int id, unsigned long base, unsigned long size,
-                unsigned int irq, struct omap_mmc_platform_data *data)
+int __init omap_mmc_add(const char *name, int id, unsigned long base,
+                                unsigned long size, unsigned int irq,
+                                struct omap_mmc_platform_data *data)
 {
         struct platform_device *pdev;
         struct resource res[OMAP_MMC_NR_RES];
         int ret;
 
-        pdev = platform_device_alloc("mmci-omap", id);
+        pdev = platform_device_alloc(name, id);
         if (!pdev)
                 return -ENOMEM;
 
diff --git a/arch/arm/plat-omap/dma.c b/arch/arm/plat-omap/dma.c
index e77373c39f8..47ec77af4cc 100644
--- a/arch/arm/plat-omap/dma.c
+++ b/arch/arm/plat-omap/dma.c
@@ -709,6 +709,7 @@ int omap_request_dma(int dev_id, const char *dev_name,
         chan->dev_name = dev_name;
         chan->callback = callback;
         chan->data = data;
+        chan->flags = 0;
 
 #ifndef CONFIG_ARCH_OMAP1
         if (cpu_class_is_omap2()) {
@@ -1888,11 +1889,11 @@ static int omap2_dma_handle_ch(int ch)
                 status = dma_read(CSR(ch));
         }
 
+        dma_write(status, CSR(ch));
+
         if (likely(dma_chan[ch].callback != NULL))
                 dma_chan[ch].callback(ch, status, dma_chan[ch].data);
 
-        dma_write(status, CSR(ch));
-
         return 0;
 }
 
diff --git a/arch/arm/plat-omap/include/mach/cpu.h b/arch/arm/plat-omap/include/mach/cpu.h
index b2062f1175d..a8e1178a946 100644
--- a/arch/arm/plat-omap/include/mach/cpu.h
+++ b/arch/arm/plat-omap/include/mach/cpu.h
@@ -339,6 +339,7 @@ IS_OMAP_TYPE(3430, 0x3430)
 #define OMAP3430_REV_ES2_0      0x34301034
 #define OMAP3430_REV_ES2_1      0x34302034
 #define OMAP3430_REV_ES3_0      0x34303034
+#define OMAP3430_REV_ES3_1      0x34304034
 
 /*
  * omap_chip bits
diff --git a/arch/arm/plat-omap/include/mach/mcbsp.h b/arch/arm/plat-omap/include/mach/mcbsp.h
index eef873db3d4..113c2466c86 100644
--- a/arch/arm/plat-omap/include/mach/mcbsp.h
+++ b/arch/arm/plat-omap/include/mach/mcbsp.h
@@ -344,7 +344,8 @@ struct omap_mcbsp_platform_data {
         u8 dma_rx_sync, dma_tx_sync;
         u16 rx_irq, tx_irq;
         struct omap_mcbsp_ops *ops;
-        char const *clk_name;
+        char const **clk_names;
+        int num_clks;
 };
 
 struct omap_mcbsp {
@@ -376,7 +377,8 @@ struct omap_mcbsp {
         /* Protect the field .free, while checking if the mcbsp is in use */
         spinlock_t lock;
         struct omap_mcbsp_platform_data *pdata;
-        struct clk *clk;
+        struct clk **clks;
+        int num_clks;
 };
 extern struct omap_mcbsp **mcbsp_ptr;
 extern int omap_mcbsp_count;
diff --git a/arch/arm/plat-omap/include/mach/mmc.h b/arch/arm/plat-omap/include/mach/mmc.h
index 031250f0280..73a9e15031b 100644
--- a/arch/arm/plat-omap/include/mach/mmc.h
+++ b/arch/arm/plat-omap/include/mach/mmc.h
@@ -115,8 +115,9 @@ void omap1_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                 int nr_controllers);
 void omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                 int nr_controllers);
-int omap_mmc_add(int id, unsigned long base, unsigned long size,
-                        unsigned int irq, struct omap_mmc_platform_data *data);
+int omap_mmc_add(const char *name, int id, unsigned long base,
+                                unsigned long size, unsigned int irq,
+                                struct omap_mmc_platform_data *data);
 #else
 static inline void omap1_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                 int nr_controllers)
@@ -126,8 +127,9 @@ static inline void omap2_init_mmc(struct omap_mmc_platform_data **mmc_data,
                                 int nr_controllers)
 {
 }
-static inline int omap_mmc_add(int id, unsigned long base, unsigned long size,
-                unsigned int irq, struct omap_mmc_platform_data *data)
+static inline int omap_mmc_add(const char *name, int id, unsigned long base,
+                                unsigned long size, unsigned int irq,
+                                struct omap_mmc_platform_data *data)
 {
         return 0;
 }
diff --git a/arch/arm/plat-omap/mcbsp.c b/arch/arm/plat-omap/mcbsp.c
index f2401a831f9..e5842e30e53 100644
--- a/arch/arm/plat-omap/mcbsp.c
+++ b/arch/arm/plat-omap/mcbsp.c
@@ -214,6 +214,7 @@ EXPORT_SYMBOL(omap_mcbsp_set_io_type);
 int omap_mcbsp_request(unsigned int id)
 {
         struct omap_mcbsp *mcbsp;
+        int i;
         int err;
 
         if (!omap_mcbsp_check_valid_id(id)) {
@@ -225,7 +226,8 @@ int omap_mcbsp_request(unsigned int id)
         if (mcbsp->pdata && mcbsp->pdata->ops && mcbsp->pdata->ops->request)
                 mcbsp->pdata->ops->request(id);
 
-        clk_enable(mcbsp->clk);
+        for (i = 0; i < mcbsp->num_clks; i++)
+                clk_enable(mcbsp->clks[i]);
 
         spin_lock(&mcbsp->lock);
         if (!mcbsp->free) {
@@ -276,6 +278,7 @@ EXPORT_SYMBOL(omap_mcbsp_request);
 void omap_mcbsp_free(unsigned int id)
 {
         struct omap_mcbsp *mcbsp;
+        int i;
 
         if (!omap_mcbsp_check_valid_id(id)) {
                 printk(KERN_ERR "%s: Invalid id (%d)\n", __func__, id + 1);
@@ -286,7 +289,8 @@ void omap_mcbsp_free(unsigned int id)
         if (mcbsp->pdata && mcbsp->pdata->ops && mcbsp->pdata->ops->free)
                 mcbsp->pdata->ops->free(id);
 
-        clk_disable(mcbsp->clk);
+        for (i = mcbsp->num_clks - 1; i >= 0; i--)
+                clk_disable(mcbsp->clks[i]);
 
         spin_lock(&mcbsp->lock);
         if (mcbsp->free) {
@@ -872,6 +876,7 @@ static int __devinit omap_mcbsp_probe(struct platform_device *pdev)
         struct omap_mcbsp_platform_data *pdata = pdev->dev.platform_data;
         struct omap_mcbsp *mcbsp;
         int id = pdev->id - 1;
+        int i;
         int ret = 0;
 
         if (!pdata) {
@@ -916,14 +921,25 @@ static int __devinit omap_mcbsp_probe(struct platform_device *pdev)
         mcbsp->dma_rx_sync = pdata->dma_rx_sync;
         mcbsp->dma_tx_sync = pdata->dma_tx_sync;
 
-        if (pdata->clk_name)
-                mcbsp->clk = clk_get(&pdev->dev, pdata->clk_name);
-        if (IS_ERR(mcbsp->clk)) {
-                dev_err(&pdev->dev,
-                        "Invalid clock configuration for McBSP%d.\n",
-                        mcbsp->id);
-                ret = PTR_ERR(mcbsp->clk);
-                goto err_clk;
+        if (pdata->num_clks) {
+                mcbsp->num_clks = pdata->num_clks;
+                mcbsp->clks = kzalloc(mcbsp->num_clks * sizeof(struct clk *),
+                                        GFP_KERNEL);
+                if (!mcbsp->clks) {
+                        ret = -ENOMEM;
+                        goto exit;
+                }
+                for (i = 0; i < mcbsp->num_clks; i++) {
+                        mcbsp->clks[i] = clk_get(&pdev->dev, pdata->clk_names[i]);
+                        if (IS_ERR(mcbsp->clks[i])) {
+                                dev_err(&pdev->dev,
+                                        "Invalid %s configuration for McBSP%d.\n",
+                                        pdata->clk_names[i], mcbsp->id);
+                                ret = PTR_ERR(mcbsp->clks[i]);
+                                goto err_clk;
+                        }
+                }
+
         }
 
         mcbsp->pdata = pdata;
@@ -932,6 +948,9 @@ static int __devinit omap_mcbsp_probe(struct platform_device *pdev)
         return 0;
 
 err_clk:
+        while (i--)
+                clk_put(mcbsp->clks[i]);
+        kfree(mcbsp->clks);
         iounmap(mcbsp->io_base);
 err_ioremap:
         mcbsp->free = 0;
@@ -942,6 +961,7 @@ exit:
 static int __devexit omap_mcbsp_remove(struct platform_device *pdev)
 {
         struct omap_mcbsp *mcbsp = platform_get_drvdata(pdev);
+        int i;
 
         platform_set_drvdata(pdev, NULL);
         if (mcbsp) {
@@ -950,12 +970,18 @@ static int __devexit omap_mcbsp_remove(struct platform_device *pdev)
                                 mcbsp->pdata->ops->free)
                         mcbsp->pdata->ops->free(mcbsp->id);
 
-                clk_disable(mcbsp->clk);
-                clk_put(mcbsp->clk);
+                for (i = mcbsp->num_clks - 1; i >= 0; i--) {
+                        clk_disable(mcbsp->clks[i]);
+                        clk_put(mcbsp->clks[i]);
+                }
 
                 iounmap(mcbsp->io_base);
 
-                mcbsp->clk = NULL;
+                if (mcbsp->num_clks) {
+                        kfree(mcbsp->clks);
+                        mcbsp->clks = NULL;
+                        mcbsp->num_clks = 0;
+                }
                 mcbsp->free = 0;
                 mcbsp->dev = NULL;
         }
diff --git a/arch/blackfin/Kconfig b/arch/blackfin/Kconfig
index a949c4fbbdd..8f1f97d56e1 100644
--- a/arch/blackfin/Kconfig
+++ b/arch/blackfin/Kconfig
@@ -169,26 +169,51 @@ config BF542
         help
           BF542 Processor Support.
 
+config BF542M
+        bool "BF542m"
+        help
+          BF542 Processor Support.
+
 config BF544
         bool "BF544"
         help
           BF544 Processor Support.
 
+config BF544M
+        bool "BF544m"
+        help
+          BF544 Processor Support.
+
 config BF547
         bool "BF547"
         help
           BF547 Processor Support.
 
+config BF547M
+        bool "BF547m"
+        help
+          BF547 Processor Support.
+
 config BF548
         bool "BF548"
         help
           BF548 Processor Support.
 
+config BF548M
+        bool "BF548m"
+        help
+          BF548 Processor Support.
+
 config BF549
         bool "BF549"
         help
           BF549 Processor Support.
 
+config BF549M
+        bool "BF549m"
+        help
+          BF549 Processor Support.
+
 config BF561
         bool "BF561"
         help
@@ -224,39 +249,39 @@ config TICK_SOURCE_SYSTMR0
 
 config BF_REV_MIN
         int
-        default 0 if (BF51x || BF52x || BF54x)
+        default 0 if (BF51x || BF52x || (BF54x && !BF54xM))
         default 2 if (BF537 || BF536 || BF534)
-        default 3 if (BF561 ||BF533 || BF532 || BF531)
+        default 3 if (BF561 || BF533 || BF532 || BF531 || BF54xM)
         default 4 if (BF538 || BF539)
 
 config BF_REV_MAX
         int
-        default 2 if (BF51x || BF52x || BF54x)
-        default 3 if (BF537 || BF536 || BF534)
+        default 2 if (BF51x || BF52x || (BF54x && !BF54xM))
+        default 3 if (BF537 || BF536 || BF534 || BF54xM)
         default 5 if (BF561 || BF538 || BF539)
         default 6 if (BF533 || BF532 || BF531)
 
 choice
         prompt "Silicon Rev"
-        default BF_REV_0_1 if (BF51x || BF52x || BF54x)
+        default BF_REV_0_1 if (BF51x || BF52x || (BF54x && !BF54xM))
         default BF_REV_0_2 if (BF534 || BF536 || BF537)
-        default BF_REV_0_3 if (BF531 || BF532 || BF533 || BF561)
+        default BF_REV_0_3 if (BF531 || BF532 || BF533 || BF54xM || BF561)
 
 config BF_REV_0_0
         bool "0.0"
-        depends on (BF51x || BF52x || BF54x)
+        depends on (BF51x || BF52x || (BF54x && !BF54xM))
 
 config BF_REV_0_1
         bool "0.1"
-        depends on (BF52x || BF54x)
+        depends on (BF52x || (BF54x && !BF54xM))
 
 config BF_REV_0_2
         bool "0.2"
-        depends on (BF52x || BF537 || BF536 || BF534 || BF54x)
+        depends on (BF52x || BF537 || BF536 || BF534 || (BF54x && !BF54xM))
 
 config BF_REV_0_3
         bool "0.3"
-        depends on (BF561 || BF537 || BF536 || BF534 || BF533 || BF532 || BF531)
+        depends on (BF54xM || BF561 || BF537 || BF536 || BF534 || BF533 || BF532 || BF531)
 
 config BF_REV_0_4
         bool "0.4"
@@ -293,9 +318,14 @@ config BF53x
         depends on (BF531 || BF532 || BF533 || BF534 || BF536 || BF537)
         default y
 
+config BF54xM
+        bool
+        depends on (BF542M || BF544M || BF547M || BF548M || BF549M)
+        default y
+
 config BF54x
         bool
-        depends on (BF542 || BF544 || BF547 || BF548 || BF549)
+        depends on (BF542 || BF544 || BF547 || BF548 || BF549 || BF54xM)
         default y
 
 config MEM_GENERIC_BOARD
diff --git a/arch/blackfin/Makefile b/arch/blackfin/Makefile
index e550c8d4606..d54c8283825 100644
--- a/arch/blackfin/Makefile
+++ b/arch/blackfin/Makefile
@@ -21,57 +21,67 @@ KALLSYMS         += --symbol-prefix=_
 KBUILD_DEFCONFIG := BF537-STAMP_defconfig
 
 # setup the machine name and the machine dependent settings
-machine-$(CONFIG_BF512) := bf518
-machine-$(CONFIG_BF514) := bf518
-machine-$(CONFIG_BF516) := bf518
-machine-$(CONFIG_BF518) := bf518
-machine-$(CONFIG_BF522) := bf527
-machine-$(CONFIG_BF523) := bf527
-machine-$(CONFIG_BF524) := bf527
-machine-$(CONFIG_BF525) := bf527
-machine-$(CONFIG_BF526) := bf527
-machine-$(CONFIG_BF527) := bf527
-machine-$(CONFIG_BF531) := bf533
-machine-$(CONFIG_BF532) := bf533
-machine-$(CONFIG_BF533) := bf533
-machine-$(CONFIG_BF534) := bf537
-machine-$(CONFIG_BF536) := bf537
-machine-$(CONFIG_BF537) := bf537
-machine-$(CONFIG_BF538) := bf538
-machine-$(CONFIG_BF539) := bf538
-machine-$(CONFIG_BF542) := bf548
-machine-$(CONFIG_BF544) := bf548
-machine-$(CONFIG_BF547) := bf548
-machine-$(CONFIG_BF548) := bf548
-machine-$(CONFIG_BF549) := bf548
-machine-$(CONFIG_BF561) := bf561
+machine-$(CONFIG_BF512)  := bf518
+machine-$(CONFIG_BF514)  := bf518
+machine-$(CONFIG_BF516)  := bf518
+machine-$(CONFIG_BF518)  := bf518
+machine-$(CONFIG_BF522)  := bf527
+machine-$(CONFIG_BF523)  := bf527
+machine-$(CONFIG_BF524)  := bf527
+machine-$(CONFIG_BF525)  := bf527
+machine-$(CONFIG_BF526)  := bf527
+machine-$(CONFIG_BF527)  := bf527
+machine-$(CONFIG_BF531)  := bf533
+machine-$(CONFIG_BF532)  := bf533
+machine-$(CONFIG_BF533)  := bf533
+machine-$(CONFIG_BF534)  := bf537
+machine-$(CONFIG_BF536)  := bf537
+machine-$(CONFIG_BF537)  := bf537
+machine-$(CONFIG_BF538)  := bf538
+machine-$(CONFIG_BF539)  := bf538
+machine-$(CONFIG_BF542)  := bf548
+machine-$(CONFIG_BF542M) := bf548
+machine-$(CONFIG_BF544)  := bf548
+machine-$(CONFIG_BF544M) := bf548
+machine-$(CONFIG_BF547)  := bf548
+machine-$(CONFIG_BF547M) := bf548
+machine-$(CONFIG_BF548)  := bf548
+machine-$(CONFIG_BF548M) := bf548
+machine-$(CONFIG_BF549)  := bf548
+machine-$(CONFIG_BF549M) := bf548
+machine-$(CONFIG_BF561)  := bf561
 MACHINE := $(machine-y)
 export MACHINE
 
-cpu-$(CONFIG_BF512) := bf512
-cpu-$(CONFIG_BF514) := bf514
-cpu-$(CONFIG_BF516) := bf516
-cpu-$(CONFIG_BF518) := bf518
-cpu-$(CONFIG_BF522) := bf522
-cpu-$(CONFIG_BF523) := bf523
-cpu-$(CONFIG_BF524) := bf524
-cpu-$(CONFIG_BF525) := bf525
-cpu-$(CONFIG_BF526) := bf526
-cpu-$(CONFIG_BF527) := bf527
-cpu-$(CONFIG_BF531) := bf531
-cpu-$(CONFIG_BF532) := bf532
-cpu-$(CONFIG_BF533) := bf533
-cpu-$(CONFIG_BF534) := bf534
-cpu-$(CONFIG_BF536) := bf536
-cpu-$(CONFIG_BF537) := bf537
-cpu-$(CONFIG_BF538) := bf538
-cpu-$(CONFIG_BF539) := bf539
-cpu-$(CONFIG_BF542) := bf542
-cpu-$(CONFIG_BF544) := bf544
-cpu-$(CONFIG_BF547) := bf547
-cpu-$(CONFIG_BF548) := bf548
-cpu-$(CONFIG_BF549) := bf549
-cpu-$(CONFIG_BF561) := bf561
+cpu-$(CONFIG_BF512)  := bf512
+cpu-$(CONFIG_BF514)  := bf514
+cpu-$(CONFIG_BF516)  := bf516
+cpu-$(CONFIG_BF518)  := bf518
+cpu-$(CONFIG_BF522)  := bf522
+cpu-$(CONFIG_BF523)  := bf523
+cpu-$(CONFIG_BF524)  := bf524
+cpu-$(CONFIG_BF525)  := bf525
+cpu-$(CONFIG_BF526)  := bf526
+cpu-$(CONFIG_BF527)  := bf527
+cpu-$(CONFIG_BF531)  := bf531
+cpu-$(CONFIG_BF532)  := bf532
+cpu-$(CONFIG_BF533)  := bf533
+cpu-$(CONFIG_BF534)  := bf534
+cpu-$(CONFIG_BF536)  := bf536
+cpu-$(CONFIG_BF537)  := bf537
+cpu-$(CONFIG_BF538)  := bf538
+cpu-$(CONFIG_BF539)  := bf539
+cpu-$(CONFIG_BF542)  := bf542
+cpu-$(CONFIG_BF542M) := bf542m
+cpu-$(CONFIG_BF544)  := bf544
+cpu-$(CONFIG_BF544M) := bf544m
+cpu-$(CONFIG_BF547)  := bf547
+cpu-$(CONFIG_BF547M) := bf547m
+cpu-$(CONFIG_BF548)  := bf548
+cpu-$(CONFIG_BF548M) := bf548m
+cpu-$(CONFIG_BF549)  := bf549
+cpu-$(CONFIG_BF549M) := bf549m
+cpu-$(CONFIG_BF561)  := bf561
 
 rev-$(CONFIG_BF_REV_0_0)  := 0.0
 rev-$(CONFIG_BF_REV_0_1)  := 0.1
diff --git a/arch/blackfin/configs/BF518F-EZBRD_defconfig b/arch/blackfin/configs/BF518F-EZBRD_defconfig
index defb9785c65..4fdb9e04759 100644
--- a/arch/blackfin/configs/BF518F-EZBRD_defconfig
+++ b/arch/blackfin/configs/BF518F-EZBRD_defconfig
@@ -1,6 +1,7 @@
 #
 # Automatically generated make config: don't edit
 # Linux kernel version: 2.6.28-rc2
+# Fri Jan  9 17:58:41 2009
 #
 # CONFIG_MMU is not set
 # CONFIG_FPU is not set
@@ -149,6 +150,7 @@ CONFIG_BF_REV_0_0=y
 # CONFIG_BF_REV_ANY is not set
 # CONFIG_BF_REV_NONE is not set
 CONFIG_BF51x=y
+CONFIG_MEM_MT48LC32M8A2_75=y
 CONFIG_BFIN518F_EZBRD=y
 
 #
@@ -598,7 +600,10 @@ CONFIG_PHYLIB=y
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
-# CONFIG_BFIN_MAC is not set
+CONFIG_BFIN_MAC=y
+CONFIG_BFIN_TX_DESC_NUM=10
+CONFIG_BFIN_RX_DESC_NUM=20
+# CONFIG_BFIN_MAC_RMII is not set
 # CONFIG_SMC91X is not set
 # CONFIG_SMSC911X is not set
 # CONFIG_DM9000 is not set
@@ -679,7 +684,7 @@ CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF526-EZBRD_defconfig b/arch/blackfin/configs/BF526-EZBRD_defconfig
index 992424ff315..8e2b855b8db 100644
--- a/arch/blackfin/configs/BF526-EZBRD_defconfig
+++ b/arch/blackfin/configs/BF526-EZBRD_defconfig
@@ -723,7 +723,7 @@ CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF527-EZKIT_defconfig b/arch/blackfin/configs/BF527-EZKIT_defconfig
index 21e3c1af55b..833128b3972 100644
--- a/arch/blackfin/configs/BF527-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF527-EZKIT_defconfig
@@ -767,7 +767,7 @@ CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF533-EZKIT_defconfig b/arch/blackfin/configs/BF533-EZKIT_defconfig
index 0bdf20a1af6..334c94b51c4 100644
--- a/arch/blackfin/configs/BF533-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF533-EZKIT_defconfig
@@ -672,7 +672,7 @@ CONFIG_BFIN_DMA_INTERFACE=m
 CONFIG_SIMPLE_GPIO=m
 # CONFIG_VT is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF533-STAMP_defconfig b/arch/blackfin/configs/BF533-STAMP_defconfig
index 2f747d6e97e..9d733436e30 100644
--- a/arch/blackfin/configs/BF533-STAMP_defconfig
+++ b/arch/blackfin/configs/BF533-STAMP_defconfig
@@ -679,7 +679,7 @@ CONFIG_BFIN_DMA_INTERFACE=m
 CONFIG_SIMPLE_GPIO=m
 # CONFIG_VT is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF537-STAMP_defconfig b/arch/blackfin/configs/BF537-STAMP_defconfig
index 8b0a81294e6..4fb4108d310 100644
--- a/arch/blackfin/configs/BF537-STAMP_defconfig
+++ b/arch/blackfin/configs/BF537-STAMP_defconfig
@@ -722,7 +722,7 @@ CONFIG_BFIN_DMA_INTERFACE=m
 CONFIG_SIMPLE_GPIO=m
 # CONFIG_VT is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF538-EZKIT_defconfig b/arch/blackfin/configs/BF538-EZKIT_defconfig
index a1f766bf7d9..cb32f5624a1 100644
--- a/arch/blackfin/configs/BF538-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF538-EZKIT_defconfig
@@ -726,7 +726,7 @@ CONFIG_BFIN_DMA_INTERFACE=m
 CONFIG_SIMPLE_GPIO=m
 # CONFIG_VT is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF548-EZKIT_defconfig b/arch/blackfin/configs/BF548-EZKIT_defconfig
index cd2da6b7692..0f8697618aa 100644
--- a/arch/blackfin/configs/BF548-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF548-EZKIT_defconfig
@@ -856,7 +856,7 @@ CONFIG_VT_CONSOLE=y
 CONFIG_HW_CONSOLE=y
 # CONFIG_VT_HW_CONSOLE_BINDING is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/BF561-EZKIT_defconfig b/arch/blackfin/configs/BF561-EZKIT_defconfig
index b398ca202db..042c7adfccf 100644
--- a/arch/blackfin/configs/BF561-EZKIT_defconfig
+++ b/arch/blackfin/configs/BF561-EZKIT_defconfig
@@ -709,7 +709,7 @@ CONFIG_BFIN_DMA_INTERFACE=m
 CONFIG_SIMPLE_GPIO=m
 # CONFIG_VT is not set
 # CONFIG_DEVKMEM is not set
-# CONFIG_BFIN_JTAG_COMM is not set
+CONFIG_BFIN_JTAG_COMM=m
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
diff --git a/arch/blackfin/configs/CM-BF527_defconfig b/arch/blackfin/configs/CM-BF527_defconfig
index 95146948166..865ed85a576 100644
--- a/arch/blackfin/configs/CM-BF527_defconfig
+++ b/arch/blackfin/configs/CM-BF527_defconfig
@@ -1,7 +1,6 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.24.7
-# Fri Jul 18 18:00:41 2008
+# Linux kernel version: 2.6.28
 #
 # CONFIG_MMU is not set
 # CONFIG_FPU is not set
@@ -9,7 +8,6 @@ CONFIG_RWSEM_GENERIC_SPINLOCK=y
 # CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
 CONFIG_BLACKFIN=y
 CONFIG_ZONE_DMA=y
-CONFIG_SEMAPHORE_SLEEPERS=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_HARDIRQS=y
@@ -32,18 +30,16 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_POSIX_MQUEUE is not set
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
-# CONFIG_USER_NS is not set
-# CONFIG_PID_NS is not set
 # CONFIG_AUDIT is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
 # CONFIG_CGROUPS is not set
-CONFIG_FAIR_GROUP_SCHED=y
-CONFIG_FAIR_USER_SCHED=y
-# CONFIG_FAIR_CGROUP_SCHED is not set
-# CONFIG_SYSFS_DEPRECATED is not set
+# CONFIG_GROUP_SCHED is not set
+CONFIG_SYSFS_DEPRECATED=y
+CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
+# CONFIG_NAMESPACES is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
@@ -52,26 +48,35 @@ CONFIG_EMBEDDED=y
 CONFIG_UID16=y
 CONFIG_SYSCTL_SYSCALL=y
 CONFIG_KALLSYMS=y
+# CONFIG_KALLSYMS_ALL is not set
 # CONFIG_KALLSYMS_EXTRA_PASS is not set
 CONFIG_HOTPLUG=y
 CONFIG_PRINTK=y
 CONFIG_BUG=y
 # CONFIG_ELF_CORE is not set
+CONFIG_COMPAT_BRK=y
 CONFIG_BASE_FULL=y
 CONFIG_FUTEX=y
 CONFIG_ANON_INODES=y
 CONFIG_EPOLL=y
 CONFIG_SIGNALFD=y
+CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
+CONFIG_AIO=y
 CONFIG_VM_EVENT_COUNTERS=y
 CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
+# CONFIG_PROFILING is not set
+# CONFIG_MARKERS is not set
+CONFIG_HAVE_OPROFILE=y
+# CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
 CONFIG_TINY_SHMEM=y
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
+# CONFIG_MODULE_FORCE_LOAD is not set
 CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
@@ -82,6 +87,7 @@ CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
 # CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
+# CONFIG_BLK_DEV_INTEGRITY is not set
 
 #
 # IO Schedulers
@@ -95,9 +101,11 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
+CONFIG_CLASSIC_RCU=y
 # CONFIG_PREEMPT_NONE is not set
 CONFIG_PREEMPT_VOLUNTARY=y
 # CONFIG_PREEMPT is not set
+# CONFIG_FREEZER is not set
 
 #
 # Blackfin Processor Options
@@ -106,6 +114,10 @@ CONFIG_PREEMPT_VOLUNTARY=y
 #
 # Processor and Board Settings
 #
+# CONFIG_BF512 is not set
+# CONFIG_BF514 is not set
+# CONFIG_BF516 is not set
+# CONFIG_BF518 is not set
 # CONFIG_BF522 is not set
 # CONFIG_BF523 is not set
 # CONFIG_BF524 is not set
@@ -118,48 +130,32 @@ CONFIG_BF527=y
 # CONFIG_BF534 is not set
 # CONFIG_BF536 is not set
 # CONFIG_BF537 is not set
+# CONFIG_BF538 is not set
+# CONFIG_BF539 is not set
 # CONFIG_BF542 is not set
+# CONFIG_BF542M is not set
 # CONFIG_BF544 is not set
+# CONFIG_BF544M is not set
 # CONFIG_BF547 is not set
+# CONFIG_BF547M is not set
 # CONFIG_BF548 is not set
+# CONFIG_BF548M is not set
 # CONFIG_BF549 is not set
+# CONFIG_BF549M is not set
 # CONFIG_BF561 is not set
+CONFIG_BF_REV_MIN=0
+CONFIG_BF_REV_MAX=2
 # CONFIG_BF_REV_0_0 is not set
 CONFIG_BF_REV_0_1=y
 # CONFIG_BF_REV_0_2 is not set
 # CONFIG_BF_REV_0_3 is not set
 # CONFIG_BF_REV_0_4 is not set
 # CONFIG_BF_REV_0_5 is not set
+# CONFIG_BF_REV_0_6 is not set
 # CONFIG_BF_REV_ANY is not set
 # CONFIG_BF_REV_NONE is not set
 CONFIG_BF52x=y
 CONFIG_MEM_MT48LC16M16A2TG_75=y
-# CONFIG_BFIN527_EZKIT is not set
-CONFIG_BFIN527_BLUETECHNIX_CM=y
-
-#
-# BF527 Specific Configuration
-#
-
-#
-# Alternative Multiplexing Scheme
-#
-# CONFIG_BF527_SPORT0_PORTF is not set
-CONFIG_BF527_SPORT0_PORTG=y
-CONFIG_BF527_SPORT0_TSCLK_PG10=y
-# CONFIG_BF527_SPORT0_TSCLK_PG14 is not set
-CONFIG_BF527_UART1_PORTF=y
-# CONFIG_BF527_UART1_PORTG is not set
-# CONFIG_BF527_NAND_D_PORTF is not set
-CONFIG_BF527_NAND_D_PORTH=y
-
-#
-# Interrupt Priority Assignment
-#
-
-#
-# Priority
-#
 CONFIG_IRQ_PLL_WAKEUP=7
 CONFIG_IRQ_DMA0_ERROR=7
 CONFIG_IRQ_DMAR0_BLK=7
@@ -179,7 +175,6 @@ CONFIG_IRQ_SPORT0_TX=9
 CONFIG_IRQ_SPORT1_RX=9
 CONFIG_IRQ_SPORT1_TX=9
 CONFIG_IRQ_TWI=10
-CONFIG_IRQ_SPI=10
 CONFIG_IRQ_UART0_RX=10
 CONFIG_IRQ_UART0_TX=10
 CONFIG_IRQ_UART1_RX=10
@@ -205,6 +200,34 @@ CONFIG_IRQ_MEM_DMA1=13
 CONFIG_IRQ_WATCH=13
 CONFIG_IRQ_PORTF_INTA=13
 CONFIG_IRQ_PORTF_INTB=13
+# CONFIG_BFIN527_EZKIT is not set
+CONFIG_BFIN527_BLUETECHNIX_CM=y
+# CONFIG_BFIN526_EZBRD is not set
+
+#
+# BF527 Specific Configuration
+#
+
+#
+# Alternative Multiplexing Scheme
+#
+# CONFIG_BF527_SPORT0_PORTF is not set
+CONFIG_BF527_SPORT0_PORTG=y
+CONFIG_BF527_SPORT0_TSCLK_PG10=y
+# CONFIG_BF527_SPORT0_TSCLK_PG14 is not set
+CONFIG_BF527_UART1_PORTF=y
+# CONFIG_BF527_UART1_PORTG is not set
+# CONFIG_BF527_NAND_D_PORTF is not set
+CONFIG_BF527_NAND_D_PORTH=y
+
+#
+# Interrupt Priority Assignment
+#
+
+#
+# Priority
+#
+CONFIG_IRQ_SPI=10
 CONFIG_IRQ_SPI_ERROR=7
 CONFIG_IRQ_NFC_ERROR=7
 CONFIG_IRQ_HDMA_ERROR=7
@@ -226,7 +249,6 @@ CONFIG_BOOT_LOAD=0x1000
 #
 CONFIG_CLKIN_HZ=25000000
 # CONFIG_BFIN_KERNEL_CLOCK is not set
-CONFIG_MAX_MEM_SIZE=512
 CONFIG_MAX_VCO_HZ=600000000
 CONFIG_MIN_VCO_HZ=50000000
 CONFIG_MAX_SCLK_HZ=133333333
@@ -240,10 +262,10 @@ CONFIG_HZ_250=y
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=250
+# CONFIG_SCHED_HRTICK is not set
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 # CONFIG_CYCLES_CLOCKSOURCE is not set
-# CONFIG_TICK_ONESHOT is not set
 # CONFIG_NO_HZ is not set
 # CONFIG_HIGH_RES_TIMERS is not set
 CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
@@ -277,6 +299,12 @@ CONFIG_ACCESS_OK_L1=y
 CONFIG_CACHELINE_ALIGNED_L1=y
 # CONFIG_SYSCALL_TAB_L1 is not set
 # CONFIG_CPLB_SWITCH_TAB_L1 is not set
+CONFIG_APP_STACK_L1=y
+
+#
+# Speed Optimizations
+#
+CONFIG_BFIN_INS_LOWOVERHEAD=y
 CONFIG_RAMKERNEL=y
 # CONFIG_ROMKERNEL is not set
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -285,10 +313,10 @@ CONFIG_FLATMEM_MANUAL=y
 # CONFIG_SPARSEMEM_MANUAL is not set
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
-# CONFIG_SPARSEMEM_STATIC is not set
-# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
+CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 # CONFIG_RESOURCES_64BIT is not set
+# CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_VIRT_TO_BUS=y
 CONFIG_BFIN_GPTIMERS=y
@@ -334,7 +362,6 @@ CONFIG_BANK_3=0xFFC0
 #
 # Bus options (PCI, PCMCIA, EISA, MCA, ISA)
 #
-# CONFIG_PCI is not set
 # CONFIG_ARCH_SUPPORTS_MSI is not set
 # CONFIG_PCCARD is not set
 
@@ -345,25 +372,20 @@ CONFIG_BINFMT_ELF_FDPIC=y
 CONFIG_BINFMT_FLAT=y
 CONFIG_BINFMT_ZFLAT=y
 # CONFIG_BINFMT_SHARED_FLAT is not set
+# CONFIG_HAVE_AOUT is not set
 # CONFIG_BINFMT_MISC is not set
 
 #
 # Power management options
 #
 # CONFIG_PM is not set
-CONFIG_SUSPEND_UP_POSSIBLE=y
-# CONFIG_PM_BFIN_SLEEP_DEEPER is not set
-# CONFIG_PM_BFIN_SLEEP is not set
+CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_PM_WAKEUP_BY_GPIO is not set
 
 #
 # CPU Frequency scaling
 #
 # CONFIG_CPU_FREQ is not set
-
-#
-# Networking
-#
 CONFIG_NET=y
 
 #
@@ -376,6 +398,7 @@ CONFIG_XFRM=y
 # CONFIG_XFRM_USER is not set
 # CONFIG_XFRM_SUB_POLICY is not set
 # CONFIG_XFRM_MIGRATE is not set
+# CONFIG_XFRM_STATISTICS is not set
 # CONFIG_NET_KEY is not set
 CONFIG_INET=y
 # CONFIG_IP_MULTICAST is not set
@@ -405,8 +428,6 @@ CONFIG_TCP_CONG_CUBIC=y
 CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TCP_MD5SIG is not set
 # CONFIG_IPV6 is not set
-# CONFIG_INET6_XFRM_TUNNEL is not set
-# CONFIG_INET6_TUNNEL is not set
 # CONFIG_NETLABEL is not set
 # CONFIG_NETWORK_SECMARK is not set
 # CONFIG_NETFILTER is not set
@@ -415,6 +436,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
+# CONFIG_NET_DSA is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
 # CONFIG_LLC2 is not set
@@ -431,14 +453,14 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 #
 # CONFIG_NET_PKTGEN is not set
 # CONFIG_HAMRADIO is not set
+# CONFIG_CAN is not set
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
-
-#
-# Wireless
-#
+# CONFIG_PHONET is not set
+CONFIG_WIRELESS=y
 # CONFIG_CFG80211 is not set
+CONFIG_WIRELESS_OLD_REGULATORY=y
 # CONFIG_WIRELESS_EXT is not set
 # CONFIG_MAC80211 is not set
 # CONFIG_IEEE80211 is not set
@@ -456,6 +478,8 @@ CONFIG_UEVENT_HELPER_PATH="/sbin/hotplug"
 CONFIG_STANDALONE=y
 CONFIG_PREVENT_FIRMWARE_BUILD=y
 # CONFIG_FW_LOADER is not set
+# CONFIG_DEBUG_DRIVER is not set
+# CONFIG_DEBUG_DEVRES is not set
 # CONFIG_SYS_HYPERVISOR is not set
 # CONFIG_CONNECTOR is not set
 CONFIG_MTD=y
@@ -464,6 +488,7 @@ CONFIG_MTD=y
 CONFIG_MTD_PARTITIONS=y
 # CONFIG_MTD_REDBOOT_PARTS is not set
 # CONFIG_MTD_CMDLINE_PARTS is not set
+# CONFIG_MTD_AR7_PARTS is not set
 
 #
 # User Modules And Translation Layers
@@ -507,6 +532,7 @@ CONFIG_MTD_ROM=m
 #
 CONFIG_MTD_COMPLEX_MAPPINGS=y
 # CONFIG_MTD_PHYSMAP is not set
+# CONFIG_MTD_GPIO_ADDR is not set
 # CONFIG_MTD_UCLINUX is not set
 # CONFIG_MTD_PLATRAM is not set
 
@@ -542,10 +568,12 @@ CONFIG_BLK_DEV=y
 CONFIG_BLK_DEV_RAM=y
 CONFIG_BLK_DEV_RAM_COUNT=16
 CONFIG_BLK_DEV_RAM_SIZE=4096
-CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
+# CONFIG_BLK_DEV_XIP is not set
 # CONFIG_CDROM_PKTCDVD is not set
 # CONFIG_ATA_OVER_ETH is not set
+# CONFIG_BLK_DEV_HD is not set
 # CONFIG_MISC_DEVICES is not set
+CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
 #
@@ -558,7 +586,6 @@ CONFIG_BLK_DEV_RAM_BLOCKSIZE=1024
 # CONFIG_ATA is not set
 # CONFIG_MD is not set
 CONFIG_NETDEVICES=y
-# CONFIG_NETDEVICES_MULTIQUEUE is not set
 # CONFIG_DUMMY is not set
 # CONFIG_BONDING is not set
 # CONFIG_MACVLAN is not set
@@ -579,6 +606,7 @@ CONFIG_PHYLIB=y
 # CONFIG_SMSC_PHY is not set
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
+# CONFIG_REALTEK_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -591,11 +619,14 @@ CONFIG_BFIN_MAC_RMII=y
 # CONFIG_SMC91X is not set
 # CONFIG_SMSC911X is not set
 # CONFIG_DM9000 is not set
+# CONFIG_ENC28J60 is not set
 # CONFIG_IBM_NEW_EMAC_ZMII is not set
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
-# CONFIG_B44 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 # CONFIG_NETDEV_1000 is not set
 # CONFIG_NETDEV_10000 is not set
 
@@ -604,6 +635,7 @@ CONFIG_BFIN_MAC_RMII=y
 #
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
+# CONFIG_IWLWIFI_LEDS is not set
 
 #
 # USB Network Adapters
@@ -616,7 +648,6 @@ CONFIG_BFIN_MAC_RMII=y
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
-# CONFIG_SHAPER is not set
 # CONFIG_NETCONSOLE is not set
 # CONFIG_NETPOLL is not set
 # CONFIG_NET_POLL_CONTROLLER is not set
@@ -642,14 +673,15 @@ CONFIG_BFIN_MAC_RMII=y
 # CONFIG_BF5xx_PPIFCD is not set
 # CONFIG_BFIN_SIMPLE_TIMER is not set
 # CONFIG_BF5xx_PPI is not set
-CONFIG_BFIN_OTP=y
-# CONFIG_BFIN_OTP_WRITE_ENABLE is not set
+# CONFIG_BF5xx_EPPI is not set
 # CONFIG_BFIN_SPORT is not set
 # CONFIG_BFIN_TIMER_LATENCY is not set
 # CONFIG_TWI_LCD is not set
+CONFIG_BFIN_DMA_INTERFACE=m
 CONFIG_SIMPLE_GPIO=m
 # CONFIG_VT is not set
 # CONFIG_DEVKMEM is not set
+# CONFIG_BFIN_JTAG_COMM is not set
 # CONFIG_SERIAL_NONSTANDARD is not set
 
 #
@@ -673,6 +705,8 @@ CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_BFIN_SPORT is not set
 CONFIG_UNIX98_PTYS=y
 # CONFIG_LEGACY_PTYS is not set
+CONFIG_BFIN_OTP=y
+# CONFIG_BFIN_OTP_WRITE_ENABLE is not set
 
 #
 # CAN, the car bus and industrial fieldbus
@@ -680,44 +714,49 @@ CONFIG_UNIX98_PTYS=y
 # CONFIG_CAN4LINUX is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
-# CONFIG_GEN_RTC is not set
 # CONFIG_R3964 is not set
 # CONFIG_RAW_DRIVER is not set
 # CONFIG_TCG_TPM is not set
 CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 CONFIG_I2C_CHARDEV=m
+CONFIG_I2C_HELPER_AUTO=y
 
 #
-# I2C Algorithms
+# I2C Hardware Bus support
 #
-# CONFIG_I2C_ALGOBIT is not set
-# CONFIG_I2C_ALGOPCF is not set
-# CONFIG_I2C_ALGOPCA is not set
 
 #
-# I2C Hardware Bus support
+# I2C system bus drivers (mostly embedded / system-on-chip)
 #
 CONFIG_I2C_BLACKFIN_TWI=m
 CONFIG_I2C_BLACKFIN_TWI_CLK_KHZ=100
 # CONFIG_I2C_GPIO is not set
 # CONFIG_I2C_OCORES is not set
-# CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_SIMTEC is not set
+
+#
+# External I2C/SMBus adapter drivers
+#
+# CONFIG_I2C_PARPORT_LIGHT is not set
 # CONFIG_I2C_TAOS_EVM is not set
-# CONFIG_I2C_STUB is not set
 # CONFIG_I2C_TINY_USB is not set
 
 #
+# Other I2C/SMBus bus drivers
+#
+# CONFIG_I2C_PCA_PLATFORM is not set
+# CONFIG_I2C_STUB is not set
+
+#
 # Miscellaneous I2C Chip support
 #
-# CONFIG_SENSORS_DS1337 is not set
-# CONFIG_SENSORS_DS1374 is not set
 # CONFIG_DS1682 is not set
+# CONFIG_AT24 is not set
 # CONFIG_SENSORS_AD5252 is not set
-# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_SENSORS_EEPROM is not set
 # CONFIG_SENSORS_PCF8574 is not set
-# CONFIG_SENSORS_PCF8575 is not set
+# CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
 # CONFIG_SENSORS_PCF8591 is not set
 # CONFIG_SENSORS_MAX6875 is not set
@@ -726,37 +765,41 @@ CONFIG_I2C_BLACKFIN_TWI_CLK_KHZ=100
 # CONFIG_I2C_DEBUG_ALGO is not set
 # CONFIG_I2C_DEBUG_BUS is not set
 # CONFIG_I2C_DEBUG_CHIP is not set
-
-#
-# SPI support
-#
 CONFIG_SPI=y
+# CONFIG_SPI_DEBUG is not set
 CONFIG_SPI_MASTER=y
 
 #
 # SPI Master Controller Drivers
 #
 CONFIG_SPI_BFIN=y
+# CONFIG_SPI_BFIN_LOCK is not set
 # CONFIG_SPI_BITBANG is not set
 
 #
 # SPI Protocol Masters
 #
-# CONFIG_EEPROM_AT25 is not set
+# CONFIG_SPI_AT25 is not set
 # CONFIG_SPI_SPIDEV is not set
 # CONFIG_SPI_TLE62X0 is not set
+CONFIG_ARCH_WANT_OPTIONAL_GPIOLIB=y
+# CONFIG_GPIOLIB is not set
 # CONFIG_W1 is not set
 # CONFIG_POWER_SUPPLY is not set
 CONFIG_HWMON=y
 # CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_AD7414 is not set
 # CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADCXX is not set
 # CONFIG_SENSORS_ADM1021 is not set
 # CONFIG_SENSORS_ADM1025 is not set
 # CONFIG_SENSORS_ADM1026 is not set
 # CONFIG_SENSORS_ADM1029 is not set
 # CONFIG_SENSORS_ADM1031 is not set
 # CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADT7462 is not set
 # CONFIG_SENSORS_ADT7470 is not set
+# CONFIG_SENSORS_ADT7473 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
 # CONFIG_SENSORS_F71805F is not set
@@ -777,6 +820,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LM90 is not set
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_MAX1111 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_MAX6650 is not set
 # CONFIG_SENSORS_PC87360 is not set
@@ -785,6 +829,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_SMSC47M1 is not set
 # CONFIG_SENSORS_SMSC47M192 is not set
 # CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_ADS7828 is not set
 # CONFIG_SENSORS_THMC50 is not set
 # CONFIG_SENSORS_VT1211 is not set
 # CONFIG_SENSORS_W83781D is not set
@@ -792,9 +837,12 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_W83792D is not set
 # CONFIG_SENSORS_W83793 is not set
 # CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
 # CONFIG_SENSORS_W83627HF is not set
 # CONFIG_SENSORS_W83627EHF is not set
 # CONFIG_HWMON_DEBUG_CHIP is not set
+# CONFIG_THERMAL is not set
+# CONFIG_THERMAL_HWMON is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
 
@@ -810,21 +858,31 @@ CONFIG_BFIN_WDT=y
 # CONFIG_USBPCWATCHDOG is not set
 
 #
-# Sonics Silicon Backplane
-#
-CONFIG_SSB_POSSIBLE=y
-# CONFIG_SSB is not set
-
-#
 # Multifunction device drivers
 #
+# CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
+# CONFIG_HTC_PASIC3 is not set
+# CONFIG_MFD_TMIO is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_REGULATOR is not set
 
 #
 # Multimedia devices
 #
+
+#
+# Multimedia core support
+#
 # CONFIG_VIDEO_DEV is not set
 # CONFIG_DVB_CORE is not set
+# CONFIG_VIDEO_MEDIA is not set
+
+#
+# Multimedia drivers
+#
 # CONFIG_DAB is not set
 
 #
@@ -839,10 +897,6 @@ CONFIG_SSB_POSSIBLE=y
 # Display device support
 #
 # CONFIG_DISPLAY_SUPPORT is not set
-
-#
-# Sound
-#
 # CONFIG_SOUND is not set
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
@@ -850,6 +904,7 @@ CONFIG_USB_ARCH_HAS_HCD=y
 # CONFIG_USB_ARCH_HAS_EHCI is not set
 CONFIG_USB=y
 # CONFIG_USB_DEBUG is not set
+# CONFIG_USB_ANNOUNCE_NEW_DEVICES is not set
 
 #
 # Miscellaneous USB options
@@ -860,40 +915,48 @@ CONFIG_USB_DEVICE_CLASS=y
 # CONFIG_USB_OTG is not set
 # CONFIG_USB_OTG_WHITELIST is not set
 CONFIG_USB_OTG_BLACKLIST_HUB=y
+CONFIG_USB_MON=y
+# CONFIG_USB_WUSB is not set
+# CONFIG_USB_WUSB_CBAF is not set
 
 #
 # USB Host Controller Drivers
 #
+# CONFIG_USB_C67X00_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
-# CONFIG_USB_ISP1362_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
+# CONFIG_USB_ISP1362_HCD is not set
 # CONFIG_USB_SL811_HCD is not set
 # CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_HWA_HCD is not set
 CONFIG_USB_MUSB_HDRC=y
 CONFIG_USB_MUSB_SOC=y
 
 #
-# Blackfin high speed USB support
+# Blackfin high speed USB Support
 #
 CONFIG_USB_MUSB_HOST=y
 # CONFIG_USB_MUSB_PERIPHERAL is not set
 # CONFIG_USB_MUSB_OTG is not set
 CONFIG_USB_MUSB_HDRC_HCD=y
 CONFIG_MUSB_PIO_ONLY=y
-CONFIG_USB_MUSB_LOGLEVEL=0
+CONFIG_MUSB_DMA_POLL=y
+# CONFIG_USB_MUSB_DEBUG is not set
 
 #
 # USB Device Class drivers
 #
 # CONFIG_USB_ACM is not set
 # CONFIG_USB_PRINTER is not set
+# CONFIG_USB_WDM is not set
+# CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 # CONFIG_USB_LIBUSUAL is not set
 
@@ -901,15 +964,10 @@ CONFIG_USB_MUSB_LOGLEVEL=0
 # USB Imaging devices
 #
 # CONFIG_USB_MDC800 is not set
-CONFIG_USB_MON=y
 
 #
 # USB port drivers
 #
-
-#
-# USB Serial Converter support
-#
 # CONFIG_USB_SERIAL is not set
 
 #
@@ -918,7 +976,7 @@ CONFIG_USB_MON=y
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
 # CONFIG_USB_ADUTUX is not set
-# CONFIG_USB_AUERSWALD is not set
+# CONFIG_USB_SEVSEG is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
@@ -934,17 +992,13 @@ CONFIG_USB_MON=y
 # CONFIG_USB_LD is not set
 # CONFIG_USB_TRANCEVIBRATOR is not set
 # CONFIG_USB_IOWARRIOR is not set
-
-#
-# USB DSL modem support
-#
-
-#
-# USB Gadget Support
-#
+# CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
 # CONFIG_MMC is not set
+# CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
+# CONFIG_ACCESSIBILITY is not set
 CONFIG_RTC_LIB=y
 CONFIG_RTC_CLASS=y
 CONFIG_RTC_HCTOSYS=y
@@ -973,51 +1027,59 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_PCF8563 is not set
 # CONFIG_RTC_DRV_PCF8583 is not set
 # CONFIG_RTC_DRV_M41T80 is not set
+# CONFIG_RTC_DRV_S35390A is not set
+# CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
 
 #
 # SPI RTC drivers
 #
-# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_M41T94 is not set
+# CONFIG_RTC_DRV_DS1305 is not set
+# CONFIG_RTC_DRV_DS1390 is not set
 # CONFIG_RTC_DRV_MAX6902 is not set
+# CONFIG_RTC_DRV_R9701 is not set
+# CONFIG_RTC_DRV_RS5C348 is not set
+# CONFIG_RTC_DRV_DS3234 is not set
 
 #
 # Platform RTC drivers
 #
+# CONFIG_RTC_DRV_DS1286 is not set
+# CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
-# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
+# CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
 # CONFIG_RTC_DRV_V3020 is not set
 
 #
 # on-CPU RTC drivers
 #
 CONFIG_RTC_DRV_BFIN=y
-
-#
-# Userspace I/O
-#
+# CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
+# CONFIG_STAGING is not set
 
 #
 # File systems
 #
 # CONFIG_EXT2_FS is not set
 # CONFIG_EXT3_FS is not set
-# CONFIG_EXT4DEV_FS is not set
+# CONFIG_EXT4_FS is not set
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 # CONFIG_FS_POSIX_ACL is not set
+CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
-# CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
-# CONFIG_MINIX_FS is not set
-# CONFIG_ROMFS_FS is not set
+# CONFIG_DNOTIFY is not set
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 # CONFIG_QUOTA is not set
-# CONFIG_DNOTIFY is not set
 # CONFIG_AUTOFS_FS is not set
 # CONFIG_AUTOFS4_FS is not set
 # CONFIG_FUSE_FS is not set
@@ -1059,8 +1121,11 @@ CONFIG_SYSFS=y
 # CONFIG_JFFS2_FS is not set
 # CONFIG_CRAMFS is not set
 # CONFIG_VXFS_FS is not set
+# CONFIG_MINIX_FS is not set
+# CONFIG_OMFS_FS is not set
 # CONFIG_HPFS_FS is not set
 # CONFIG_QNX4FS_FS is not set
+# CONFIG_ROMFS_FS is not set
 # CONFIG_SYSV_FS is not set
 # CONFIG_UFS_FS is not set
 CONFIG_NETWORK_FILESYSTEMS=y
@@ -1068,13 +1133,12 @@ CONFIG_NFS_FS=m
 CONFIG_NFS_V3=y
 # CONFIG_NFS_V3_ACL is not set
 # CONFIG_NFS_V4 is not set
-# CONFIG_NFS_DIRECTIO is not set
 # CONFIG_NFSD is not set
 CONFIG_LOCKD=m
 CONFIG_LOCKD_V4=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=m
-# CONFIG_SUNRPC_BIND34 is not set
+# CONFIG_SUNRPC_REGISTER_V4 is not set
 # CONFIG_RPCSEC_GSS_KRB5 is not set
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 CONFIG_SMB_FS=m
@@ -1130,7 +1194,6 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_NLS_KOI8_U is not set
 # CONFIG_NLS_UTF8 is not set
 # CONFIG_DLM is not set
-# CONFIG_INSTRUMENTATION is not set
 
 #
 # Kernel hacking
@@ -1138,14 +1201,61 @@ CONFIG_NLS_DEFAULT="iso8859-1"
 # CONFIG_PRINTK_TIME is not set
 CONFIG_ENABLE_WARN_DEPRECATED=y
 CONFIG_ENABLE_MUST_CHECK=y
+CONFIG_FRAME_WARN=1024
 # CONFIG_MAGIC_SYSRQ is not set
 # CONFIG_UNUSED_SYMBOLS is not set
 CONFIG_DEBUG_FS=y
 # CONFIG_HEADERS_CHECK is not set
-# CONFIG_DEBUG_KERNEL is not set
+CONFIG_DEBUG_KERNEL=y
+# CONFIG_DEBUG_SHIRQ is not set
+CONFIG_DETECT_SOFTLOCKUP=y
+# CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC is not set
+CONFIG_BOOTPARAM_SOFTLOCKUP_PANIC_VALUE=0
+# CONFIG_SCHED_DEBUG is not set
+# CONFIG_SCHEDSTATS is not set
+# CONFIG_TIMER_STATS is not set
+# CONFIG_DEBUG_OBJECTS is not set
+# CONFIG_DEBUG_SLAB is not set
+# CONFIG_DEBUG_RT_MUTEXES is not set
+# CONFIG_RT_MUTEX_TESTER is not set
+# CONFIG_DEBUG_SPINLOCK is not set
+# CONFIG_DEBUG_MUTEXES is not set
+# CONFIG_DEBUG_SPINLOCK_SLEEP is not set
+# CONFIG_DEBUG_LOCKING_API_SELFTESTS is not set
+# CONFIG_DEBUG_KOBJECT is not set
 # CONFIG_DEBUG_BUGVERBOSE is not set
+# CONFIG_DEBUG_INFO is not set
+# CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_WRITECOUNT is not set
+# CONFIG_DEBUG_MEMORY_INIT is not set
+# CONFIG_DEBUG_LIST is not set
+# CONFIG_DEBUG_SG is not set
+# CONFIG_FRAME_POINTER is not set
+# CONFIG_BOOT_PRINTK_DELAY is not set
+# CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
+# CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
+# CONFIG_FAULT_INJECTION is not set
+# CONFIG_SYSCTL_SYSCALL_CHECK is not set
+
+#
+# Tracers
+#
+# CONFIG_SCHED_TRACER is not set
+# CONFIG_CONTEXT_SWITCH_TRACER is not set
+# CONFIG_BOOT_TRACER is not set
+# CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
+CONFIG_HAVE_ARCH_KGDB=y
+# CONFIG_KGDB is not set
+# CONFIG_DEBUG_STACKOVERFLOW is not set
+# CONFIG_DEBUG_STACK_USAGE is not set
+# CONFIG_KGDB_TESTCASE is not set
+CONFIG_DEBUG_VERBOSE=y
 CONFIG_DEBUG_MMRS=y
+# CONFIG_DEBUG_HWERR is not set
+# CONFIG_DEBUG_DOUBLEFAULT is not set
 CONFIG_DEBUG_HUNT_FOR_ZERO=y
 CONFIG_DEBUG_BFIN_HWTRACE_ON=y
 CONFIG_DEBUG_BFIN_HWTRACE_COMPRESSION_OFF=y
@@ -1154,7 +1264,7 @@ CONFIG_DEBUG_BFIN_HWTRACE_COMPRESSION_OFF=y
 CONFIG_DEBUG_BFIN_HWTRACE_COMPRESSION=0
 # CONFIG_DEBUG_BFIN_HWTRACE_EXPAND is not set
 # CONFIG_DEBUG_BFIN_NO_KERN_HWTRACE is not set
-CONFIG_EARLY_PRINTK=y
+# CONFIG_EARLY_PRINTK is not set
 # CONFIG_CPLB_INFO is not set
 CONFIG_ACCESS_CHECK=y
 
@@ -1163,10 +1273,96 @@ CONFIG_ACCESS_CHECK=y
 #
 # CONFIG_KEYS is not set
 CONFIG_SECURITY=y
+# CONFIG_SECURITYFS is not set
 # CONFIG_SECURITY_NETWORK is not set
-# CONFIG_SECURITY_CAPABILITIES is not set
+# CONFIG_SECURITY_FILE_CAPABILITIES is not set
 # CONFIG_SECURITY_ROOTPLUG is not set
-# CONFIG_CRYPTO is not set
+CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR=0
+CONFIG_CRYPTO=y
+
+#
+# Crypto core or helper
+#
+# CONFIG_CRYPTO_FIPS is not set
+# CONFIG_CRYPTO_MANAGER is not set
+# CONFIG_CRYPTO_MANAGER2 is not set
+# CONFIG_CRYPTO_GF128MUL is not set
+# CONFIG_CRYPTO_NULL is not set
+# CONFIG_CRYPTO_CRYPTD is not set
+# CONFIG_CRYPTO_AUTHENC is not set
+# CONFIG_CRYPTO_TEST is not set
+
+#
+# Authenticated Encryption with Associated Data
+#
+# CONFIG_CRYPTO_CCM is not set
+# CONFIG_CRYPTO_GCM is not set
+# CONFIG_CRYPTO_SEQIV is not set
+
+#
+# Block modes
+#
+# CONFIG_CRYPTO_CBC is not set
+# CONFIG_CRYPTO_CTR is not set
+# CONFIG_CRYPTO_CTS is not set
+# CONFIG_CRYPTO_ECB is not set
+# CONFIG_CRYPTO_LRW is not set
+# CONFIG_CRYPTO_PCBC is not set
+# CONFIG_CRYPTO_XTS is not set
+
+#
+# Hash modes
+#
+# CONFIG_CRYPTO_HMAC is not set
+# CONFIG_CRYPTO_XCBC is not set
+
+#
+# Digest
+#
+# CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_MD4 is not set
+# CONFIG_CRYPTO_MD5 is not set
+# CONFIG_CRYPTO_MICHAEL_MIC is not set
+# CONFIG_CRYPTO_RMD128 is not set
+# CONFIG_CRYPTO_RMD160 is not set
+# CONFIG_CRYPTO_RMD256 is not set
+# CONFIG_CRYPTO_RMD320 is not set
+# CONFIG_CRYPTO_SHA1 is not set
+# CONFIG_CRYPTO_SHA256 is not set
+# CONFIG_CRYPTO_SHA512 is not set
+# CONFIG_CRYPTO_TGR192 is not set
+# CONFIG_CRYPTO_WP512 is not set
+
+#
+# Ciphers
+#
+# CONFIG_CRYPTO_AES is not set
+# CONFIG_CRYPTO_ANUBIS is not set
+# CONFIG_CRYPTO_ARC4 is not set
+# CONFIG_CRYPTO_BLOWFISH is not set
+# CONFIG_CRYPTO_CAMELLIA is not set
+# CONFIG_CRYPTO_CAST5 is not set
+# CONFIG_CRYPTO_CAST6 is not set
+# CONFIG_CRYPTO_DES is not set
+# CONFIG_CRYPTO_FCRYPT is not set
+# CONFIG_CRYPTO_KHAZAD is not set
+# CONFIG_CRYPTO_SALSA20 is not set
+# CONFIG_CRYPTO_SEED is not set
+# CONFIG_CRYPTO_SERPENT is not set
+# CONFIG_CRYPTO_TEA is not set
+# CONFIG_CRYPTO_TWOFISH is not set
+
+#
+# Compression
+#
+# CONFIG_CRYPTO_DEFLATE is not set
+# CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
+CONFIG_CRYPTO_HW=y
 
 #
 # Library routines
@@ -1174,6 +1370,7 @@ CONFIG_SECURITY=y
 CONFIG_BITREVERSE=y
 CONFIG_CRC_CCITT=m
 # CONFIG_CRC16 is not set
+# CONFIG_CRC_T10DIF is not set
 # CONFIG_CRC_ITU_T is not set
 CONFIG_CRC32=y
 # CONFIG_CRC7 is not set
diff --git a/arch/blackfin/include/asm/checksum.h b/arch/blackfin/include/asm/checksum.h
index f67289a0d8d..793581fc955 100644
--- a/arch/blackfin/include/asm/checksum.h
+++ b/arch/blackfin/include/asm/checksum.h
@@ -63,23 +63,23 @@ static inline __wsum
 csum_tcpudp_nofold(__be32 saddr, __be32 daddr, unsigned short len,
                    unsigned short proto, __wsum sum)
 {
-
-        __asm__ ("%0 = %0 + %1;\n\t"
-                 "CC = AC0;\n\t"
-                 "if !CC jump 4;\n\t"
-                 "%0 = %0 + %4;\n\t"
-                 "%0 = %0 + %2;\n\t"
-                 "CC = AC0;\n\t"
-                 "if !CC jump 4;\n\t"
-                 "%0 = %0 + %4;\n\t"
-                 "%0 = %0 + %3;\n\t"
-                 "CC = AC0;\n\t"
-                 "if !CC jump 4;\n\t"
-                 "%0 = %0 + %4;\n\t"
-                 "NOP;\n\t"
-                 : "=d" (sum)
-                 : "d" (daddr), "d" (saddr), "d" ((ntohs(len)<<16)+proto*256), "d" (1), "0"(sum)
-                 : "CC");
+        unsigned int carry;
+
+        __asm__ ("%0 = %0 + %2;\n\t"
+                "CC = AC0;\n\t"
+                "%1 = CC;\n\t"
+                "%0 = %0 + %1;\n\t"
+                "%0 = %0 + %3;\n\t"
+                "CC = AC0;\n\t"
+                "%1 = CC;\n\t"
+                "%0 = %0 + %1;\n\t"
+                "%0 = %0 + %4;\n\t"
+                "CC = AC0;\n\t"
+                "%1 = CC;\n\t"
+                "%0 = %0 + %1;\n\t"
+                : "=d" (sum), "=&d" (carry)
+                : "d" (daddr), "d" (saddr), "d" ((len + proto) << 8), "0"(sum)
+                : "CC");
 
         return (sum);
 }
diff --git a/arch/blackfin/include/asm/delay.h b/arch/blackfin/include/asm/delay.h
index 0889c3abb59..c31f91cc1d5 100644
--- a/arch/blackfin/include/asm/delay.h
+++ b/arch/blackfin/include/asm/delay.h
@@ -13,29 +13,7 @@
 
 static inline void __delay(unsigned long loops)
 {
-        if (ANOMALY_05000312) {
-                /* Interrupted loads to loop registers -> bad */
-                unsigned long tmp;
-                __asm__ __volatile__(
-                        "[--SP] = LC0;"
-                        "[--SP] = LT0;"
-                        "[--SP] = LB0;"
-                        "LSETUP (1f,1f) LC0 = %1;"
-                        "1: NOP;"
-                        /* We take advantage of the fact that LC0 is 0 at
-                         * the end of the loop.  Otherwise we'd need some
-                         * NOPs after the CLI here.
-                         */
-                        "CLI %0;"
-                        "LB0 = [SP++];"
-                        "LT0 = [SP++];"
-                        "LC0 = [SP++];"
-                        "STI %0;"
-                        : "=d" (tmp)
-                        : "a" (loops)
-                );
-        } else
-                __asm__ __volatile__ (
+__asm__ __volatile__ (
                         "LSETUP(1f, 1f) LC0 = %0;"
                         "1: NOP;"
                         :
@@ -47,16 +25,15 @@ static inline void __delay(unsigned long loops)
 #include <linux/param.h>        /* needed for HZ */
 
 /*
- * Use only for very small delays ( < 1 msec).  Should probably use a
- * lookup table, really, as the multiplications take much too long with
- * short delays.  This is a "reasonable" implementation, though (and the
- * first constant multiplications gets optimized away if the delay is
- * a constant)
+ * close approximation borrowed from m68knommu to avoid 64-bit math
  */
+
+#define HZSCALE         (268435456 / (1000000/HZ))
+
 static inline void udelay(unsigned long usecs)
 {
         extern unsigned long loops_per_jiffy;
-        __delay(usecs * loops_per_jiffy / (1000000 / HZ));
+        __delay((((usecs * HZSCALE) >> 11) * (loops_per_jiffy >> 11)) >> 6);
 }
 
 #endif
diff --git a/arch/blackfin/include/asm/gpio.h b/arch/blackfin/include/asm/gpio.h
index 9477d82fcad..d4a082ef75b 100644
--- a/arch/blackfin/include/asm/gpio.h
+++ b/arch/blackfin/include/asm/gpio.h
@@ -27,60 +27,6 @@
  * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-/*
-*  Number     BF537/6/4    BF561    BF533/2/1
-*             BF527/5/2
-*
-*  GPIO_0       PF0         PF0        PF0
-*  GPIO_1       PF1         PF1        PF1
-*  GPIO_2       PF2         PF2        PF2
-*  GPIO_3       PF3         PF3        PF3
-*  GPIO_4       PF4         PF4        PF4
-*  GPIO_5       PF5         PF5        PF5
-*  GPIO_6       PF6         PF6        PF6
-*  GPIO_7       PF7         PF7        PF7
-*  GPIO_8       PF8         PF8        PF8
-*  GPIO_9       PF9         PF9        PF9
-*  GPIO_10      PF10        PF10       PF10
-*  GPIO_11      PF11        PF11       PF11
-*  GPIO_12      PF12        PF12       PF12
-*  GPIO_13      PF13        PF13       PF13
-*  GPIO_14      PF14        PF14       PF14
-*  GPIO_15      PF15        PF15       PF15
-*  GPIO_16      PG0         PF16
-*  GPIO_17      PG1         PF17
-*  GPIO_18      PG2         PF18
-*  GPIO_19      PG3         PF19
-*  GPIO_20      PG4         PF20
-*  GPIO_21      PG5         PF21
-*  GPIO_22      PG6         PF22
-*  GPIO_23      PG7         PF23
-*  GPIO_24      PG8         PF24
-*  GPIO_25      PG9         PF25
-*  GPIO_26      PG10        PF26
-*  GPIO_27      PG11        PF27
-*  GPIO_28      PG12        PF28
-*  GPIO_29      PG13        PF29
-*  GPIO_30      PG14        PF30
-*  GPIO_31      PG15        PF31
-*  GPIO_32      PH0         PF32
-*  GPIO_33      PH1         PF33
-*  GPIO_34      PH2         PF34
-*  GPIO_35      PH3         PF35
-*  GPIO_36      PH4         PF36
-*  GPIO_37      PH5         PF37
-*  GPIO_38      PH6         PF38
-*  GPIO_39      PH7         PF39
-*  GPIO_40      PH8         PF40
-*  GPIO_41      PH9         PF41
-*  GPIO_42      PH10        PF42
-*  GPIO_43      PH11        PF43
-*  GPIO_44      PH12        PF44
-*  GPIO_45      PH13        PF45
-*  GPIO_46      PH14        PF46
-*  GPIO_47      PH15        PF47
-*/
-
 #ifndef __ARCH_BLACKFIN_GPIO_H__
 #define __ARCH_BLACKFIN_GPIO_H__
 
@@ -295,10 +241,6 @@ int bfin_gpio_direction_output(unsigned gpio, int value);
 int bfin_gpio_get_value(unsigned gpio);
 void bfin_gpio_set_value(unsigned gpio, int value);
 
-#ifndef BF548_FAMILY
-#define bfin_gpio_set_value(gpio, value)    set_gpio_data(gpio, value)
-#endif
-
 #ifdef CONFIG_GPIOLIB
 #include <asm-generic/gpio.h>           /* cansleep wrappers */
 
diff --git a/arch/blackfin/include/asm/kgdb.h b/arch/blackfin/include/asm/kgdb.h
index 26ebac6646d..c8b256d2ea3 100644
--- a/arch/blackfin/include/asm/kgdb.h
+++ b/arch/blackfin/include/asm/kgdb.h
@@ -1,32 +1,8 @@
-/*
- * File:         include/asm-blackfin/kgdb.h
- * Based on:
- * Author:       Sonic Zhang
- *
- * Created:
- * Description:
- *
- * Rev:          $Id: kgdb_bfin_linux-2.6.x.patch 4934 2007-02-13 09:32:11Z sonicz $
- *
- * Modified:
- *               Copyright 2005-2006 Analog Devices Inc.
- *
- * Bugs:         Enter bugs at http://blackfin.uclinux.org/
+/* Blackfin KGDB header
  *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
+ * Copyright 2005-2009 Analog Devices Inc.
  *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, see the file COPYING, or write
- * to the Free Software Foundation, Inc.,
- * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
+ * Licensed under the GPL-2 or later.
  */
 
 #ifndef __ASM_BLACKFIN_KGDB_H__
@@ -37,17 +13,18 @@
 /* gdb locks */
 #define KGDB_MAX_NO_CPUS 8
 
-/************************************************************************/
-/* BUFMAX defines the maximum number of characters in inbound/outbound buffers*/
-/* at least NUMREGBYTES*2 are needed for register packets */
-/* Longer buffer is needed to list all threads */
+/*
+ * BUFMAX defines the maximum number of characters in inbound/outbound buffers.
+ * At least NUMREGBYTES*2 are needed for register packets.
+ * Longer buffer is needed to list all threads.
+ */
 #define BUFMAX 2048
 
 /*
- *  Note that this register image is different from
- *  the register image that Linux produces at interrupt time.
- *  
- *  Linux's register image is defined by struct pt_regs in ptrace.h.
+ * Note that this register image is different from
+ * the register image that Linux produces at interrupt time.
+ *
+ * Linux's register image is defined by struct pt_regs in ptrace.h.
  */
 enum regnames {
   /* Core Registers */
@@ -104,14 +81,14 @@ enum regnames {
   BFIN_RETX,
   BFIN_RETN,
   BFIN_RETE,
-  
+
   /* Pseudo Registers */
   BFIN_PC,
   BFIN_CC,
   BFIN_EXTRA1,          /* Address of .text section.  */
   BFIN_EXTRA2,          /* Address of .data section.  */
   BFIN_EXTRA3,          /* Address of .bss section.  */
-  BFIN_FDPIC_EXEC, 
+  BFIN_FDPIC_EXEC,
   BFIN_FDPIC_INTERP,
 
   /* MMRs */
@@ -126,7 +103,7 @@ enum regnames {
 
 static inline void arch_kgdb_breakpoint(void)
 {
-        asm("   EXCPT 2;");
+        asm("EXCPT 2;");
 }
 #define BREAK_INSTR_SIZE        2
 #define CACHE_FLUSH_IS_SAFE     1
diff --git a/arch/blackfin/include/asm/mem_init.h b/arch/blackfin/include/asm/mem_init.h
index 255a9316ad3..61f7487fbf1 100644
--- a/arch/blackfin/include/asm/mem_init.h
+++ b/arch/blackfin/include/asm/mem_init.h
@@ -115,7 +115,7 @@
 #define mem_SDRRC       (((CONFIG_SCLK_HZ / 1000) * SDRAM_Tref) / SDRAM_NRA) - (SDRAM_tRAS_num + SDRAM_tRP_num)
 
 /* Enable SCLK Out */
-#define mem_SDGCTL        (0x80000000 | SCTLE | SDRAM_CL | SDRAM_tRAS | SDRAM_tRP | SDRAM_tRCD | SDRAM_tWR | PSS)
+#define mem_SDGCTL        (SCTLE | SDRAM_CL | SDRAM_tRAS | SDRAM_tRP | SDRAM_tRCD | SDRAM_tWR | PSS)
 #else
 #define mem_SDRRC       CONFIG_MEM_SDRRC
 #define mem_SDGCTL      CONFIG_MEM_SDGCTL
diff --git a/arch/blackfin/include/asm/pda.h b/arch/blackfin/include/asm/pda.h
index bd8d4a7efeb..a67142740df 100644
--- a/arch/blackfin/include/asm/pda.h
+++ b/arch/blackfin/include/asm/pda.h
@@ -59,6 +59,7 @@ struct blackfin_pda {			/* Per-processor Data Area */
         unsigned long icplb_fault_addr;
         unsigned long retx;
         unsigned long seqstat;
+        unsigned int __nmi_count;       /* number of times NMI asserted on this CPU */
 };
 
 extern struct blackfin_pda cpu_pda[];
diff --git a/arch/blackfin/include/asm/reboot.h b/arch/blackfin/include/asm/reboot.h
index 4856d62b746..ae1e36329be 100644
--- a/arch/blackfin/include/asm/reboot.h
+++ b/arch/blackfin/include/asm/reboot.h
@@ -15,6 +15,6 @@ extern void native_machine_halt(void);
 extern void native_machine_power_off(void);
 
 /* common reboot workarounds */
-extern void bfin_gpio_reset_spi0_ssel1(void);
+extern void bfin_reset_boot_spi_cs(unsigned short pin);
 
 #endif
diff --git a/arch/blackfin/kernel/Makefile b/arch/blackfin/kernel/Makefile
index 38a233374f0..4a92a86824b 100644
--- a/arch/blackfin/kernel/Makefile
+++ b/arch/blackfin/kernel/Makefile
@@ -15,6 +15,8 @@ else
     obj-y += time.o
 endif
 
+CFLAGS_kgdb_test.o := -mlong-calls -O0
+
 obj-$(CONFIG_IPIPE)                  += ipipe.o
 obj-$(CONFIG_IPIPE_TRACE_MCOUNT)     += mcount.o
 obj-$(CONFIG_BFIN_GPTIMERS)          += gptimers.o
diff --git a/arch/blackfin/kernel/bfin_dma_5xx.c b/arch/blackfin/kernel/bfin_dma_5xx.c
index 07e02c0d1c0..8531693fb48 100644
--- a/arch/blackfin/kernel/bfin_dma_5xx.c
+++ b/arch/blackfin/kernel/bfin_dma_5xx.c
@@ -249,6 +249,13 @@ static void __dma_memcpy(u32 daddr, s16 dmod, u32 saddr, s16 smod, size_t cnt, u
 
         spin_lock_irqsave(&mdma_lock, flags);
 
+        /* Force a sync in case a previous config reset on this channel
+         * occurred.  This is needed so subsequent writes to DMA registers
+         * are not spuriously lost/corrupted.  Do it under irq lock and
+         * without the anomaly version (because we are atomic already).
+         */
+        __builtin_bfin_ssync();
+
         if (bfin_read_MDMA_S0_CONFIG())
                 while (!(bfin_read_MDMA_D0_IRQ_STATUS() & DMA_DONE))
                         continue;
diff --git a/arch/blackfin/kernel/bfin_gpio.c b/arch/blackfin/kernel/bfin_gpio.c
index 4c14331978f..51dac55c524 100644
--- a/arch/blackfin/kernel/bfin_gpio.c
+++ b/arch/blackfin/kernel/bfin_gpio.c
@@ -27,59 +27,6 @@
  * 51 Franklin St, Fifth Floor, Boston, MA  02110-1301  USA
  */
 
-/*
-*  Number     BF537/6/4    BF561    BF533/2/1      BF549/8/4/2
-*
-*  GPIO_0       PF0         PF0        PF0         PA0...PJ13
-*  GPIO_1       PF1         PF1        PF1
-*  GPIO_2       PF2         PF2        PF2
-*  GPIO_3       PF3         PF3        PF3
-*  GPIO_4       PF4         PF4        PF4
-*  GPIO_5       PF5         PF5        PF5
-*  GPIO_6       PF6         PF6        PF6
-*  GPIO_7       PF7         PF7        PF7
-*  GPIO_8       PF8         PF8        PF8
-*  GPIO_9       PF9         PF9        PF9
-*  GPIO_10      PF10        PF10       PF10
-*  GPIO_11      PF11        PF11       PF11
-*  GPIO_12      PF12        PF12       PF12
-*  GPIO_13      PF13        PF13       PF13
-*  GPIO_14      PF14        PF14       PF14
-*  GPIO_15      PF15        PF15       PF15
-*  GPIO_16      PG0         PF16
-*  GPIO_17      PG1         PF17
-*  GPIO_18      PG2         PF18
-*  GPIO_19      PG3         PF19
-*  GPIO_20      PG4         PF20
-*  GPIO_21      PG5         PF21
-*  GPIO_22      PG6         PF22
-*  GPIO_23      PG7         PF23
-*  GPIO_24      PG8         PF24
-*  GPIO_25      PG9         PF25
-*  GPIO_26      PG10        PF26
-*  GPIO_27      PG11        PF27
-*  GPIO_28      PG12        PF28
-*  GPIO_29      PG13        PF29
-*  GPIO_30      PG14        PF30
-*  GPIO_31      PG15        PF31
-*  GPIO_32      PH0         PF32
-*  GPIO_33      PH1         PF33
-*  GPIO_34      PH2         PF34
-*  GPIO_35      PH3         PF35
-*  GPIO_36      PH4         PF36
-*  GPIO_37      PH5         PF37
-*  GPIO_38      PH6         PF38
-*  GPIO_39      PH7         PF39
-*  GPIO_40      PH8         PF40
-*  GPIO_41      PH9         PF41
-*  GPIO_42      PH10        PF42
-*  GPIO_43      PH11        PF43
-*  GPIO_44      PH12        PF44
-*  GPIO_45      PH13        PF45
-*  GPIO_46      PH14        PF46
-*  GPIO_47      PH15        PF47
-*/
-
 #include <linux/delay.h>
 #include <linux/module.h>
 #include <linux/err.h>
@@ -119,62 +66,61 @@ enum {
 #define AWA_DUMMY_READ(...)  do { } while (0)
 #endif
 
+static struct gpio_port_t * const gpio_array[] = {
 #if defined(BF533_FAMILY) || defined(BF538_FAMILY)
-static struct gpio_port_t *gpio_bankb[] = {
         (struct gpio_port_t *) FIO_FLAG_D,
-};
-#endif
-
-#if defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
-static struct gpio_port_t *gpio_bankb[] = {
+#elif defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
         (struct gpio_port_t *) PORTFIO,
         (struct gpio_port_t *) PORTGIO,
         (struct gpio_port_t *) PORTHIO,
+#elif defined(BF561_FAMILY)
+        (struct gpio_port_t *) FIO0_FLAG_D,
+        (struct gpio_port_t *) FIO1_FLAG_D,
+        (struct gpio_port_t *) FIO2_FLAG_D,
+#elif defined(BF548_FAMILY)
+        (struct gpio_port_t *)PORTA_FER,
+        (struct gpio_port_t *)PORTB_FER,
+        (struct gpio_port_t *)PORTC_FER,
+        (struct gpio_port_t *)PORTD_FER,
+        (struct gpio_port_t *)PORTE_FER,
+        (struct gpio_port_t *)PORTF_FER,
+        (struct gpio_port_t *)PORTG_FER,
+        (struct gpio_port_t *)PORTH_FER,
+        (struct gpio_port_t *)PORTI_FER,
+        (struct gpio_port_t *)PORTJ_FER,
+#else
+# error no gpio arrays defined
+#endif
 };
 
-static unsigned short *port_fer[] = {
+#if defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
+static unsigned short * const port_fer[] = {
         (unsigned short *) PORTF_FER,
         (unsigned short *) PORTG_FER,
         (unsigned short *) PORTH_FER,
 };
-#endif
 
-#if defined(BF527_FAMILY) || defined(BF518_FAMILY)
-static unsigned short *port_mux[] = {
+# if !defined(BF537_FAMILY)
+static unsigned short * const port_mux[] = {
         (unsigned short *) PORTF_MUX,
         (unsigned short *) PORTG_MUX,
         (unsigned short *) PORTH_MUX,
 };
 
 static const
-u8 pmux_offset[][16] =
-        {{ 0, 0, 0, 0, 0, 0, 0, 0, 2, 2, 4, 6, 8, 8, 10, 10 }, /* PORTF */
-         { 0, 0, 0, 0, 0, 2, 2, 4, 4, 6, 8, 10, 10, 10, 12, 12 }, /* PORTG */
-         { 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 4, 4, 4, 4, 4, 4 }, /* PORTH */
-        };
-#endif
-
-#ifdef BF561_FAMILY
-static struct gpio_port_t *gpio_bankb[] = {
-        (struct gpio_port_t *) FIO0_FLAG_D,
-        (struct gpio_port_t *) FIO1_FLAG_D,
-        (struct gpio_port_t *) FIO2_FLAG_D,
+u8 pmux_offset[][16] = {
+#  if defined(BF527_FAMILY)
+        { 0, 0, 0, 0, 0, 0, 0, 0, 2, 2, 4, 6, 8, 8, 10, 10 }, /* PORTF */
+        { 0, 0, 0, 0, 0, 2, 2, 4, 4, 6, 8, 10, 10, 10, 12, 12 }, /* PORTG */
+        { 0, 0, 0, 0, 0, 0, 0, 0, 2, 4, 4, 4, 4, 4, 4, 4 }, /* PORTH */
+#  elif defined(BF518_FAMILY)
+        { 0, 2, 2, 2, 2, 2, 2, 4, 6, 6, 6, 8, 8, 8, 8, 10 }, /* PORTF */
+        { 0, 0, 0, 2, 4, 6, 6, 6, 8, 10, 10, 12, 14, 14, 14, 14 }, /* PORTG */
+        { 0, 0, 0, 0, 2, 2, 4, 6, 10, 10, 10, 10, 10, 10, 10, 10 }, /* PORTH */
+#  endif
 };
-#endif
+# endif
 
-#ifdef BF548_FAMILY
-static struct gpio_port_t *gpio_array[] = {
-        (struct gpio_port_t *)PORTA_FER,
-        (struct gpio_port_t *)PORTB_FER,
-        (struct gpio_port_t *)PORTC_FER,
-        (struct gpio_port_t *)PORTD_FER,
-        (struct gpio_port_t *)PORTE_FER,
-        (struct gpio_port_t *)PORTF_FER,
-        (struct gpio_port_t *)PORTG_FER,
-        (struct gpio_port_t *)PORTH_FER,
-        (struct gpio_port_t *)PORTI_FER,
-        (struct gpio_port_t *)PORTJ_FER,
-};
 #endif
 
 static unsigned short reserved_gpio_map[GPIO_BANK_NUM];
@@ -188,35 +134,9 @@ static struct str_ident {
 } str_ident[MAX_RESOURCES];
 
 #if defined(CONFIG_PM)
-#if defined(CONFIG_BF54x)
-static struct gpio_port_s gpio_bank_saved[GPIO_BANK_NUM];
-#else
-static unsigned short wakeup_map[GPIO_BANK_NUM];
-static unsigned char wakeup_flags_map[MAX_BLACKFIN_GPIOS];
 static struct gpio_port_s gpio_bank_saved[GPIO_BANK_NUM];
-
-#ifdef BF533_FAMILY
-static unsigned int sic_iwr_irqs[] = {IRQ_PROG_INTB};
-#endif
-
-#ifdef BF537_FAMILY
-static unsigned int sic_iwr_irqs[] = {IRQ_PROG_INTB, IRQ_PORTG_INTB, IRQ_MAC_TX};
-#endif
-
-#ifdef BF538_FAMILY
-static unsigned int sic_iwr_irqs[] = {IRQ_PORTF_INTB};
 #endif
 
-#if defined(BF527_FAMILY) || defined(BF518_FAMILY)
-static unsigned int sic_iwr_irqs[] = {IRQ_PORTF_INTB, IRQ_PORTG_INTB, IRQ_PORTH_INTB};
-#endif
-
-#ifdef BF561_FAMILY
-static unsigned int sic_iwr_irqs[] = {IRQ_PROG0_INTB, IRQ_PROG1_INTB, IRQ_PROG2_INTB};
-#endif
-#endif
-#endif /* CONFIG_PM */
-
 inline int check_gpio(unsigned gpio)
 {
 #if defined(BF548_FAMILY)
@@ -330,9 +250,10 @@ static struct {
         {.res = P_SPI0_SSEL3, .offset = 0},
 };
 
-static void portmux_setup(unsigned short per, unsigned short function)
+static void portmux_setup(unsigned short per)
 {
         u16 y, offset, muxreg;
+        u16 function = P_FUNCT2MUX(per);
 
         for (y = 0; y < ARRAY_SIZE(port_mux_lut); y++) {
                 if (port_mux_lut[y].res == per) {
@@ -353,30 +274,33 @@ static void portmux_setup(unsigned short per, unsigned short function)
         }
 }
 #elif defined(BF548_FAMILY)
-inline void portmux_setup(unsigned short portno, unsigned short function)
+inline void portmux_setup(unsigned short per)
 {
         u32 pmux;
+        u16 ident = P_IDENT(per);
+        u16 function = P_FUNCT2MUX(per);
 
-        pmux = gpio_array[gpio_bank(portno)]->port_mux;
+        pmux = gpio_array[gpio_bank(ident)]->port_mux;
 
-        pmux &= ~(0x3 << (2 * gpio_sub_n(portno)));
-        pmux |= (function & 0x3) << (2 * gpio_sub_n(portno));
+        pmux &= ~(0x3 << (2 * gpio_sub_n(ident)));
+        pmux |= (function & 0x3) << (2 * gpio_sub_n(ident));
 
-        gpio_array[gpio_bank(portno)]->port_mux = pmux;
+        gpio_array[gpio_bank(ident)]->port_mux = pmux;
 }
 
-inline u16 get_portmux(unsigned short portno)
+inline u16 get_portmux(unsigned short per)
 {
         u32 pmux;
+        u16 ident = P_IDENT(per);
 
-        pmux = gpio_array[gpio_bank(portno)]->port_mux;
+        pmux = gpio_array[gpio_bank(ident)]->port_mux;
 
-        return (pmux >> (2 * gpio_sub_n(portno)) & 0x3);
+        return (pmux >> (2 * gpio_sub_n(ident)) & 0x3);
 }
 #elif defined(BF527_FAMILY) || defined(BF518_FAMILY)
-inline void portmux_setup(unsigned short portno, unsigned short function)
+inline void portmux_setup(unsigned short per)
 {
-        u16 pmux, ident = P_IDENT(portno);
+        u16 pmux, ident = P_IDENT(per), function = P_FUNCT2MUX(per);
         u8 offset = pmux_offset[gpio_bank(ident)][gpio_sub_n(ident)];
 
         pmux = *port_mux[gpio_bank(ident)];
@@ -424,90 +348,71 @@ void set_gpio_ ## name(unsigned gpio, unsigned short arg) \
         unsigned long flags; \
         local_irq_save_hw(flags); \
         if (arg) \
-                gpio_bankb[gpio_bank(gpio)]->name |= gpio_bit(gpio); \
+                gpio_array[gpio_bank(gpio)]->name |= gpio_bit(gpio); \
         else \
-                gpio_bankb[gpio_bank(gpio)]->name &= ~gpio_bit(gpio); \
+                gpio_array[gpio_bank(gpio)]->name &= ~gpio_bit(gpio); \
         AWA_DUMMY_READ(name); \
         local_irq_restore_hw(flags); \
 } \
 EXPORT_SYMBOL(set_gpio_ ## name);
 
-SET_GPIO(dir)
-SET_GPIO(inen)
-SET_GPIO(polar)
-SET_GPIO(edge)
-SET_GPIO(both)
+SET_GPIO(dir)   /* set_gpio_dir() */
+SET_GPIO(inen)  /* set_gpio_inen() */
+SET_GPIO(polar) /* set_gpio_polar() */
+SET_GPIO(edge)  /* set_gpio_edge() */
+SET_GPIO(both)  /* set_gpio_both() */
 
 
-#if ANOMALY_05000311 || ANOMALY_05000323
 #define SET_GPIO_SC(name) \
 void set_gpio_ ## name(unsigned gpio, unsigned short arg) \
 { \
         unsigned long flags; \
-        local_irq_save_hw(flags); \
-        if (arg) \
-                gpio_bankb[gpio_bank(gpio)]->name ## _set = gpio_bit(gpio); \
-        else \
-                gpio_bankb[gpio_bank(gpio)]->name ## _clear = gpio_bit(gpio); \
-        AWA_DUMMY_READ(name); \
-        local_irq_restore_hw(flags); \
-} \
-EXPORT_SYMBOL(set_gpio_ ## name);
-#else
-#define SET_GPIO_SC(name) \
-void set_gpio_ ## name(unsigned gpio, unsigned short arg) \
-{ \
+        if (ANOMALY_05000311 || ANOMALY_05000323) \
+                local_irq_save_hw(flags); \
         if (arg) \
-                gpio_bankb[gpio_bank(gpio)]->name ## _set = gpio_bit(gpio); \
+                gpio_array[gpio_bank(gpio)]->name ## _set = gpio_bit(gpio); \
         else \
-                gpio_bankb[gpio_bank(gpio)]->name ## _clear = gpio_bit(gpio); \
+                gpio_array[gpio_bank(gpio)]->name ## _clear = gpio_bit(gpio); \
+        if (ANOMALY_05000311 || ANOMALY_05000323) { \
+                AWA_DUMMY_READ(name); \
+                local_irq_restore_hw(flags); \
+        } \
 } \
 EXPORT_SYMBOL(set_gpio_ ## name);
-#endif
 
 SET_GPIO_SC(maska)
 SET_GPIO_SC(maskb)
 SET_GPIO_SC(data)
 
-#if ANOMALY_05000311 || ANOMALY_05000323
 void set_gpio_toggle(unsigned gpio)
 {
         unsigned long flags;
-        local_irq_save_hw(flags);
-        gpio_bankb[gpio_bank(gpio)]->toggle = gpio_bit(gpio);
-        AWA_DUMMY_READ(toggle);
-        local_irq_restore_hw(flags);
-}
-#else
-void set_gpio_toggle(unsigned gpio)
-{
-        gpio_bankb[gpio_bank(gpio)]->toggle = gpio_bit(gpio);
+        if (ANOMALY_05000311 || ANOMALY_05000323)
+                local_irq_save_hw(flags);
+        gpio_array[gpio_bank(gpio)]->toggle = gpio_bit(gpio);
+        if (ANOMALY_05000311 || ANOMALY_05000323) {
+                AWA_DUMMY_READ(toggle);
+                local_irq_restore_hw(flags);
+        }
 }
-#endif
 EXPORT_SYMBOL(set_gpio_toggle);
 
 
 /*Set current PORT date (16-bit word)*/
 
-#if ANOMALY_05000311 || ANOMALY_05000323
 #define SET_GPIO_P(name) \
 void set_gpiop_ ## name(unsigned gpio, unsigned short arg) \
 { \
         unsigned long flags; \
-        local_irq_save_hw(flags); \
-        gpio_bankb[gpio_bank(gpio)]->name = arg; \
-        AWA_DUMMY_READ(name); \
-        local_irq_restore_hw(flags); \
+        if (ANOMALY_05000311 || ANOMALY_05000323) \
+                local_irq_save_hw(flags); \
+        gpio_array[gpio_bank(gpio)]->name = arg; \
+        if (ANOMALY_05000311 || ANOMALY_05000323) { \
+                AWA_DUMMY_READ(name); \
+                local_irq_restore_hw(flags); \
+        } \
 } \
 EXPORT_SYMBOL(set_gpiop_ ## name);
-#else
-#define SET_GPIO_P(name) \
-void set_gpiop_ ## name(unsigned gpio, unsigned short arg) \
-{ \
-        gpio_bankb[gpio_bank(gpio)]->name = arg; \
-} \
-EXPORT_SYMBOL(set_gpiop_ ## name);
-#endif
 
 SET_GPIO_P(data)
 SET_GPIO_P(dir)
@@ -519,27 +424,21 @@ SET_GPIO_P(maska)
 SET_GPIO_P(maskb)
 
 /* Get a specific bit */
-#if ANOMALY_05000311 || ANOMALY_05000323
 #define GET_GPIO(name) \
 unsigned short get_gpio_ ## name(unsigned gpio) \
 { \
         unsigned long flags; \
         unsigned short ret; \
-        local_irq_save_hw(flags); \
-        ret = 0x01 & (gpio_bankb[gpio_bank(gpio)]->name >> gpio_sub_n(gpio)); \
-        AWA_DUMMY_READ(name); \
-        local_irq_restore_hw(flags); \
+        if (ANOMALY_05000311 || ANOMALY_05000323) \
+                local_irq_save_hw(flags); \
+        ret = 0x01 & (gpio_array[gpio_bank(gpio)]->name >> gpio_sub_n(gpio)); \
+        if (ANOMALY_05000311 || ANOMALY_05000323) { \
+                AWA_DUMMY_READ(name); \
+                local_irq_restore_hw(flags); \
+        } \
         return ret; \
 } \
 EXPORT_SYMBOL(get_gpio_ ## name);
-#else
-#define GET_GPIO(name) \
-unsigned short get_gpio_ ## name(unsigned gpio) \
-{ \
-        return (0x01 & (gpio_bankb[gpio_bank(gpio)]->name >> gpio_sub_n(gpio))); \
-} \
-EXPORT_SYMBOL(get_gpio_ ## name);
-#endif
 
 GET_GPIO(data)
 GET_GPIO(dir)
@@ -552,27 +451,21 @@ GET_GPIO(maskb)
 
 /*Get current PORT date (16-bit word)*/
 
-#if ANOMALY_05000311 || ANOMALY_05000323
 #define GET_GPIO_P(name) \
 unsigned short get_gpiop_ ## name(unsigned gpio) \
 { \
         unsigned long flags; \
         unsigned short ret; \
-        local_irq_save_hw(flags); \
-        ret = (gpio_bankb[gpio_bank(gpio)]->name); \
-        AWA_DUMMY_READ(name); \
-        local_irq_restore_hw(flags); \
+        if (ANOMALY_05000311 || ANOMALY_05000323) \
+                local_irq_save_hw(flags); \
+        ret = (gpio_array[gpio_bank(gpio)]->name); \
+        if (ANOMALY_05000311 || ANOMALY_05000323) { \
+                AWA_DUMMY_READ(name); \
+                local_irq_restore_hw(flags); \
+        } \
         return ret; \
 } \
 EXPORT_SYMBOL(get_gpiop_ ## name);
-#else
-#define GET_GPIO_P(name) \
-unsigned short get_gpiop_ ## name(unsigned gpio) \
-{ \
-        return (gpio_bankb[gpio_bank(gpio)]->name);\
-} \
-EXPORT_SYMBOL(get_gpiop_ ## name);
-#endif
 
 GET_GPIO_P(data)
 GET_GPIO_P(dir)
@@ -585,6 +478,26 @@ GET_GPIO_P(maskb)
 
 
 #ifdef CONFIG_PM
+
+static unsigned short wakeup_map[GPIO_BANK_NUM];
+static unsigned char wakeup_flags_map[MAX_BLACKFIN_GPIOS];
+
+static const unsigned int sic_iwr_irqs[] = {
+#if defined(BF533_FAMILY)
+        IRQ_PROG_INTB
+#elif defined(BF537_FAMILY)
+        IRQ_PROG_INTB, IRQ_PORTG_INTB, IRQ_MAC_TX
+#elif defined(BF538_FAMILY)
+        IRQ_PORTF_INTB
+#elif defined(BF527_FAMILY) || defined(BF518_FAMILY)
+        IRQ_PORTF_INTB, IRQ_PORTG_INTB, IRQ_PORTH_INTB
+#elif defined(BF561_FAMILY)
+        IRQ_PROG0_INTB, IRQ_PROG1_INTB, IRQ_PROG2_INTB
+#else
+# error no SIC_IWR defined
+#endif
+};
+
 /***********************************************************
 *
 * FUNCTIONS: Blackfin PM Setup API
@@ -669,18 +582,18 @@ u32 bfin_pm_standby_setup(void)
                 mask = wakeup_map[gpio_bank(i)];
                 bank = gpio_bank(i);
 
-                gpio_bank_saved[bank].maskb = gpio_bankb[bank]->maskb;
-                gpio_bankb[bank]->maskb = 0;
+                gpio_bank_saved[bank].maskb = gpio_array[bank]->maskb;
+                gpio_array[bank]->maskb = 0;
 
                 if (mask) {
 #if defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
                         gpio_bank_saved[bank].fer   = *port_fer[bank];
 #endif
-                        gpio_bank_saved[bank].inen  = gpio_bankb[bank]->inen;
-                        gpio_bank_saved[bank].polar = gpio_bankb[bank]->polar;
-                        gpio_bank_saved[bank].dir   = gpio_bankb[bank]->dir;
-                        gpio_bank_saved[bank].edge  = gpio_bankb[bank]->edge;
-                        gpio_bank_saved[bank].both  = gpio_bankb[bank]->both;
+                        gpio_bank_saved[bank].inen  = gpio_array[bank]->inen;
+                        gpio_bank_saved[bank].polar = gpio_array[bank]->polar;
+                        gpio_bank_saved[bank].dir   = gpio_array[bank]->dir;
+                        gpio_bank_saved[bank].edge  = gpio_array[bank]->edge;
+                        gpio_bank_saved[bank].both  = gpio_array[bank]->both;
                         gpio_bank_saved[bank].reserved =
                                                 reserved_gpio_map[bank];
 
@@ -700,7 +613,7 @@ u32 bfin_pm_standby_setup(void)
                         }
 
                         bfin_internal_set_wake(sic_iwr_irqs[bank], 1);
-                        gpio_bankb[bank]->maskb_set = wakeup_map[gpio_bank(i)];
+                        gpio_array[bank]->maskb_set = wakeup_map[gpio_bank(i)];
                 }
         }
 
@@ -721,18 +634,18 @@ void bfin_pm_standby_restore(void)
 #if defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
                         *port_fer[bank]         = gpio_bank_saved[bank].fer;
 #endif
-                        gpio_bankb[bank]->inen  = gpio_bank_saved[bank].inen;
-                        gpio_bankb[bank]->dir   = gpio_bank_saved[bank].dir;
-                        gpio_bankb[bank]->polar = gpio_bank_saved[bank].polar;
-                        gpio_bankb[bank]->edge  = gpio_bank_saved[bank].edge;
-                        gpio_bankb[bank]->both  = gpio_bank_saved[bank].both;
+                        gpio_array[bank]->inen  = gpio_bank_saved[bank].inen;
+                        gpio_array[bank]->dir   = gpio_bank_saved[bank].dir;
+                        gpio_array[bank]->polar = gpio_bank_saved[bank].polar;
+                        gpio_array[bank]->edge  = gpio_bank_saved[bank].edge;
+                        gpio_array[bank]->both  = gpio_bank_saved[bank].both;
 
                         reserved_gpio_map[bank] =
                                         gpio_bank_saved[bank].reserved;
                         bfin_internal_set_wake(sic_iwr_irqs[bank], 0);
                 }
 
-                gpio_bankb[bank]->maskb = gpio_bank_saved[bank].maskb;
+                gpio_array[bank]->maskb = gpio_bank_saved[bank].maskb;
         }
         AWA_DUMMY_READ(maskb);
 }
@@ -745,21 +658,21 @@ void bfin_gpio_pm_hibernate_suspend(void)
                 bank = gpio_bank(i);
 
 #if defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
-                        gpio_bank_saved[bank].fer   = *port_fer[bank];
+                gpio_bank_saved[bank].fer = *port_fer[bank];
 #if defined(BF527_FAMILY) || defined(BF518_FAMILY)
-                        gpio_bank_saved[bank].mux   = *port_mux[bank];
+                gpio_bank_saved[bank].mux = *port_mux[bank];
 #else
-                        if (bank == 0)
-                                gpio_bank_saved[bank].mux   = bfin_read_PORT_MUX();
+                if (bank == 0)
+                        gpio_bank_saved[bank].mux = bfin_read_PORT_MUX();
 #endif
 #endif
-                        gpio_bank_saved[bank].data  = gpio_bankb[bank]->data;
-                        gpio_bank_saved[bank].inen  = gpio_bankb[bank]->inen;
-                        gpio_bank_saved[bank].polar = gpio_bankb[bank]->polar;
-                        gpio_bank_saved[bank].dir   = gpio_bankb[bank]->dir;
-                        gpio_bank_saved[bank].edge  = gpio_bankb[bank]->edge;
-                        gpio_bank_saved[bank].both  = gpio_bankb[bank]->both;
-                        gpio_bank_saved[bank].maska  = gpio_bankb[bank]->maska;
+                gpio_bank_saved[bank].data  = gpio_array[bank]->data;
+                gpio_bank_saved[bank].inen  = gpio_array[bank]->inen;
+                gpio_bank_saved[bank].polar = gpio_array[bank]->polar;
+                gpio_bank_saved[bank].dir   = gpio_array[bank]->dir;
+                gpio_bank_saved[bank].edge  = gpio_array[bank]->edge;
+                gpio_bank_saved[bank].both  = gpio_array[bank]->both;
+                gpio_bank_saved[bank].maska = gpio_array[bank]->maska;
         }
 
         AWA_DUMMY_READ(maska);
@@ -770,27 +683,27 @@ void bfin_gpio_pm_hibernate_restore(void)
         int i, bank;
 
         for (i = 0; i < MAX_BLACKFIN_GPIOS; i += GPIO_BANKSIZE) {
-                        bank = gpio_bank(i);
+                bank = gpio_bank(i);
 
 #if defined(BF527_FAMILY) || defined(BF537_FAMILY) || defined(BF518_FAMILY)
 #if defined(BF527_FAMILY) || defined(BF518_FAMILY)
-                        *port_mux[bank] = gpio_bank_saved[bank].mux;
+                *port_mux[bank] = gpio_bank_saved[bank].mux;
 #else
-                        if (bank == 0)
-                                bfin_write_PORT_MUX(gpio_bank_saved[bank].mux);
+                if (bank == 0)
+                        bfin_write_PORT_MUX(gpio_bank_saved[bank].mux);
 #endif
-                        *port_fer[bank]         = gpio_bank_saved[bank].fer;
+                *port_fer[bank] = gpio_bank_saved[bank].fer;
 #endif
-                        gpio_bankb[bank]->inen  = gpio_bank_saved[bank].inen;
-                        gpio_bankb[bank]->dir   = gpio_bank_saved[bank].dir;
-                        gpio_bankb[bank]->polar = gpio_bank_saved[bank].polar;
-                        gpio_bankb[bank]->edge  = gpio_bank_saved[bank].edge;
-                        gpio_bankb[bank]->both  = gpio_bank_saved[bank].both;
+                gpio_array[bank]->inen  = gpio_bank_saved[bank].inen;
+                gpio_array[bank]->dir   = gpio_bank_saved[bank].dir;
+                gpio_array[bank]->polar = gpio_bank_saved[bank].polar;
+                gpio_array[bank]->edge  = gpio_bank_saved[bank].edge;
+                gpio_array[bank]->both  = gpio_bank_saved[bank].both;
 
-                        gpio_bankb[bank]->data_set = gpio_bank_saved[bank].data
-                                                        | gpio_bank_saved[bank].dir;
+                gpio_array[bank]->data_set = gpio_bank_saved[bank].data
+                                                | gpio_bank_saved[bank].dir;
 
-                        gpio_bankb[bank]->maska = gpio_bank_saved[bank].maska;
+                gpio_array[bank]->maska = gpio_bank_saved[bank].maska;
         }
         AWA_DUMMY_READ(maska);
 }
@@ -817,12 +730,12 @@ void bfin_gpio_pm_hibernate_suspend(void)
         for (i = 0; i < MAX_BLACKFIN_GPIOS; i += GPIO_BANKSIZE) {
                 bank = gpio_bank(i);
 
-                        gpio_bank_saved[bank].fer  = gpio_array[bank]->port_fer;
-                        gpio_bank_saved[bank].mux  = gpio_array[bank]->port_mux;
-                        gpio_bank_saved[bank].data  = gpio_array[bank]->port_data;
-                        gpio_bank_saved[bank].data  = gpio_array[bank]->port_data;
-                        gpio_bank_saved[bank].inen  = gpio_array[bank]->port_inen;
-                        gpio_bank_saved[bank].dir   = gpio_array[bank]->port_dir_set;
+                gpio_bank_saved[bank].fer = gpio_array[bank]->port_fer;
+                gpio_bank_saved[bank].mux = gpio_array[bank]->port_mux;
+                gpio_bank_saved[bank].data = gpio_array[bank]->data;
+                gpio_bank_saved[bank].data = gpio_array[bank]->data;
+                gpio_bank_saved[bank].inen = gpio_array[bank]->inen;
+                gpio_bank_saved[bank].dir = gpio_array[bank]->dir_set;
         }
 }
 
@@ -831,21 +744,21 @@ void bfin_gpio_pm_hibernate_restore(void)
         int i, bank;
 
         for (i = 0; i < MAX_BLACKFIN_GPIOS; i += GPIO_BANKSIZE) {
-                        bank = gpio_bank(i);
-
-                        gpio_array[bank]->port_mux  = gpio_bank_saved[bank].mux;
-                        gpio_array[bank]->port_fer  = gpio_bank_saved[bank].fer;
-                        gpio_array[bank]->port_inen  = gpio_bank_saved[bank].inen;
-                        gpio_array[bank]->port_dir_set   = gpio_bank_saved[bank].dir;
-                        gpio_array[bank]->port_set = gpio_bank_saved[bank].data
-                                                        | gpio_bank_saved[bank].dir;
+                bank = gpio_bank(i);
+
+                gpio_array[bank]->port_mux = gpio_bank_saved[bank].mux;
+                gpio_array[bank]->port_fer = gpio_bank_saved[bank].fer;
+                gpio_array[bank]->inen = gpio_bank_saved[bank].inen;
+                gpio_array[bank]->dir_set = gpio_bank_saved[bank].dir;
+                gpio_array[bank]->data_set = gpio_bank_saved[bank].data
+                                                | gpio_bank_saved[bank].dir;
         }
 }
 #endif
 
 unsigned short get_gpio_dir(unsigned gpio)
 {
-        return (0x01 & (gpio_array[gpio_bank(gpio)]->port_dir_clear >> gpio_sub_n(gpio)));
+        return (0x01 & (gpio_array[gpio_bank(gpio)]->dir_clear >> gpio_sub_n(gpio)));
 }
 EXPORT_SYMBOL(get_gpio_dir);
 
@@ -905,9 +818,7 @@ int peripheral_request(unsigned short per, const char *label)
                  */
 
 #ifdef BF548_FAMILY
-                u16 funct = get_portmux(ident);
-
-                if (!((per & P_MAYSHARE) && (funct == P_FUNCT2MUX(per)))) {
+                if (!((per & P_MAYSHARE) && get_portmux(per) == P_FUNCT2MUX(per))) {
 #else
                 if (!(per & P_MAYSHARE)) {
 #endif
@@ -931,11 +842,7 @@ int peripheral_request(unsigned short per, const char *label)
  anyway:
         reserved_peri_map[gpio_bank(ident)] |= gpio_bit(ident);
 
-#ifdef BF548_FAMILY
-        portmux_setup(ident, P_FUNCT2MUX(per));
-#else
-        portmux_setup(per, P_FUNCT2MUX(per));
-#endif
+        portmux_setup(per);
         port_setup(ident, PERIPHERAL_USAGE);
 
         local_irq_restore_hw(flags);
@@ -977,9 +884,6 @@ void peripheral_free(unsigned short per)
         if (!(per & P_DEFINED))
                 return;
 
-        if (check_gpio(ident) < 0)
-                return;
-
         local_irq_save_hw(flags);
 
         if (unlikely(!(reserved_peri_map[gpio_bank(ident)] & gpio_bit(ident)))) {
@@ -1056,9 +960,15 @@ int bfin_gpio_request(unsigned gpio, const char *label)
                 local_irq_restore_hw(flags);
                 return -EBUSY;
         }
-        if (unlikely(reserved_gpio_irq_map[gpio_bank(gpio)] & gpio_bit(gpio)))
+        if (unlikely(reserved_gpio_irq_map[gpio_bank(gpio)] & gpio_bit(gpio))) {
                 printk(KERN_NOTICE "bfin-gpio: GPIO %d is already reserved as gpio-irq!"
                        " (Documentation/blackfin/bfin-gpio-notes.txt)\n", gpio);
+        }
+#ifndef BF548_FAMILY
+        else {  /* Reset POLAR setting when acquiring a gpio for the first time */
+                set_gpio_polar(gpio, 0);
+        }
+#endif
 
         reserved_gpio_map[gpio_bank(gpio)] |= gpio_bit(gpio);
         set_label(gpio, label);
@@ -1078,6 +988,8 @@ void bfin_gpio_free(unsigned gpio)
         if (check_gpio(gpio) < 0)
                 return;
 
+        might_sleep();
+
         local_irq_save_hw(flags);
 
         if (unlikely(!(reserved_gpio_map[gpio_bank(gpio)] & gpio_bit(gpio)))) {
@@ -1158,8 +1070,16 @@ void bfin_gpio_irq_free(unsigned gpio)
         local_irq_restore_hw(flags);
 }
 
-
+static inline void __bfin_gpio_direction_input(unsigned gpio)
+{
 #ifdef BF548_FAMILY
+        gpio_array[gpio_bank(gpio)]->dir_clear = gpio_bit(gpio);
+#else
+        gpio_array[gpio_bank(gpio)]->dir &= ~gpio_bit(gpio);
+#endif
+        gpio_array[gpio_bank(gpio)]->inen |= gpio_bit(gpio);
+}
+
 int bfin_gpio_direction_input(unsigned gpio)
 {
         unsigned long flags;
@@ -1170,125 +1090,85 @@ int bfin_gpio_direction_input(unsigned gpio)
         }
 
         local_irq_save_hw(flags);
-        gpio_array[gpio_bank(gpio)]->port_dir_clear = gpio_bit(gpio);
-        gpio_array[gpio_bank(gpio)]->port_inen |= gpio_bit(gpio);
+        __bfin_gpio_direction_input(gpio);
+        AWA_DUMMY_READ(inen);
         local_irq_restore_hw(flags);
 
         return 0;
 }
 EXPORT_SYMBOL(bfin_gpio_direction_input);
 
-int bfin_gpio_direction_output(unsigned gpio, int value)
+void bfin_gpio_irq_prepare(unsigned gpio)
 {
+#ifdef BF548_FAMILY
         unsigned long flags;
+#endif
 
-        if (!(reserved_gpio_map[gpio_bank(gpio)] & gpio_bit(gpio))) {
-                gpio_error(gpio);
-                return -EINVAL;
-        }
+        port_setup(gpio, GPIO_USAGE);
 
+#ifdef BF548_FAMILY
         local_irq_save_hw(flags);
-        gpio_array[gpio_bank(gpio)]->port_inen &= ~gpio_bit(gpio);
-        gpio_set_value(gpio, value);
-        gpio_array[gpio_bank(gpio)]->port_dir_set = gpio_bit(gpio);
+        __bfin_gpio_direction_input(gpio);
         local_irq_restore_hw(flags);
-
-        return 0;
+#endif
 }
-EXPORT_SYMBOL(bfin_gpio_direction_output);
 
 void bfin_gpio_set_value(unsigned gpio, int arg)
 {
         if (arg)
-                gpio_array[gpio_bank(gpio)]->port_set = gpio_bit(gpio);
+                gpio_array[gpio_bank(gpio)]->data_set = gpio_bit(gpio);
         else
-                gpio_array[gpio_bank(gpio)]->port_clear = gpio_bit(gpio);
+                gpio_array[gpio_bank(gpio)]->data_clear = gpio_bit(gpio);
 }
 EXPORT_SYMBOL(bfin_gpio_set_value);
 
-int bfin_gpio_get_value(unsigned gpio)
-{
-        return (1 & (gpio_array[gpio_bank(gpio)]->port_data >> gpio_sub_n(gpio)));
-}
-EXPORT_SYMBOL(bfin_gpio_get_value);
-
-void bfin_gpio_irq_prepare(unsigned gpio)
+int bfin_gpio_direction_output(unsigned gpio, int value)
 {
         unsigned long flags;
 
-        port_setup(gpio, GPIO_USAGE);
+        if (!(reserved_gpio_map[gpio_bank(gpio)] & gpio_bit(gpio))) {
+                gpio_error(gpio);
+                return -EINVAL;
+        }
 
         local_irq_save_hw(flags);
-        gpio_array[gpio_bank(gpio)]->port_dir_clear = gpio_bit(gpio);
-        gpio_array[gpio_bank(gpio)]->port_inen |= gpio_bit(gpio);
-        local_irq_restore_hw(flags);
-}
 
+        gpio_array[gpio_bank(gpio)]->inen &= ~gpio_bit(gpio);
+        gpio_set_value(gpio, value);
+#ifdef BF548_FAMILY
+        gpio_array[gpio_bank(gpio)]->dir_set = gpio_bit(gpio);
 #else
+        gpio_array[gpio_bank(gpio)]->dir |= gpio_bit(gpio);
+#endif
+
+        AWA_DUMMY_READ(dir);
+        local_irq_restore_hw(flags);
+
+        return 0;
+}
+EXPORT_SYMBOL(bfin_gpio_direction_output);
 
 int bfin_gpio_get_value(unsigned gpio)
 {
+#ifdef BF548_FAMILY
+        return (1 & (gpio_array[gpio_bank(gpio)]->data >> gpio_sub_n(gpio)));
+#else
         unsigned long flags;
-        int ret;
 
         if (unlikely(get_gpio_edge(gpio))) {
+                int ret;
                 local_irq_save_hw(flags);
                 set_gpio_edge(gpio, 0);
                 ret = get_gpio_data(gpio);
                 set_gpio_edge(gpio, 1);
                 local_irq_restore_hw(flags);
-
                 return ret;
         } else
                 return get_gpio_data(gpio);
+#endif
 }
 EXPORT_SYMBOL(bfin_gpio_get_value);
 
-
-int bfin_gpio_direction_input(unsigned gpio)
-{
-        unsigned long flags;
-
-        if (!(reserved_gpio_map[gpio_bank(gpio)] & gpio_bit(gpio))) {
-                gpio_error(gpio);
-                return -EINVAL;
-        }
-
-        local_irq_save_hw(flags);
-        gpio_bankb[gpio_bank(gpio)]->dir &= ~gpio_bit(gpio);
-        gpio_bankb[gpio_bank(gpio)]->inen |= gpio_bit(gpio);
-        AWA_DUMMY_READ(inen);
-        local_irq_restore_hw(flags);
-
-        return 0;
-}
-EXPORT_SYMBOL(bfin_gpio_direction_input);
-
-int bfin_gpio_direction_output(unsigned gpio, int value)
-{
-        unsigned long flags;
-
-        if (!(reserved_gpio_map[gpio_bank(gpio)] & gpio_bit(gpio))) {
-                gpio_error(gpio);
-                return -EINVAL;
-        }
-
-        local_irq_save_hw(flags);
-        gpio_bankb[gpio_bank(gpio)]->inen &= ~gpio_bit(gpio);
-
-        if (value)
-                gpio_bankb[gpio_bank(gpio)]->data_set = gpio_bit(gpio);
-        else
-                gpio_bankb[gpio_bank(gpio)]->data_clear = gpio_bit(gpio);
-
-        gpio_bankb[gpio_bank(gpio)]->dir |= gpio_bit(gpio);
-        AWA_DUMMY_READ(dir);
-        local_irq_restore_hw(flags);
-
-        return 0;
-}
-EXPORT_SYMBOL(bfin_gpio_direction_output);
-
 /* If we are booting from SPI and our board lacks a strong enough pull up,
  * the core can reset and execute the bootrom faster than the resistor can
  * pull the signal logically high.  To work around this (common) error in
@@ -1299,23 +1179,15 @@ EXPORT_SYMBOL(bfin_gpio_direction_output);
  * lives here as we need to force all the GPIO states w/out going through
  * BUG() checks and such.
  */
-void bfin_gpio_reset_spi0_ssel1(void)
+void bfin_reset_boot_spi_cs(unsigned short pin)
 {
-        u16 gpio = P_IDENT(P_SPI0_SSEL1);
-
+        unsigned short gpio = P_IDENT(pin);
         port_setup(gpio, GPIO_USAGE);
-        gpio_bankb[gpio_bank(gpio)]->data_set = gpio_bit(gpio);
+        gpio_array[gpio_bank(gpio)]->data_set = gpio_bit(gpio);
         AWA_DUMMY_READ(data_set);
         udelay(1);
 }
 
-void bfin_gpio_irq_prepare(unsigned gpio)
-{
-        port_setup(gpio, GPIO_USAGE);
-}
-
-#endif /*BF548_FAMILY */
-
 #if defined(CONFIG_PROC_FS)
 static int gpio_proc_read(char *buf, char **start, off_t offset,
                           int len, int *unused_i, void *unused_v)
@@ -1369,11 +1241,7 @@ int bfin_gpiolib_get_value(struct gpio_chip *chip, unsigned gpio)
 
 void bfin_gpiolib_set_value(struct gpio_chip *chip, unsigned gpio, int value)
 {
-#ifdef BF548_FAMILY
         return bfin_gpio_set_value(gpio, value);
-#else
-        return set_gpio_data(gpio, value);
-#endif
 }
 
 int bfin_gpiolib_gpio_request(struct gpio_chip *chip, unsigned gpio)
diff --git a/arch/blackfin/kernel/cplb-mpu/cplbinit.c b/arch/blackfin/kernel/cplb-mpu/cplbinit.c
index bdb958486e7..3e329a6ce04 100644
--- a/arch/blackfin/kernel/cplb-mpu/cplbinit.c
+++ b/arch/blackfin/kernel/cplb-mpu/cplbinit.c
@@ -63,10 +63,8 @@ void __init generate_cplb_tables_cpu(unsigned int cpu)
         dcplb_tbl[cpu][i_d].addr = 0;
         dcplb_tbl[cpu][i_d++].data = SDRAM_OOPS | PAGE_SIZE_1KB;
 
-#if 0
         icplb_tbl[cpu][i_i].addr = 0;
-        icplb_tbl[cpu][i_i++].data = i_cache | CPLB_USER_RD | PAGE_SIZE_4KB;
-#endif
+        icplb_tbl[cpu][i_i++].data = i_cache | CPLB_USER_RD | PAGE_SIZE_1KB;
 
         /* Cover kernel memory with 4M pages.  */
         addr = 0;
diff --git a/arch/blackfin/kernel/cplb-nompu/cplbmgr.c b/arch/blackfin/kernel/cplb-nompu/cplbmgr.c
index 376249ab269..8cbb47c7b66 100644
--- a/arch/blackfin/kernel/cplb-nompu/cplbmgr.c
+++ b/arch/blackfin/kernel/cplb-nompu/cplbmgr.c
@@ -163,12 +163,14 @@ MGR_ATTR static int icplb_miss(int cpu)
                 nr_icplb_supv_miss[cpu]++;
 
         base = 0;
-        for (idx = 0; idx < icplb_nr_bounds; idx++) {
+        idx = 0;
+        do {
                 eaddr = icplb_bounds[idx].eaddr;
                 if (addr < eaddr)
                         break;
                 base = eaddr;
-        }
+        } while (++idx < icplb_nr_bounds);
+
         if (unlikely(idx == icplb_nr_bounds))
                 return CPLB_NO_ADDR_MATCH;
 
@@ -208,12 +210,14 @@ MGR_ATTR static int dcplb_miss(int cpu)
                 nr_dcplb_supv_miss[cpu]++;
 
         base = 0;
-        for (idx = 0; idx < dcplb_nr_bounds; idx++) {
+        idx = 0;
+        do {
                 eaddr = dcplb_bounds[idx].eaddr;
                 if (addr < eaddr)
                         break;
                 base = eaddr;
-        }
+        } while (++idx < dcplb_nr_bounds);
+
         if (unlikely(idx == dcplb_nr_bounds))
                 return CPLB_NO_ADDR_MATCH;
 
diff --git a/arch/blackfin/kernel/irqchip.c b/arch/blackfin/kernel/irqchip.c
index ab8209cbbad..23e9aa08071 100644
--- a/arch/blackfin/kernel/irqchip.c
+++ b/arch/blackfin/kernel/irqchip.c
@@ -35,6 +35,7 @@
 #include <linux/interrupt.h>
 #include <linux/irq.h>
 #include <asm/trace.h>
+#include <asm/pda.h>
 
 static atomic_t irq_err_count;
 static spinlock_t irq_controller_lock;
@@ -69,6 +70,11 @@ static struct irq_desc bad_irq_desc = {
 #endif
 };
 
+#ifdef CONFIG_CPUMASK_OFFSTACK
+/* We are not allocating a variable-sized bad_irq_desc.affinity */
+#error "Blackfin architecture does not support CONFIG_CPUMASK_OFFSTACK."
+#endif
+
 int show_interrupts(struct seq_file *p, void *v)
 {
         int i = *(loff_t *) v, j;
@@ -91,8 +97,13 @@ int show_interrupts(struct seq_file *p, void *v)
                 seq_putc(p, '\n');
  skip:
                 spin_unlock_irqrestore(&irq_desc[i].lock, flags);
-        } else if (i == NR_IRQS)
+        } else if (i == NR_IRQS) {
+                seq_printf(p, "NMI: ");
+                for_each_online_cpu(j)
+                        seq_printf(p, "%10u ", cpu_pda[j].__nmi_count);
+                seq_printf(p, "     CORE  Non Maskable Interrupt\n");
                 seq_printf(p, "Err: %10u\n",  atomic_read(&irq_err_count));
+        }
         return 0;
 }
 
diff --git a/arch/blackfin/kernel/reboot.c b/arch/blackfin/kernel/reboot.c
index eeee8cb4336..53d08dee853 100644
--- a/arch/blackfin/kernel/reboot.c
+++ b/arch/blackfin/kernel/reboot.c
@@ -20,8 +20,8 @@
  * reset while the Core B bit (on dual core parts) is cleared by
  * the core reset.
  */
-__attribute__((l1_text))
-static void _bfin_reset(void)
+__attribute__ ((__l1_text__, __noreturn__))
+static void bfin_reset(void)
 {
         /* Wait for completion of "system" events such as cache line
          * line fills so that we avoid infinite stalls later on as
@@ -30,7 +30,11 @@ static void _bfin_reset(void)
          */
         __builtin_bfin_ssync();
 
-        while (1) {
+        /* The bootrom checks to see how it was reset and will
+         * automatically perform a software reset for us when
+         * it starts executing after the core reset.
+         */
+        if (ANOMALY_05000353 || ANOMALY_05000386) {
                 /* Initiate System software reset. */
                 bfin_write_SWRST(0x7);
 
@@ -50,6 +54,11 @@ static void _bfin_reset(void)
                 /* Clear System software reset */
                 bfin_write_SWRST(0);
 
+                /* The BF526 ROM will crash during reset */
+#if defined(__ADSPBF522__) || defined(__ADSPBF524__) || defined(__ADSPBF526__)
+                bfin_read_SWRST();
+#endif
+
                 /* Wait for the SWRST write to complete.  Cannot rely on SSYNC
                  * though as the System state is all reset now.
                  */
@@ -60,22 +69,11 @@ static void _bfin_reset(void)
                         : "a" (15 * 1)
                         : "LC1", "LB1", "LT1"
                 );
+        }
 
+        while (1)
                 /* Issue core reset */
                 asm("raise 1");
-        }
-}
-
-static void bfin_reset(void)
-{
-        if (ANOMALY_05000353 || ANOMALY_05000386)
-                _bfin_reset();
-        else
-                /* the bootrom checks to see how it was reset and will
-                 * automatically perform a software reset for us when
-                 * it starts executing boot
-                 */
-                asm("raise 1;");
 }
 
 __attribute__((weak))
diff --git a/arch/blackfin/kernel/setup.c b/arch/blackfin/kernel/setup.c
index b2a811347b6..e5c11623080 100644
--- a/arch/blackfin/kernel/setup.c
+++ b/arch/blackfin/kernel/setup.c
@@ -60,7 +60,7 @@ void __initdata *init_retx, *init_saved_retx, *init_saved_seqstat,
 #define BFIN_MEMMAP_MAX         128 /* number of entries in bfin_memmap */
 #define BFIN_MEMMAP_RAM         1
 #define BFIN_MEMMAP_RESERVED    2
-struct bfin_memmap {
+static struct bfin_memmap {
         int nr_map;
         struct bfin_memmap_entry {
                 unsigned long long addr; /* start of memory segment */
@@ -824,7 +824,15 @@ void __init setup_arch(char **cmdline_p)
         flash_probe();
 #endif
 
+        printk(KERN_INFO "Boot Mode: %i\n", bfin_read_SYSCR() & 0xF);
+
+        /* Newer parts mirror SWRST bits in SYSCR */
+#if defined(CONFIG_BF53x) || defined(CONFIG_BF561) || \
+    defined(CONFIG_BF538) || defined(CONFIG_BF539)
         _bfin_swrst = bfin_read_SWRST();
+#else
+        _bfin_swrst = bfin_read_SYSCR();
+#endif
 
 #ifdef CONFIG_DEBUG_DOUBLEFAULT_PRINT
         bfin_write_SWRST(_bfin_swrst & ~DOUBLE_FAULT);
@@ -853,7 +861,7 @@ void __init setup_arch(char **cmdline_p)
         else if (_bfin_swrst & RESET_SOFTWARE)
                 printk(KERN_NOTICE "Reset caused by Software reset\n");
 
-        printk(KERN_INFO "Blackfin support (C) 2004-2008 Analog Devices, Inc.\n");
+        printk(KERN_INFO "Blackfin support (C) 2004-2009 Analog Devices, Inc.\n");
         if (bfin_compiled_revid() == 0xffff)
                 printk(KERN_INFO "Compiled for ADSP-%s Rev any\n", CPU);
         else if (bfin_compiled_revid() == -1)
diff --git a/arch/blackfin/kernel/traps.c b/arch/blackfin/kernel/traps.c
index 5b0667da8d0..ffe7fb53ecc 100644
--- a/arch/blackfin/kernel/traps.c
+++ b/arch/blackfin/kernel/traps.c
@@ -673,6 +673,14 @@ static void decode_instruction(unsigned short *address)
                         verbose_printk("RTI");
                 else if (opcode == 0x0012)
                         verbose_printk("RTX");
+                else if (opcode == 0x0013)
+                        verbose_printk("RTN");
+                else if (opcode == 0x0014)
+                        verbose_printk("RTE");
+                else if (opcode == 0x0025)
+                        verbose_printk("EMUEXCPT");
+                else if (opcode == 0x0040 && opcode <= 0x0047)
+                        verbose_printk("STI R%i", opcode & 7);
                 else if (opcode >= 0x0050 && opcode <= 0x0057)
                         verbose_printk("JUMP (P%i)", opcode & 7);
                 else if (opcode >= 0x0060 && opcode <= 0x0067)
@@ -681,6 +689,10 @@ static void decode_instruction(unsigned short *address)
                         verbose_printk("CALL (PC+P%i)", opcode & 7);
                 else if (opcode >= 0x0080 && opcode <= 0x0087)
                         verbose_printk("JUMP (PC+P%i)", opcode & 7);
+                else if (opcode >= 0x0090 && opcode <= 0x009F)
+                        verbose_printk("RAISE 0x%x", opcode & 0xF);
+                else if (opcode >= 0x00A0 && opcode <= 0x00AF)
+                        verbose_printk("EXCPT 0x%x", opcode & 0xF);
                 else if ((opcode >= 0x1000 && opcode <= 0x13FF) || (opcode >= 0x1800 && opcode <= 0x1BFF))
                         verbose_printk("IF !CC JUMP");
                 else if ((opcode >= 0x1400 && opcode <= 0x17ff) || (opcode >= 0x1c00 && opcode <= 0x1fff))
@@ -820,11 +832,8 @@ void show_stack(struct task_struct *task, unsigned long *stack)
         decode_address(buf, (unsigned int)stack);
         printk(KERN_NOTICE " SP: [0x%p] %s\n", stack, buf);
 
-        addr = (unsigned int *)((unsigned int)stack & ~0x3F);
-
         /* First thing is to look for a frame pointer */
-        for (addr = (unsigned int *)((unsigned int)stack & ~0xF), i = 0;
-                addr < endstack; addr++, i++) {
+        for (addr = (unsigned int *)((unsigned int)stack & ~0xF); addr < endstack; addr++) {
                 if (*addr & 0x1)
                         continue;
                 ins_addr = (unsigned short *)*addr;
@@ -834,7 +843,8 @@ void show_stack(struct task_struct *task, unsigned long *stack)
 
                 if (fp) {
                         /* Let's check to see if it is a frame pointer */
-                        while (fp >= (addr - 1) && fp < endstack && fp)
+                        while (fp >= (addr - 1) && fp < endstack
+                               && fp && ((unsigned int) fp & 0x3) == 0)
                                 fp = (unsigned int *)*fp;
                         if (fp == 0 || fp == endstack) {
                                 fp = addr - 1;
@@ -1052,8 +1062,9 @@ void show_regs(struct pt_regs *fp)
         char buf [150];
         struct irqaction *action;
         unsigned int i;
-        unsigned long flags;
+        unsigned long flags = 0;
         unsigned int cpu = smp_processor_id();
+        unsigned char in_atomic = (bfin_read_IPEND() & 0x10) || in_atomic();
 
         verbose_printk(KERN_NOTICE "\n" KERN_NOTICE "SEQUENCER STATUS:\t\t%s\n", print_tainted());
         verbose_printk(KERN_NOTICE " SEQSTAT: %08lx  IPEND: %04lx  SYSCFG: %04lx\n",
@@ -1073,17 +1084,22 @@ void show_regs(struct pt_regs *fp)
         }
         verbose_printk(KERN_NOTICE "  EXCAUSE   : 0x%lx\n",
                 fp->seqstat & SEQSTAT_EXCAUSE);
-        for (i = 6; i <= 15 ; i++) {
+        for (i = 2; i <= 15 ; i++) {
                 if (fp->ipend & (1 << i)) {
-                        decode_address(buf, bfin_read32(EVT0 + 4*i));
-                        verbose_printk(KERN_NOTICE "  physical IVG%i asserted : %s\n", i, buf);
+                        if (i != 4) {
+                                decode_address(buf, bfin_read32(EVT0 + 4*i));
+                                verbose_printk(KERN_NOTICE "  physical IVG%i asserted : %s\n", i, buf);
+                        } else
+                                verbose_printk(KERN_NOTICE "  interrupts disabled\n");
                 }
         }
 
         /* if no interrupts are going off, don't print this out */
         if (fp->ipend & ~0x3F) {
                 for (i = 0; i < (NR_IRQS - 1); i++) {
-                        spin_lock_irqsave(&irq_desc[i].lock, flags);
+                        if (!in_atomic)
+                                spin_lock_irqsave(&irq_desc[i].lock, flags);
+
                         action = irq_desc[i].action;
                         if (!action)
                                 goto unlock;
@@ -1096,7 +1112,8 @@ void show_regs(struct pt_regs *fp)
                         }
                         verbose_printk("\n");
 unlock:
-                        spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+                        if (!in_atomic)
+                                spin_unlock_irqrestore(&irq_desc[i].lock, flags);
                 }
         }
 
diff --git a/arch/blackfin/mach-bf518/boards/ezbrd.c b/arch/blackfin/mach-bf518/boards/ezbrd.c
index 15f1351c864..0e175342112 100644
--- a/arch/blackfin/mach-bf518/boards/ezbrd.c
+++ b/arch/blackfin/mach-bf518/boards/ezbrd.c
@@ -46,6 +46,7 @@
 #include <asm/dpmc.h>
 #include <asm/bfin_sdh.h>
 #include <linux/spi/ad7877.h>
+#include <net/dsa.h>
 
 /*
  * Name the Board for the /proc/cpuinfo
@@ -104,8 +105,31 @@ static struct platform_device rtc_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
+};
+#endif
+
+#if defined(CONFIG_NET_DSA_KSZ8893M) || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
+static struct dsa_platform_data ksz8893m_switch_data = {
+        .mii_bus = &bfin_mii_bus.dev,
+        .netdev = &bfin_mac_device.dev,
+        .port_names[0]  = NULL,
+        .port_names[1]  = "eth%d",
+        .port_names[2]  = "eth%d",
+        .port_names[3]  = "cpu",
+};
+
+static struct platform_device ksz8893m_switch_device = {
+        .name           = "dsa",
+        .id             = 0,
+        .num_resources  = 0,
+        .dev.platform_data = &ksz8893m_switch_data,
 };
 #endif
 
@@ -147,6 +171,15 @@ static struct bfin5xx_spi_chip spi_adc_chip_info = {
 };
 #endif
 
+#if defined(CONFIG_NET_DSA_KSZ8893M) \
+        || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
+/* SPI SWITCH CHIP */
+static struct bfin5xx_spi_chip spi_switch_info = {
+        .enable_dma = 0,
+        .bits_per_word = 8,
+};
+#endif
+
 #if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
 static struct bfin5xx_spi_chip spi_mmc_chip_info = {
         .enable_dma = 1,
@@ -226,6 +259,19 @@ static struct spi_board_info bfin_spi_board_info[] __initdata = {
         },
 #endif
 
+#if defined(CONFIG_NET_DSA_KSZ8893M) \
+        || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
+        {
+                .modalias = "ksz8893m",
+                .max_speed_hz = 5000000,
+                .bus_num = 0,
+                .chip_select = 1,
+                .platform_data = NULL,
+                .controller_data = &spi_switch_info,
+                .mode = SPI_MODE_3,
+        },
+#endif
+
 #if defined(CONFIG_SPI_MMC) || defined(CONFIG_SPI_MMC_MODULE)
         {
                 .modalias = "spi_mmc_dummy",
@@ -473,7 +519,6 @@ static struct platform_device i2c_bfin_twi_device = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
         {
@@ -487,7 +532,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
         },
 #endif
 };
-#endif
 
 #if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
 static struct platform_device bfin_sport0_uart_device = {
@@ -584,9 +628,14 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
+#if defined(CONFIG_NET_DSA_KSZ8893M) || defined(CONFIG_NET_DSA_KSZ8893M_MODULE)
+        &ksz8893m_switch_device,
+#endif
+
 #if defined(CONFIG_SPI_BFIN) || defined(CONFIG_SPI_BFIN_MODULE)
         &bfin_spi0_device,
         &bfin_spi1_device,
@@ -632,12 +681,8 @@ static struct platform_device *stamp_devices[] __initdata = {
 static int __init ezbrd_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
-
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
-
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
         return 0;
@@ -649,7 +694,7 @@ void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
 
 void bfin_get_ether_addr(char *addr)
diff --git a/arch/blackfin/mach-bf518/include/mach/portmux.h b/arch/blackfin/mach-bf518/include/mach/portmux.h
index ac16d54734d..f618b487b2b 100644
--- a/arch/blackfin/mach-bf518/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf518/include/mach/portmux.h
@@ -103,6 +103,8 @@
 #define P_SPI1_SSEL4    (P_DEFINED | P_IDENT(GPIO_PF8) | P_FUNCT(2))
 #define P_SPI1_SSEL5    (P_DEFINED | P_IDENT(GPIO_PG11) | P_FUNCT(2))
 
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL2
+
 /* SPORT Port Mux */
 #define P_SPORT0_DRPRI  (P_DEFINED | P_IDENT(GPIO_PG3) | P_FUNCT(0))
 #define P_SPORT0_RSCLK  (P_DEFINED | P_IDENT(GPIO_PG4) | P_FUNCT(0))
diff --git a/arch/blackfin/mach-bf527/boards/cm_bf527.c b/arch/blackfin/mach-bf527/boards/cm_bf527.c
index a2c3578f4b6..856c097b531 100644
--- a/arch/blackfin/mach-bf527/boards/cm_bf527.c
+++ b/arch/blackfin/mach-bf527/boards/cm_bf527.c
@@ -403,8 +403,13 @@ static struct platform_device isp1362_hcd_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -793,7 +798,6 @@ static struct platform_device i2c_bfin_twi_device = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
         {
@@ -809,7 +813,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
         },
 #endif
 };
-#endif
 
 #if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
 static struct platform_device bfin_sport0_uart_device = {
@@ -920,6 +923,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -968,27 +972,23 @@ static struct platform_device *stamp_devices[] __initdata = {
         &bfin_gpios_device,
 };
 
-static int __init stamp_init(void)
+static int __init cm_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
-
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
-
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
         return 0;
 }
 
-arch_initcall(stamp_init);
+arch_initcall(cm_init);
 
 void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
 
 void bfin_get_ether_addr(char *addr)
diff --git a/arch/blackfin/mach-bf527/boards/ezbrd.c b/arch/blackfin/mach-bf527/boards/ezbrd.c
index 0314bd3355e..83606fcdde2 100644
--- a/arch/blackfin/mach-bf527/boards/ezbrd.c
+++ b/arch/blackfin/mach-bf527/boards/ezbrd.c
@@ -208,8 +208,13 @@ static struct platform_device rtc_device = {
 
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -590,7 +595,6 @@ static struct platform_device i2c_bfin_twi_device = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
         {
@@ -604,7 +608,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
         },
 #endif
 };
-#endif
 
 #if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
 static struct platform_device bfin_sport0_uart_device = {
@@ -720,6 +723,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -764,27 +768,23 @@ static struct platform_device *stamp_devices[] __initdata = {
         &bfin_gpios_device,
 };
 
-static int __init stamp_init(void)
+static int __init ezbrd_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
-
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
-
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
         return 0;
 }
 
-arch_initcall(stamp_init);
+arch_initcall(ezbrd_init);
 
 void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
 
 void bfin_get_ether_addr(char *addr)
diff --git a/arch/blackfin/mach-bf527/boards/ezkit.c b/arch/blackfin/mach-bf527/boards/ezkit.c
index 9454fb7b18c..d0864111ef5 100644
--- a/arch/blackfin/mach-bf527/boards/ezkit.c
+++ b/arch/blackfin/mach-bf527/boards/ezkit.c
@@ -425,8 +425,13 @@ static struct platform_device isp1362_hcd_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -830,7 +835,6 @@ static struct platform_device i2c_bfin_twi_device = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_TWI_LCD) || defined(CONFIG_TWI_LCD_MODULE)
         {
@@ -844,7 +848,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
         },
 #endif
 };
-#endif
 
 #if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
 static struct platform_device bfin_sport0_uart_device = {
@@ -988,6 +991,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -1048,27 +1052,23 @@ static struct platform_device *stamp_devices[] __initdata = {
         &bfin_gpios_device,
 };
 
-static int __init stamp_init(void)
+static int __init ezkit_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
-
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
-
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
         return 0;
 }
 
-arch_initcall(stamp_init);
+arch_initcall(ezkit_init);
 
 void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
 
 void bfin_get_ether_addr(char *addr)
diff --git a/arch/blackfin/mach-bf527/include/mach/portmux.h b/arch/blackfin/mach-bf527/include/mach/portmux.h
index 7f6da2c386b..72b1652be4d 100644
--- a/arch/blackfin/mach-bf527/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf527/include/mach/portmux.h
@@ -73,6 +73,8 @@
 
 #define P_HWAIT         (P_DONTCARE)
 
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL1
+
 #define P_SPI0_SS       (P_DEFINED | P_IDENT(GPIO_PG1) | P_FUNCT(0))
 #define P_SPI0_SSEL1    (P_DEFINED | P_IDENT(GPIO_PG1) | P_FUNCT(2))
 #define P_SPI0_SCK      (P_DEFINED | P_IDENT(GPIO_PG2) | P_FUNCT(2))
diff --git a/arch/blackfin/mach-bf533/boards/blackstamp.c b/arch/blackfin/mach-bf533/boards/blackstamp.c
index 6ee607c259a..015c18f85e7 100644
--- a/arch/blackfin/mach-bf533/boards/blackstamp.c
+++ b/arch/blackfin/mach-bf533/boards/blackstamp.c
@@ -309,10 +309,8 @@ static struct platform_device i2c_gpio_device = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 };
-#endif
 
 static const unsigned int cclk_vlev_datasheet[] =
 {
@@ -390,10 +388,8 @@ static int __init blackstamp_init(void)
 
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
 
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
 
         ret = platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         if (ret < 0)
diff --git a/arch/blackfin/mach-bf533/boards/stamp.c b/arch/blackfin/mach-bf533/boards/stamp.c
index 07f9ad1e189..db96f33f72e 100644
--- a/arch/blackfin/mach-bf533/boards/stamp.c
+++ b/arch/blackfin/mach-bf533/boards/stamp.c
@@ -441,7 +441,6 @@ static struct platform_device i2c_gpio_device = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_JOYSTICK_AD7142) || defined(CONFIG_JOYSTICK_AD7142_MODULE)
         {
@@ -461,7 +460,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
         },
 #endif
 };
-#endif
 
 static const unsigned int cclk_vlev_datasheet[] =
 {
@@ -550,10 +548,8 @@ static int __init stamp_init(void)
 
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
 
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
 
         ret = platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         if (ret < 0)
diff --git a/arch/blackfin/mach-bf533/include/mach/portmux.h b/arch/blackfin/mach-bf533/include/mach/portmux.h
index 685a2651dcd..2f59ce0b0cb 100644
--- a/arch/blackfin/mach-bf533/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf533/include/mach/portmux.h
@@ -54,14 +54,11 @@
 #define P_SPI0_SSEL2    (P_DEFINED | P_IDENT(GPIO_PF2))
 #define P_SPI0_SSEL1    (P_DEFINED | P_IDENT(GPIO_PF1))
 #define P_SPI0_SS       (P_DEFINED | P_IDENT(GPIO_PF0))
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL2
 
 #define P_TMR2          (P_DONTCARE)
 #define P_TMR1          (P_DONTCARE)
 #define P_TMR0          (P_DONTCARE)
 #define P_TMRCLK        (P_DEFINED | P_IDENT(GPIO_PF1))
 
-
-
-
-
 #endif /* _MACH_PORTMUX_H_ */
diff --git a/arch/blackfin/mach-bf537/boards/cm_bf537.c b/arch/blackfin/mach-bf537/boards/cm_bf537.c
index 6ac8e4d5bd3..9cd8fb2a30d 100644
--- a/arch/blackfin/mach-bf537/boards/cm_bf537.c
+++ b/arch/blackfin/mach-bf537/boards/cm_bf537.c
@@ -479,8 +479,13 @@ static struct platform_device bfin_sport1_uart_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -591,6 +596,7 @@ static struct platform_device *cm_bf537_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
diff --git a/arch/blackfin/mach-bf537/boards/generic_board.c b/arch/blackfin/mach-bf537/boards/generic_board.c
index dd6e6bfb98e..da710fdc456 100644
--- a/arch/blackfin/mach-bf537/boards/generic_board.c
+++ b/arch/blackfin/mach-bf537/boards/generic_board.c
@@ -262,8 +262,13 @@ static struct platform_device isp1362_hcd_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -662,6 +667,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -708,7 +714,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 };
 
-static int __init stamp_init(void)
+static int __init generic_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
@@ -720,13 +726,13 @@ static int __init stamp_init(void)
         return 0;
 }
 
-arch_initcall(stamp_init);
+arch_initcall(generic_init);
 
 void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
diff --git a/arch/blackfin/mach-bf537/boards/minotaur.c b/arch/blackfin/mach-bf537/boards/minotaur.c
index bb795341cb1..db7d3a385e4 100644
--- a/arch/blackfin/mach-bf537/boards/minotaur.c
+++ b/arch/blackfin/mach-bf537/boards/minotaur.c
@@ -61,8 +61,13 @@ static struct platform_device rtc_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -324,6 +329,7 @@ static struct platform_device *minotaur_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -377,5 +383,5 @@ void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
diff --git a/arch/blackfin/mach-bf537/boards/pnav10.c b/arch/blackfin/mach-bf537/boards/pnav10.c
index 89de94f4545..590eb3a139b 100644
--- a/arch/blackfin/mach-bf537/boards/pnav10.c
+++ b/arch/blackfin/mach-bf537/boards/pnav10.c
@@ -198,8 +198,13 @@ static struct platform_device isp1362_hcd_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -529,6 +534,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -558,7 +564,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 };
 
-static int __init stamp_init(void)
+static int __init pnav_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
@@ -569,7 +575,7 @@ static int __init stamp_init(void)
         return 0;
 }
 
-arch_initcall(stamp_init);
+arch_initcall(pnav_init);
 
 void bfin_get_ether_addr(char *addr)
 {
diff --git a/arch/blackfin/mach-bf537/boards/stamp.c b/arch/blackfin/mach-bf537/boards/stamp.c
index d812e2514a2..cd04c5e4487 100644
--- a/arch/blackfin/mach-bf537/boards/stamp.c
+++ b/arch/blackfin/mach-bf537/boards/stamp.c
@@ -321,8 +321,13 @@ static struct platform_device isp1362_hcd_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -1068,7 +1073,6 @@ static struct adp5588_kpad_platform_data adp5588_kpad_data = {
 };
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
 #if defined(CONFIG_JOYSTICK_AD7142) || defined(CONFIG_JOYSTICK_AD7142_MODULE)
         {
@@ -1102,7 +1106,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info[] = {
         },
 #endif
 };
-#endif
 
 #if defined(CONFIG_SERIAL_BFIN_SPORT) || defined(CONFIG_SERIAL_BFIN_SPORT_MODULE)
 static struct platform_device bfin_sport0_uart_device = {
@@ -1217,6 +1220,7 @@ static struct platform_device *stamp_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -1284,12 +1288,8 @@ static struct platform_device *stamp_devices[] __initdata = {
 static int __init stamp_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
-
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info,
                                 ARRAY_SIZE(bfin_i2c_board_info));
-#endif
-
         bfin_plat_nand_init();
         platform_add_devices(stamp_devices, ARRAY_SIZE(stamp_devices));
         spi_register_board_info(bfin_spi_board_info, ARRAY_SIZE(bfin_spi_board_info));
@@ -1307,7 +1307,7 @@ void native_machine_restart(char *cmd)
 {
         /* workaround reboot hang when booting from SPI */
         if ((bfin_read_SYSCR() & 0x7) == 0x3)
-                bfin_gpio_reset_spi0_ssel1();
+                bfin_reset_boot_spi_cs(P_DEFAULT_BOOT_SPI_CS);
 }
 
 /*
diff --git a/arch/blackfin/mach-bf537/boards/tcm_bf537.c b/arch/blackfin/mach-bf537/boards/tcm_bf537.c
index 2f4b066153c..3f4f203a06e 100644
--- a/arch/blackfin/mach-bf537/boards/tcm_bf537.c
+++ b/arch/blackfin/mach-bf537/boards/tcm_bf537.c
@@ -481,8 +481,13 @@ static struct platform_device bfin_sport1_uart_device = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+static struct platform_device bfin_mii_bus = {
+        .name = "bfin_mii_bus",
+};
+
 static struct platform_device bfin_mac_device = {
         .name = "bfin_mac",
+        .dev.platform_data = &bfin_mii_bus,
 };
 #endif
 
@@ -593,6 +598,7 @@ static struct platform_device *cm_bf537_devices[] __initdata = {
 #endif
 
 #if defined(CONFIG_BFIN_MAC) || defined(CONFIG_BFIN_MAC_MODULE)
+        &bfin_mii_bus,
         &bfin_mac_device,
 #endif
 
@@ -615,7 +621,7 @@ static struct platform_device *cm_bf537_devices[] __initdata = {
         &bfin_gpios_device,
 };
 
-static int __init cm_bf537_init(void)
+static int __init tcm_bf537_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
         platform_add_devices(cm_bf537_devices, ARRAY_SIZE(cm_bf537_devices));
@@ -629,7 +635,7 @@ static int __init cm_bf537_init(void)
         return 0;
 }
 
-arch_initcall(cm_bf537_init);
+arch_initcall(tcm_bf537_init);
 
 void bfin_get_ether_addr(char *addr)
 {
diff --git a/arch/blackfin/mach-bf537/include/mach/portmux.h b/arch/blackfin/mach-bf537/include/mach/portmux.h
index 78fee6e0f23..87285e75e90 100644
--- a/arch/blackfin/mach-bf537/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf537/include/mach/portmux.h
@@ -31,6 +31,7 @@
 #define P_PPI0_FS1      (P_DEFINED | P_IDENT(GPIO_PF9) | P_FUNCT(1))
 #define P_TACLK0        (P_DEFINED | P_IDENT(GPIO_PF14) | P_FUNCT(1))
 #define P_TMRCLK        (P_DEFINED | P_IDENT(GPIO_PF15) | P_FUNCT(1))
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL1
 
 #define P_PPI0_D0       (P_DEFINED | P_IDENT(GPIO_PG0) | P_FUNCT(0))
 #define P_PPI0_D1       (P_DEFINED | P_IDENT(GPIO_PG1) | P_FUNCT(0))
diff --git a/arch/blackfin/mach-bf538/include/mach/portmux.h b/arch/blackfin/mach-bf538/include/mach/portmux.h
index 1e031b588b4..c8db264e3e4 100644
--- a/arch/blackfin/mach-bf538/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf538/include/mach/portmux.h
@@ -102,5 +102,6 @@
 #define P_SPI0_SSEL2    (P_DEFINED | P_IDENT(GPIO_PF2))
 #define P_SPI0_SSEL1    (P_DEFINED | P_IDENT(GPIO_PF1))
 #define P_SPI0_SS       (P_DEFINED | P_IDENT(GPIO_PF0))
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL2
 
 #endif /* _MACH_PORTMUX_H_ */
diff --git a/arch/blackfin/mach-bf548/boards/ezkit.c b/arch/blackfin/mach-bf548/boards/ezkit.c
index 309c16014ca..096e661700a 100644
--- a/arch/blackfin/mach-bf548/boards/ezkit.c
+++ b/arch/blackfin/mach-bf548/boards/ezkit.c
@@ -781,7 +781,6 @@ static struct platform_device i2c_bfin_twi1_device = {
 #endif
 #endif
 
-#ifdef CONFIG_I2C_BOARDINFO
 static struct i2c_board_info __initdata bfin_i2c_board_info0[] = {
 };
 
@@ -800,7 +799,6 @@ static struct i2c_board_info __initdata bfin_i2c_board_info1[] = {
 #endif
 };
 #endif
-#endif
 
 #if defined(CONFIG_KEYBOARD_GPIO) || defined(CONFIG_KEYBOARD_GPIO_MODULE)
 #include <linux/gpio_keys.h>
@@ -956,14 +954,12 @@ static int __init ezkit_init(void)
 {
         printk(KERN_INFO "%s(): registering device resources\n", __func__);
 
-#ifdef CONFIG_I2C_BOARDINFO
         i2c_register_board_info(0, bfin_i2c_board_info0,
                                 ARRAY_SIZE(bfin_i2c_board_info0));
 #if !defined(CONFIG_BF542)      /* The BF542 only has 1 TWI */
         i2c_register_board_info(1, bfin_i2c_board_info1,
                                 ARRAY_SIZE(bfin_i2c_board_info1));
 #endif
-#endif
 
         platform_add_devices(ezkit_devices, ARRAY_SIZE(ezkit_devices));
 
diff --git a/arch/blackfin/mach-bf548/include/mach/anomaly.h b/arch/blackfin/mach-bf548/include/mach/anomaly.h
index 3b5430999f4..23d03c52f4b 100644
--- a/arch/blackfin/mach-bf548/include/mach/anomaly.h
+++ b/arch/blackfin/mach-bf548/include/mach/anomaly.h
@@ -175,6 +175,7 @@
 #define ANOMALY_05000311 (0)
 #define ANOMALY_05000323 (0)
 #define ANOMALY_05000363 (0)
+#define ANOMALY_05000380 (0)
 #define ANOMALY_05000412 (0)
 #define ANOMALY_05000432 (0)
 #define ANOMALY_05000435 (0)
diff --git a/arch/blackfin/mach-bf548/include/mach/bf548.h b/arch/blackfin/mach-bf548/include/mach/bf548.h
index f0e56998481..cd31f72bdd8 100644
--- a/arch/blackfin/mach-bf548/include/mach/bf548.h
+++ b/arch/blackfin/mach-bf548/include/mach/bf548.h
@@ -104,6 +104,18 @@
 
 #define AMGCTLVAL       (V_AMBEN | V_AMCKEN)
 
+#if defined(CONFIG_BF542M)
+# define CONFIG_BF542
+#elif defined(CONFIG_BF544M)
+# define CONFIG_BF544
+#elif defined(CONFIG_BF547M)
+# define CONFIG_BF547
+#elif defined(CONFIG_BF548M)
+# define CONFIG_BF548
+#elif defined(CONFIG_BF549M)
+# define CONFIG_BF549
+#endif
+
 #if defined(CONFIG_BF542)
 # define CPU   "BF542"
 # define CPUID 0x27de
diff --git a/arch/blackfin/mach-bf548/include/mach/gpio.h b/arch/blackfin/mach-bf548/include/mach/gpio.h
index bba82dc75f1..3a205170978 100644
--- a/arch/blackfin/mach-bf548/include/mach/gpio.h
+++ b/arch/blackfin/mach-bf548/include/mach/gpio.h
@@ -195,17 +195,17 @@
 struct gpio_port_t {
         unsigned short port_fer;
         unsigned short dummy1;
-        unsigned short port_data;
+        unsigned short data;
         unsigned short dummy2;
-        unsigned short port_set;
+        unsigned short data_set;
         unsigned short dummy3;
-        unsigned short port_clear;
+        unsigned short data_clear;
         unsigned short dummy4;
-        unsigned short port_dir_set;
+        unsigned short dir_set;
         unsigned short dummy5;
-        unsigned short port_dir_clear;
+        unsigned short dir_clear;
         unsigned short dummy6;
-        unsigned short port_inen;
+        unsigned short inen;
         unsigned short dummy7;
         unsigned int port_mux;
 };
diff --git a/arch/blackfin/mach-bf548/include/mach/portmux.h b/arch/blackfin/mach-bf548/include/mach/portmux.h
index 8177a567dcd..ffb1d0a44b4 100644
--- a/arch/blackfin/mach-bf548/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf548/include/mach/portmux.h
@@ -125,6 +125,7 @@
 #define P_KEY_COL2      (P_DEFINED | P_IDENT(GPIO_PD14) | P_FUNCT(3))
 #define P_KEY_COL3      (P_DEFINED | P_IDENT(GPIO_PD15) | P_FUNCT(3))
 
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL1
 #define P_SPI0_SCK      (P_DEFINED | P_IDENT(GPIO_PE0) | P_FUNCT(0))
 #define P_SPI0_MISO     (P_DEFINED | P_IDENT(GPIO_PE1) | P_FUNCT(0))
 #define P_SPI0_MOSI     (P_DEFINED | P_IDENT(GPIO_PE2) | P_FUNCT(0))
diff --git a/arch/blackfin/mach-bf561/include/mach/defBF561.h b/arch/blackfin/mach-bf561/include/mach/defBF561.h
index d7c50975965..cf922295f4c 100644
--- a/arch/blackfin/mach-bf561/include/mach/defBF561.h
+++ b/arch/blackfin/mach-bf561/include/mach/defBF561.h
@@ -1106,6 +1106,8 @@
 #define DLEN_8               0x0        /* PPI Data Length mask for DLEN=8 */
 #define DLEN(x) (((x-9) & 0x07) << 11)  /* PPI Data Length (only works for x=10-->x=16) */
 #define POL                  0x0000C000 /* PPI Signal Polarities       */
+#define POLC            0x4000          /* PPI Clock Polarity */
+#define POLS            0x8000          /* PPI Frame Sync Polarity */
 
 /* PPI_STATUS Masks */
 #define FLD                  0x00000400 /* Field Indicator   */
diff --git a/arch/blackfin/mach-bf561/include/mach/portmux.h b/arch/blackfin/mach-bf561/include/mach/portmux.h
index a6ee8206efb..2e5ad6347de 100644
--- a/arch/blackfin/mach-bf561/include/mach/portmux.h
+++ b/arch/blackfin/mach-bf561/include/mach/portmux.h
@@ -85,5 +85,6 @@
 #define P_SPI0_MOSI     (P_DONTCARE)
 #define P_SPI0_MISO     (P_DONTCARE)
 #define P_SPI0_SCK      (P_DONTCARE)
+#define P_DEFAULT_BOOT_SPI_CS P_SPI0_SSEL2
 
 #endif /* _MACH_PORTMUX_H_ */
diff --git a/arch/blackfin/mach-common/clocks-init.c b/arch/blackfin/mach-common/clocks-init.c
index 5d182abefc7..9dddb6f8cc8 100644
--- a/arch/blackfin/mach-common/clocks-init.c
+++ b/arch/blackfin/mach-common/clocks-init.c
@@ -14,6 +14,7 @@
 #include <asm/clocks.h>
 #include <asm/mem_init.h>
 
+#define SDGCTL_WIDTH (1 << 31)  /* SDRAM external data path width */
 #define PLL_CTL_VAL \
         (((CONFIG_VCO_MULT & 63) << 9) | CLKIN_HALF | \
          (PLL_BYPASS << 8) | (ANOMALY_05000265 ? 0x8000 : 0))
@@ -76,7 +77,7 @@ void init_clocks(void)
         bfin_write_PLL_DIV(CONFIG_CCLK_ACT_DIV | CONFIG_SCLK_DIV);
 #ifdef EBIU_SDGCTL
         bfin_write_EBIU_SDRRC(mem_SDRRC);
-        bfin_write_EBIU_SDGCTL(mem_SDGCTL);
+        bfin_write_EBIU_SDGCTL((bfin_read_EBIU_SDGCTL() & SDGCTL_WIDTH) | mem_SDGCTL);
 #else
         bfin_write_EBIU_RSTCTL(bfin_read_EBIU_RSTCTL() & ~(SRREQ));
         do_sync();
diff --git a/arch/blackfin/mach-common/entry.S b/arch/blackfin/mach-common/entry.S
index fae77465137..88de053bbe8 100644
--- a/arch/blackfin/mach-common/entry.S
+++ b/arch/blackfin/mach-common/entry.S
@@ -151,13 +151,6 @@ ENTRY(_ex_syscall)
         jump.s _bfin_return_from_exception;
 ENDPROC(_ex_syscall)
 
-ENTRY(_ex_soft_bp)
-        r7 = retx;
-        r7 += -2;
-        retx = r7;
-        jump.s _ex_trap_c;
-ENDPROC(_ex_soft_bp)
-
 ENTRY(_ex_single_step)
         /* If we just returned from an interrupt, the single step event is
            for the RTI instruction.  */
@@ -1087,7 +1080,7 @@ ENTRY(_ex_table)
          * EXCPT instruction can provide 4 bits of EXCAUSE, allowing 16 to be user defined
          */
         .long _ex_syscall       /* 0x00 - User Defined - Linux Syscall */
-        .long _ex_soft_bp       /* 0x01 - User Defined - Software breakpoint */
+        .long _ex_trap_c        /* 0x01 - User Defined - Software breakpoint */
 #ifdef  CONFIG_KGDB
         .long _ex_trap_c        /* 0x02 - User Defined - KGDB initial connection
                                                          and break signal trap */
diff --git a/arch/blackfin/mach-common/head.S b/arch/blackfin/mach-common/head.S
index e1e42c029e1..698d4c05947 100644
--- a/arch/blackfin/mach-common/head.S
+++ b/arch/blackfin/mach-common/head.S
@@ -17,6 +17,19 @@
 
 __INIT
 
+ENTRY(__init_clear_bss)
+        r2 = r2 - r1;
+        cc = r2 == 0;
+        if cc jump .L_bss_done;
+        r2 >>= 2;
+        p1 = r1;
+        p2 = r2;
+        lsetup (1f, 1f) lc0 = p2;
+1:      [p1++] = r0;
+.L_bss_done:
+        rts;
+ENDPROC(__init_clear_bss)
+
 #define INITIAL_STACK   (L1_SCRATCH_START + L1_SCRATCH_LENGTH - 12)
 
 ENTRY(__start)
@@ -144,6 +157,35 @@ ENTRY(__start)
         call _init_early_exception_vectors;
 #endif
 
+        r0 = 0 (x);
+        /* Zero out all of the fun bss regions */
+#if L1_DATA_A_LENGTH > 0
+        r1.l = __sbss_l1;
+        r1.h = __sbss_l1;
+        r2.l = __ebss_l1;
+        r2.h = __ebss_l1;
+        call __init_clear_bss
+#endif
+#if L1_DATA_B_LENGTH > 0
+        r1.l = __sbss_b_l1;
+        r1.h = __sbss_b_l1;
+        r2.l = __ebss_b_l1;
+        r2.h = __ebss_b_l1;
+        call __init_clear_bss
+#endif
+#if L2_LENGTH > 0
+        r1.l = __sbss_l2;
+        r1.h = __sbss_l2;
+        r2.l = __ebss_l2;
+        r2.h = __ebss_l2;
+        call __init_clear_bss
+#endif
+        r1.l = ___bss_start;
+        r1.h = ___bss_start;
+        r2.l = ___bss_stop;
+        r2.h = ___bss_stop;
+        call __init_clear_bss
+
         /* Put The Code for PLL Programming and SDRAM Programming in L1 ISRAM */
         call _bfin_relocate_l1_mem;
 #ifdef CONFIG_BFIN_KERNEL_CLOCK
@@ -185,19 +227,6 @@ ENDPROC(__start)
 # define WDOG_CTL WDOGA_CTL
 #endif
 
-ENTRY(__init_clear_bss)
-        r2 = r2 - r1;
-        cc = r2 == 0;
-        if cc jump .L_bss_done;
-        r2 >>= 2;
-        p1 = r1;
-        p2 = r2;
-        lsetup (1f, 1f) lc0 = p2;
-1:      [p1++] = r0;
-.L_bss_done:
-        rts;
-ENDPROC(__init_clear_bss)
-
 ENTRY(_real_start)
         /* Enable nested interrupts */
         [--sp] = reti;
@@ -209,35 +238,6 @@ ENTRY(_real_start)
         w[p0] = r0;
         ssync;
 
-        r0 = 0 (x);
-        /* Zero out all of the fun bss regions */
-#if L1_DATA_A_LENGTH > 0
-        r1.l = __sbss_l1;
-        r1.h = __sbss_l1;
-        r2.l = __ebss_l1;
-        r2.h = __ebss_l1;
-        call __init_clear_bss
-#endif
-#if L1_DATA_B_LENGTH > 0
-        r1.l = __sbss_b_l1;
-        r1.h = __sbss_b_l1;
-        r2.l = __ebss_b_l1;
-        r2.h = __ebss_b_l1;
-        call __init_clear_bss
-#endif
-#if L2_LENGTH > 0
-        r1.l = __sbss_l2;
-        r1.h = __sbss_l2;
-        r2.l = __ebss_l2;
-        r2.h = __ebss_l2;
-        call __init_clear_bss
-#endif
-        r1.l = ___bss_start;
-        r1.h = ___bss_start;
-        r2.l = ___bss_stop;
-        r2.h = ___bss_stop;
-        call __init_clear_bss
-
         /* Pass the u-boot arguments to the global value command line */
         R0 = R7;
         call _cmdline_init;
diff --git a/arch/blackfin/mach-common/interrupt.S b/arch/blackfin/mach-common/interrupt.S
index 473df0f7fa7..43c4eb9acb6 100644
--- a/arch/blackfin/mach-common/interrupt.S
+++ b/arch/blackfin/mach-common/interrupt.S
@@ -195,7 +195,7 @@ ENDPROC(_evt_ivhw)
 /* Interrupt routine for evt2 (NMI).
  * We don't actually use this, so just return.
  * For inner circle type details, please see:
- * http://docs.blackfin.uclinux.org/doku.php?id=linux:nmi
+ * http://docs.blackfin.uclinux.org/doku.php?id=linux-kernel:nmi
  */
 ENTRY(_evt_nmi)
 .weak _evt_nmi
diff --git a/arch/blackfin/mach-common/ints-priority.c b/arch/blackfin/mach-common/ints-priority.c
index 1bba6030dce..202494568c6 100644
--- a/arch/blackfin/mach-common/ints-priority.c
+++ b/arch/blackfin/mach-common/ints-priority.c
@@ -1101,10 +1101,9 @@ int __init init_arch_irq(void)
             IMASK_IVG14 | IMASK_IVG13 | IMASK_IVG12 | IMASK_IVG11 |
             IMASK_IVG10 | IMASK_IVG9 | IMASK_IVG8 | IMASK_IVG7 | IMASK_IVGHW;
 
-#if defined(CONFIG_BF54x) || defined(CONFIG_BF52x) || defined(CONFIG_BF561) \
-        || defined(BF538_FAMILY) || defined(CONFIG_BF51x)
+#ifdef SIC_IWR0
         bfin_write_SIC_IWR0(IWR_DISABLE_ALL);
-#if defined(CONFIG_BF52x) || defined(CONFIG_BF51x)
+# ifdef SIC_IWR1
         /* BF52x/BF51x system reset does not properly reset SIC_IWR1 which
          * will screw up the bootrom as it relies on MDMA0/1 waking it
          * up from IDLE instructions.  See this report for more info:
@@ -1114,10 +1113,8 @@ int __init init_arch_irq(void)
                 bfin_write_SIC_IWR1(IWR_ENABLE(10) | IWR_ENABLE(11));
         else
                 bfin_write_SIC_IWR1(IWR_DISABLE_ALL);
-#else
-        bfin_write_SIC_IWR1(IWR_DISABLE_ALL);
-#endif
-# ifdef CONFIG_BF54x
+# endif
+# ifdef SIC_IWR2
         bfin_write_SIC_IWR2(IWR_DISABLE_ALL);
 # endif
 #else
diff --git a/arch/blackfin/mach-common/pm.c b/arch/blackfin/mach-common/pm.c
index d3d70fd67c1..f48a6aebb49 100644
--- a/arch/blackfin/mach-common/pm.c
+++ b/arch/blackfin/mach-common/pm.c
@@ -82,10 +82,9 @@ void bfin_pm_suspend_standby_enter(void)
 
         bfin_pm_standby_restore();
 
-#if defined(CONFIG_BF54x) || defined(CONFIG_BF52x)  || defined(CONFIG_BF561) || \
-        defined(CONFIG_BF538) || defined(CONFIG_BF539) || defined(CONFIG_BF51x)
+#ifdef SIC_IWR0
         bfin_write_SIC_IWR0(IWR_DISABLE_ALL);
-#if defined(CONFIG_BF52x) || defined(CONFIG_BF51x)
+# ifdef SIC_IWR1
         /* BF52x system reset does not properly reset SIC_IWR1 which
          * will screw up the bootrom as it relies on MDMA0/1 waking it
          * up from IDLE instructions.  See this report for more info:
@@ -95,10 +94,8 @@ void bfin_pm_suspend_standby_enter(void)
                 bfin_write_SIC_IWR1(IWR_ENABLE(10) | IWR_ENABLE(11));
         else
                 bfin_write_SIC_IWR1(IWR_DISABLE_ALL);
-#else
-        bfin_write_SIC_IWR1(IWR_DISABLE_ALL);
-#endif
-# ifdef CONFIG_BF54x
+# endif
+# ifdef SIC_IWR2
         bfin_write_SIC_IWR2(IWR_DISABLE_ALL);
 # endif
 #else
diff --git a/arch/frv/mm/dma-alloc.c b/arch/frv/mm/dma-alloc.c
index dc6522c464d..44840e73e90 100644
--- a/arch/frv/mm/dma-alloc.c
+++ b/arch/frv/mm/dma-alloc.c
@@ -36,10 +36,10 @@
 #include <linux/vmalloc.h>
 #include <linux/init.h>
 #include <linux/pci.h>
+#include <linux/hardirq.h>
 
 #include <asm/pgalloc.h>
 #include <asm/io.h>
-#include <asm/hardirq.h>
 #include <asm/mmu_context.h>
 #include <asm/pgtable.h>
 #include <asm/mmu.h>
diff --git a/arch/ia64/include/asm/percpu.h b/arch/ia64/include/asm/percpu.h
index 77f30b664b4..30cf46534dd 100644
--- a/arch/ia64/include/asm/percpu.h
+++ b/arch/ia64/include/asm/percpu.h
@@ -27,12 +27,12 @@ extern void *per_cpu_init(void);
 
 #else /* ! SMP */
 
-#define PER_CPU_ATTRIBUTES      __attribute__((__section__(".data.percpu")))
-
 #define per_cpu_init()                          (__phys_per_cpu_start)
 
 #endif  /* SMP */
 
+#define PER_CPU_BASE_SECTION ".data.percpu"
+
 /*
  * Be extremely careful when taking the address of this variable!  Due to virtual
  * remapping, it is different from the canonical address returned by __get_cpu_var(var)!
diff --git a/arch/ia64/include/asm/topology.h b/arch/ia64/include/asm/topology.h
index 32f3af1641c..3193f4417e1 100644
--- a/arch/ia64/include/asm/topology.h
+++ b/arch/ia64/include/asm/topology.h
@@ -84,7 +84,7 @@ void build_cpu_to_node_map(void);
         .child                  = NULL,                 \
         .groups                 = NULL,                 \
         .min_interval           = 8,                    \
-        .max_interval           = 8*(min(num_online_cpus(), 32)), \
+        .max_interval           = 8*(min(num_online_cpus(), 32U)), \
         .busy_factor            = 64,                   \
         .imbalance_pct          = 125,                  \
         .cache_nice_tries       = 2,                    \
diff --git a/arch/ia64/include/asm/uv/uv.h b/arch/ia64/include/asm/uv/uv.h
new file mode 100644
index 00000000000..61b5bdfd980
--- /dev/null
+++ b/arch/ia64/include/asm/uv/uv.h
@@ -0,0 +1,13 @@
+#ifndef _ASM_IA64_UV_UV_H
+#define _ASM_IA64_UV_UV_H
+
+#include <asm/system.h>
+#include <asm/sn/simulator.h>
+
+static inline int is_uv_system(void)
+{
+        /* temporary support for running on hardware simulator */
+        return IS_MEDUSA() || ia64_platform_is("uv");
+}
+
+#endif  /* _ASM_IA64_UV_UV_H */
diff --git a/arch/ia64/kernel/acpi.c b/arch/ia64/kernel/acpi.c
index d541671caf4..2363ed17319 100644
--- a/arch/ia64/kernel/acpi.c
+++ b/arch/ia64/kernel/acpi.c
@@ -199,6 +199,10 @@ char *__init __acpi_map_table(unsigned long phys_addr, unsigned long size)
         return __va(phys_addr);
 }
 
+char *__init __acpi_unmap_table(unsigned long virt_addr, unsigned long size)
+{
+}
+
 /* --------------------------------------------------------------------------
                             Boot-time Table Parsing
    -------------------------------------------------------------------------- */
diff --git a/arch/ia64/kernel/iosapic.c b/arch/ia64/kernel/iosapic.c
index 5cfd3d91001..006ad366a45 100644
--- a/arch/ia64/kernel/iosapic.c
+++ b/arch/ia64/kernel/iosapic.c
@@ -880,7 +880,7 @@ iosapic_unregister_intr (unsigned int gsi)
         if (iosapic_intr_info[irq].count == 0) {
 #ifdef CONFIG_SMP
                 /* Clear affinity */
-                cpus_setall(idesc->affinity);
+                cpumask_setall(idesc->affinity);
 #endif
                 /* Clear the interrupt information */
                 iosapic_intr_info[irq].dest = 0;
diff --git a/arch/ia64/kernel/irq.c b/arch/ia64/kernel/irq.c
index a58f64ca9f0..226233a6fa1 100644
--- a/arch/ia64/kernel/irq.c
+++ b/arch/ia64/kernel/irq.c
@@ -103,7 +103,7 @@ static char irq_redir [NR_IRQS]; // = { [0 ... NR_IRQS-1] = 1 };
 void set_irq_affinity_info (unsigned int irq, int hwid, int redir)
 {
         if (irq < NR_IRQS) {
-                cpumask_copy(&irq_desc[irq].affinity,
+                cpumask_copy(irq_desc[irq].affinity,
                              cpumask_of(cpu_logical_id(hwid)));
                 irq_redir[irq] = (char) (redir & 0xff);
         }
@@ -148,7 +148,7 @@ static void migrate_irqs(void)
                 if (desc->status == IRQ_PER_CPU)
                         continue;
 
-                if (cpumask_any_and(&irq_desc[irq].affinity, cpu_online_mask)
+                if (cpumask_any_and(irq_desc[irq].affinity, cpu_online_mask)
                     >= nr_cpu_ids) {
                         /*
                          * Save it for phase 2 processing
diff --git a/arch/ia64/kernel/irq_ia64.c b/arch/ia64/kernel/irq_ia64.c
index 28d3d483db9..927ad027820 100644
--- a/arch/ia64/kernel/irq_ia64.c
+++ b/arch/ia64/kernel/irq_ia64.c
@@ -493,11 +493,13 @@ ia64_handle_irq (ia64_vector vector, struct pt_regs *regs)
         saved_tpr = ia64_getreg(_IA64_REG_CR_TPR);
         ia64_srlz_d();
         while (vector != IA64_SPURIOUS_INT_VECTOR) {
+                struct irq_desc *desc = irq_to_desc(vector);
+
                 if (unlikely(IS_LOCAL_TLB_FLUSH(vector))) {
                         smp_local_flush_tlb();
-                        kstat_this_cpu.irqs[vector]++;
+                        kstat_incr_irqs_this_cpu(vector, desc);
                 } else if (unlikely(IS_RESCHEDULE(vector)))
-                        kstat_this_cpu.irqs[vector]++;
+                        kstat_incr_irqs_this_cpu(vector, desc);
                 else {
                         int irq = local_vector_to_irq(vector);
 
@@ -551,11 +553,13 @@ void ia64_process_pending_intr(void)
           * Perform normal interrupt style processing
           */
         while (vector != IA64_SPURIOUS_INT_VECTOR) {
+                struct irq_desc *desc = irq_to_desc(vector);
+
                 if (unlikely(IS_LOCAL_TLB_FLUSH(vector))) {
                         smp_local_flush_tlb();
-                        kstat_this_cpu.irqs[vector]++;
+                        kstat_incr_irqs_this_cpu(vector, desc);
                 } else if (unlikely(IS_RESCHEDULE(vector)))
-                        kstat_this_cpu.irqs[vector]++;
+                        kstat_incr_irqs_this_cpu(vector, desc);
                 else {
                         struct pt_regs *old_regs = set_irq_regs(NULL);
                         int irq = local_vector_to_irq(vector);
diff --git a/arch/ia64/kernel/msi_ia64.c b/arch/ia64/kernel/msi_ia64.c
index 89033933903..dcb6b7c51ea 100644
--- a/arch/ia64/kernel/msi_ia64.c
+++ b/arch/ia64/kernel/msi_ia64.c
@@ -75,7 +75,7 @@ static void ia64_set_msi_irq_affinity(unsigned int irq,
         msg.data = data;
 
         write_msi_msg(irq, &msg);
-        irq_desc[irq].affinity = cpumask_of_cpu(cpu);
+        cpumask_copy(irq_desc[irq].affinity, cpumask_of(cpu));
 }
 #endif /* CONFIG_SMP */
 
@@ -187,7 +187,7 @@ static void dmar_msi_set_affinity(unsigned int irq, const struct cpumask *mask)
         msg.address_lo |= MSI_ADDR_DESTID_CPU(cpu_physical_id(cpu));
 
         dmar_msi_write(irq, &msg);
-        irq_desc[irq].affinity = *mask;
+        cpumask_copy(irq_desc[irq].affinity, mask);
 }
 #endif /* CONFIG_SMP */
 
diff --git a/arch/ia64/kernel/vmlinux.lds.S b/arch/ia64/kernel/vmlinux.lds.S
index 10a7d47e851..f45e4e508ec 100644
--- a/arch/ia64/kernel/vmlinux.lds.S
+++ b/arch/ia64/kernel/vmlinux.lds.S
@@ -219,6 +219,7 @@ SECTIONS
   .data.percpu PERCPU_ADDR : AT(__phys_per_cpu_start - LOAD_OFFSET)
         {
                 __per_cpu_start = .;
+                *(.data.percpu.page_aligned)
                 *(.data.percpu)
                 *(.data.percpu.shared_aligned)
                 __per_cpu_end = .;
diff --git a/arch/ia64/sn/kernel/io_acpi_init.c b/arch/ia64/sn/kernel/io_acpi_init.c
index c5a214026a7..d0223abbbbd 100644
--- a/arch/ia64/sn/kernel/io_acpi_init.c
+++ b/arch/ia64/sn/kernel/io_acpi_init.c
@@ -443,7 +443,7 @@ sn_acpi_slot_fixup(struct pci_dev *dev)
                 size = pci_resource_len(dev, PCI_ROM_RESOURCE);
                 addr = ioremap(pcidev_info->pdi_pio_mapped_addr[PCI_ROM_RESOURCE],
                                size);
-                image_size = pci_get_rom_size(addr, size);
+                image_size = pci_get_rom_size(dev, addr, size);
                 dev->resource[PCI_ROM_RESOURCE].start = (unsigned long) addr;
                 dev->resource[PCI_ROM_RESOURCE].end =
                                         (unsigned long) addr + image_size - 1;
diff --git a/arch/ia64/sn/kernel/io_init.c b/arch/ia64/sn/kernel/io_init.c
index 4e1801bad83..e2eb2da60f9 100644
--- a/arch/ia64/sn/kernel/io_init.c
+++ b/arch/ia64/sn/kernel/io_init.c
@@ -269,7 +269,7 @@ sn_io_slot_fixup(struct pci_dev *dev)
 
                         rom = ioremap(pci_resource_start(dev, PCI_ROM_RESOURCE),
                                       size + 1);
-                        image_size = pci_get_rom_size(rom, size + 1);
+                        image_size = pci_get_rom_size(dev, rom, size + 1);
                         dev->resource[PCI_ROM_RESOURCE].end =
                                 dev->resource[PCI_ROM_RESOURCE].start +
                                 image_size - 1;
diff --git a/arch/ia64/sn/kernel/msi_sn.c b/arch/ia64/sn/kernel/msi_sn.c
index ca553b0429c..81e428943d7 100644
--- a/arch/ia64/sn/kernel/msi_sn.c
+++ b/arch/ia64/sn/kernel/msi_sn.c
@@ -205,7 +205,7 @@ static void sn_set_msi_irq_affinity(unsigned int irq,
         msg.address_lo = (u32)(bus_addr & 0x00000000ffffffff);
 
         write_msi_msg(irq, &msg);
-        irq_desc[irq].affinity = *cpu_mask;
+        cpumask_copy(irq_desc[irq].affinity, cpu_mask);
 }
 #endif /* CONFIG_SMP */
 
diff --git a/arch/mips/Kconfig b/arch/mips/Kconfig
index 52c80c2a57f..600eef3f3ac 100644
--- a/arch/mips/Kconfig
+++ b/arch/mips/Kconfig
@@ -351,7 +351,7 @@ config SGI_IP27
         select ARC64
         select BOOT_ELF64
         select DEFAULT_SGI_PARTITION
-        select DMA_IP27
+        select DMA_COHERENT
         select SYS_HAS_EARLY_PRINTK
         select HW_HAS_PCI
         select NR_CPUS_DEFAULT_64
@@ -761,9 +761,6 @@ config CFE
 config DMA_COHERENT
         bool
 
-config DMA_IP27
-        bool
-
 config DMA_NONCOHERENT
         bool
         select DMA_NEED_PCI_MAP_STATE
@@ -1368,7 +1365,7 @@ config CPU_SUPPORTS_64BIT_KERNEL
 #
 config HARDWARE_WATCHPOINTS
        bool
-       default y if CPU_MIPS32 || CPU_MIPS64
+       default y if CPU_MIPSR1 || CPU_MIPSR2
 
 menu "Kernel type"
 
diff --git a/arch/mips/alchemy/common/time.c b/arch/mips/alchemy/common/time.c
index 32880146cbc..6fd441d16af 100644
--- a/arch/mips/alchemy/common/time.c
+++ b/arch/mips/alchemy/common/time.c
@@ -89,7 +89,7 @@ static struct clock_event_device au1x_rtcmatch2_clockdev = {
         .irq            = AU1000_RTC_MATCH2_INT,
         .set_next_event = au1x_rtcmatch2_set_next_event,
         .set_mode       = au1x_rtcmatch2_set_mode,
-        .cpumask        = CPU_MASK_ALL,
+        .cpumask        = CPU_MASK_ALL_PTR,
 };
 
 static struct irqaction au1x_rtcmatch2_irqaction = {
diff --git a/arch/mips/cavium-octeon/setup.c b/arch/mips/cavium-octeon/setup.c
index e085feddb4a..5f4e49ba471 100644
--- a/arch/mips/cavium-octeon/setup.c
+++ b/arch/mips/cavium-octeon/setup.c
@@ -15,13 +15,11 @@
 #include <linux/serial.h>
 #include <linux/types.h>
 #include <linux/string.h>       /* for memset */
-#include <linux/serial.h>
 #include <linux/tty.h>
 #include <linux/time.h>
 #include <linux/platform_device.h>
 #include <linux/serial_core.h>
 #include <linux/serial_8250.h>
-#include <linux/string.h>
 
 #include <asm/processor.h>
 #include <asm/reboot.h>
diff --git a/arch/mips/configs/ip27_defconfig b/arch/mips/configs/ip27_defconfig
index 34ea319be94..f2baea3039b 100644
--- a/arch/mips/configs/ip27_defconfig
+++ b/arch/mips/configs/ip27_defconfig
@@ -53,7 +53,7 @@ CONFIG_GENERIC_TIME=y
 CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
 CONFIG_GENERIC_HARDIRQS_NO__DO_IRQ=y
 CONFIG_ARC=y
-CONFIG_DMA_IP27=y
+CONFIG_DMA_COHERENT=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_SYS_HAS_EARLY_PRINTK=y
 # CONFIG_NO_IOPORT is not set
diff --git a/arch/mips/include/asm/atomic.h b/arch/mips/include/asm/atomic.h
index c996c3b4d07..1b332e15ab5 100644
--- a/arch/mips/include/asm/atomic.h
+++ b/arch/mips/include/asm/atomic.h
@@ -50,7 +50,7 @@
 static __inline__ void atomic_add(int i, atomic_t * v)
 {
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -62,7 +62,7 @@ static __inline__ void atomic_add(int i, atomic_t * v)
                 : "=&r" (temp), "=m" (v->counter)
                 : "Ir" (i), "m" (v->counter));
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -95,7 +95,7 @@ static __inline__ void atomic_add(int i, atomic_t * v)
 static __inline__ void atomic_sub(int i, atomic_t * v)
 {
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -107,7 +107,7 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
                 : "=&r" (temp), "=m" (v->counter)
                 : "Ir" (i), "m" (v->counter));
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -135,12 +135,12 @@ static __inline__ void atomic_sub(int i, atomic_t * v)
  */
 static __inline__ int atomic_add_return(int i, atomic_t * v)
 {
-        unsigned long result;
+        int result;
 
         smp_llsc_mb();
 
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -154,7 +154,7 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
                 : "Ir" (i), "m" (v->counter)
                 : "memory");
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -187,12 +187,12 @@ static __inline__ int atomic_add_return(int i, atomic_t * v)
 
 static __inline__ int atomic_sub_return(int i, atomic_t * v)
 {
-        unsigned long result;
+        int result;
 
         smp_llsc_mb();
 
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -206,7 +206,7 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
                 : "Ir" (i), "m" (v->counter)
                 : "memory");
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -247,12 +247,12 @@ static __inline__ int atomic_sub_return(int i, atomic_t * v)
  */
 static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
 {
-        unsigned long result;
+        int result;
 
         smp_llsc_mb();
 
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -270,7 +270,7 @@ static __inline__ int atomic_sub_if_positive(int i, atomic_t * v)
                 : "Ir" (i), "m" (v->counter)
                 : "memory");
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                int temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -429,7 +429,7 @@ static __inline__ int atomic_add_unless(atomic_t *v, int a, int u)
 static __inline__ void atomic64_add(long i, atomic64_t * v)
 {
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -441,7 +441,7 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
                 : "=&r" (temp), "=m" (v->counter)
                 : "Ir" (i), "m" (v->counter));
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -474,7 +474,7 @@ static __inline__ void atomic64_add(long i, atomic64_t * v)
 static __inline__ void atomic64_sub(long i, atomic64_t * v)
 {
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -486,7 +486,7 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
                 : "=&r" (temp), "=m" (v->counter)
                 : "Ir" (i), "m" (v->counter));
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -514,12 +514,12 @@ static __inline__ void atomic64_sub(long i, atomic64_t * v)
  */
 static __inline__ long atomic64_add_return(long i, atomic64_t * v)
 {
-        unsigned long result;
+        long result;
 
         smp_llsc_mb();
 
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -533,7 +533,7 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
                 : "Ir" (i), "m" (v->counter)
                 : "memory");
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -566,12 +566,12 @@ static __inline__ long atomic64_add_return(long i, atomic64_t * v)
 
 static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
 {
-        unsigned long result;
+        long result;
 
         smp_llsc_mb();
 
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -585,7 +585,7 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
                 : "Ir" (i), "m" (v->counter)
                 : "memory");
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -626,12 +626,12 @@ static __inline__ long atomic64_sub_return(long i, atomic64_t * v)
  */
 static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
 {
-        unsigned long result;
+        long result;
 
         smp_llsc_mb();
 
         if (cpu_has_llsc && R10000_LLSC_WAR) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
@@ -649,7 +649,7 @@ static __inline__ long atomic64_sub_if_positive(long i, atomic64_t * v)
                 : "Ir" (i), "m" (v->counter)
                 : "memory");
         } else if (cpu_has_llsc) {
-                unsigned long temp;
+                long temp;
 
                 __asm__ __volatile__(
                 "       .set    mips3                                   \n"
diff --git a/arch/mips/include/asm/irq.h b/arch/mips/include/asm/irq.h
index abc62aa744a..3214ade02d1 100644
--- a/arch/mips/include/asm/irq.h
+++ b/arch/mips/include/asm/irq.h
@@ -66,7 +66,7 @@ extern void smtc_forward_irq(unsigned int irq);
  */
 #define IRQ_AFFINITY_HOOK(irq)                                          \
 do {                                                                    \
-    if (!cpu_isset(smp_processor_id(), irq_desc[irq].affinity)) {       \
+    if (!cpumask_test_cpu(smp_processor_id(), irq_desc[irq].affinity)) {\
         smtc_forward_irq(irq);                                          \
         irq_exit();                                                     \
         return;                                                         \
diff --git a/arch/mips/include/asm/mach-rc32434/gpio.h b/arch/mips/include/asm/mach-rc32434/gpio.h
index b5cf6457305..3cb50d17b62 100644
--- a/arch/mips/include/asm/mach-rc32434/gpio.h
+++ b/arch/mips/include/asm/mach-rc32434/gpio.h
@@ -80,11 +80,8 @@ struct rb532_gpio_reg {
 /* Compact Flash GPIO pin */
 #define CF_GPIO_NUM             13
 
-extern void set_434_reg(unsigned reg_offs, unsigned bit, unsigned len, unsigned val);
-extern unsigned get_434_reg(unsigned reg_offs);
-extern void set_latch_u5(unsigned char or_mask, unsigned char nand_mask);
-extern unsigned char get_latch_u5(void);
 extern void rb532_gpio_set_ilevel(int bit, unsigned gpio);
 extern void rb532_gpio_set_istat(int bit, unsigned gpio);
+extern void rb532_gpio_set_func(unsigned gpio);
 
 #endif /* _RC32434_GPIO_H_ */
diff --git a/arch/mips/include/asm/mach-rc32434/irq.h b/arch/mips/include/asm/mach-rc32434/irq.h
index 56738d8ec4e..023a5b100ed 100644
--- a/arch/mips/include/asm/mach-rc32434/irq.h
+++ b/arch/mips/include/asm/mach-rc32434/irq.h
@@ -30,4 +30,7 @@
 #define ETH0_RX_OVR_IRQ         (GROUP3_IRQ_BASE + 9)
 #define ETH0_TX_UND_IRQ         (GROUP3_IRQ_BASE + 10)
 
+#define GPIO_MAPPED_IRQ_BASE    GROUP4_IRQ_BASE
+#define GPIO_MAPPED_IRQ_GROUP   4
+
 #endif  /* __ASM_RC32434_IRQ_H */
diff --git a/arch/mips/include/asm/mach-rc32434/rb.h b/arch/mips/include/asm/mach-rc32434/rb.h
index f25a8491670..6dc5f8df1f3 100644
--- a/arch/mips/include/asm/mach-rc32434/rb.h
+++ b/arch/mips/include/asm/mach-rc32434/rb.h
@@ -83,4 +83,7 @@ struct mpmc_device {
         void __iomem    *base;
 };
 
+extern void set_latch_u5(unsigned char or_mask, unsigned char nand_mask);
+extern unsigned char get_latch_u5(void);
+
 #endif  /* __ASM_RC32434_RB_H */
diff --git a/arch/mips/include/asm/ptrace.h b/arch/mips/include/asm/ptrace.h
index 1f30d16d466..ce47118e52b 100644
--- a/arch/mips/include/asm/ptrace.h
+++ b/arch/mips/include/asm/ptrace.h
@@ -105,7 +105,7 @@ struct pt_watch_regs {
         enum pt_watch_style style;
         union {
                 struct mips32_watch_regs mips32;
-                struct mips32_watch_regs mips64;
+                struct mips64_watch_regs mips64;
         };
 };
 
diff --git a/arch/mips/include/asm/spinlock.h b/arch/mips/include/asm/spinlock.h
index 1a1f320c30d..0884947ebe2 100644
--- a/arch/mips/include/asm/spinlock.h
+++ b/arch/mips/include/asm/spinlock.h
@@ -51,6 +51,7 @@ static inline int __raw_spin_is_contended(raw_spinlock_t *lock)
 
         return (((counters >> 14) - counters) & 0x1fff) > 1;
 }
+#define __raw_spin_is_contended __raw_spin_is_contended
 
 static inline void __raw_spin_lock(raw_spinlock_t *lock)
 {
diff --git a/arch/mips/include/asm/termios.h b/arch/mips/include/asm/termios.h
index a275661fa7e..8f77f774a2a 100644
--- a/arch/mips/include/asm/termios.h
+++ b/arch/mips/include/asm/termios.h
@@ -9,6 +9,7 @@
 #ifndef _ASM_TERMIOS_H
 #define _ASM_TERMIOS_H
 
+#include <linux/errno.h>
 #include <asm/termbits.h>
 #include <asm/ioctls.h>
 
@@ -94,38 +95,81 @@ struct termio {
 /*
  * Translate a "termio" structure into a "termios". Ugh.
  */
-#define user_termio_to_kernel_termios(termios, termio) \
-({ \
-        unsigned short tmp; \
-        get_user(tmp, &(termio)->c_iflag); \
-        (termios)->c_iflag = (0xffff0000 & ((termios)->c_iflag)) | tmp; \
-        get_user(tmp, &(termio)->c_oflag); \
-        (termios)->c_oflag = (0xffff0000 & ((termios)->c_oflag)) | tmp; \
-        get_user(tmp, &(termio)->c_cflag); \
-        (termios)->c_cflag = (0xffff0000 & ((termios)->c_cflag)) | tmp; \
-        get_user(tmp, &(termio)->c_lflag); \
-        (termios)->c_lflag = (0xffff0000 & ((termios)->c_lflag)) | tmp; \
-        get_user((termios)->c_line, &(termio)->c_line); \
-        copy_from_user((termios)->c_cc, (termio)->c_cc, NCC); \
-})
+static inline int user_termio_to_kernel_termios(struct ktermios *termios,
+        struct termio __user *termio)
+{
+        unsigned short iflag, oflag, cflag, lflag;
+        unsigned int err;
+
+        if (!access_ok(VERIFY_READ, termio, sizeof(struct termio)))
+                return -EFAULT;
+
+        err = __get_user(iflag, &termio->c_iflag);
+        termios->c_iflag = (termios->c_iflag & 0xffff0000) | iflag;
+        err |=__get_user(oflag, &termio->c_oflag);
+        termios->c_oflag = (termios->c_oflag & 0xffff0000) | oflag;
+        err |=__get_user(cflag, &termio->c_cflag);
+        termios->c_cflag = (termios->c_cflag & 0xffff0000) | cflag;
+        err |=__get_user(lflag, &termio->c_lflag);
+        termios->c_lflag = (termios->c_lflag & 0xffff0000) | lflag;
+        err |=__get_user(termios->c_line, &termio->c_line);
+        if (err)
+                return -EFAULT;
+
+        if (__copy_from_user(termios->c_cc, termio->c_cc, NCC))
+                return -EFAULT;
+
+        return 0;
+}
 
 /*
  * Translate a "termios" structure into a "termio". Ugh.
  */
-#define kernel_termios_to_user_termio(termio, termios) \
-({ \
-        put_user((termios)->c_iflag, &(termio)->c_iflag); \
-        put_user((termios)->c_oflag, &(termio)->c_oflag); \
-        put_user((termios)->c_cflag, &(termio)->c_cflag); \
-        put_user((termios)->c_lflag, &(termio)->c_lflag); \
-        put_user((termios)->c_line, &(termio)->c_line); \
-        copy_to_user((termio)->c_cc, (termios)->c_cc, NCC); \
-})
-
-#define user_termios_to_kernel_termios(k, u) copy_from_user(k, u, sizeof(struct termios2))
-#define kernel_termios_to_user_termios(u, k) copy_to_user(u, k, sizeof(struct termios2))
-#define user_termios_to_kernel_termios_1(k, u) copy_from_user(k, u, sizeof(struct termios))
-#define kernel_termios_to_user_termios_1(u, k) copy_to_user(u, k, sizeof(struct termios))
+static inline int kernel_termios_to_user_termio(struct termio __user *termio,
+        struct ktermios *termios)
+{
+        int err;
+
+        if (!access_ok(VERIFY_WRITE, termio, sizeof(struct termio)))
+                return -EFAULT;
+
+        err = __put_user(termios->c_iflag, &termio->c_iflag);
+        err |= __put_user(termios->c_oflag, &termio->c_oflag);
+        err |= __put_user(termios->c_cflag, &termio->c_cflag);
+        err |= __put_user(termios->c_lflag, &termio->c_lflag);
+        err |= __put_user(termios->c_line, &termio->c_line);
+        if (err)
+                return -EFAULT;
+
+        if (__copy_to_user(termio->c_cc, termios->c_cc, NCC))
+                return -EFAULT;
+
+        return 0;
+}
+
+static inline int user_termios_to_kernel_termios(struct ktermios __user *k,
+        struct termios2 *u)
+{
+        return copy_from_user(k, u, sizeof(struct termios2)) ? -EFAULT : 0;
+}
+
+static inline int kernel_termios_to_user_termios(struct termios2 __user *u,
+        struct ktermios *k)
+{
+        return copy_to_user(u, k, sizeof(struct termios2)) ? -EFAULT : 0;
+}
+
+static inline int user_termios_to_kernel_termios_1(struct ktermios *k,
+        struct termios __user *u)
+{
+        return copy_from_user(k, u, sizeof(struct termios)) ? -EFAULT : 0;
+}
+
+static inline int kernel_termios_to_user_termios_1(struct termios __user *u,
+        struct ktermios *k)
+{
+        return copy_to_user(u, k, sizeof(struct termios)) ? -EFAULT : 0;
+}
 
 #endif /* defined(__KERNEL__) */
 
diff --git a/arch/mips/include/asm/txx9/tx4939.h b/arch/mips/include/asm/txx9/tx4939.h
index 88badb42301..964ef7ede26 100644
--- a/arch/mips/include/asm/txx9/tx4939.h
+++ b/arch/mips/include/asm/txx9/tx4939.h
@@ -541,5 +541,6 @@ void tx4939_irq_init(void);
 int tx4939_irq(void);
 void tx4939_mtd_init(int ch);
 void tx4939_ata_init(void);
+void tx4939_rtc_init(void);
 
 #endif /* __ASM_TXX9_TX4939_H */
diff --git a/arch/mips/kernel/genex.S b/arch/mips/kernel/genex.S
index fb6f73148df..8882e5766f2 100644
--- a/arch/mips/kernel/genex.S
+++ b/arch/mips/kernel/genex.S
@@ -458,7 +458,11 @@ NESTED(nmi_handler, PT_SIZE, sp)
         BUILD_HANDLER fpe fpe fpe silent                /* #15 */
         BUILD_HANDLER mdmx mdmx sti silent              /* #22 */
 #ifdef  CONFIG_HARDWARE_WATCHPOINTS
-        BUILD_HANDLER watch watch sti silent            /* #23 */
+        /*
+         * For watch, interrupts will be enabled after the watch
+         * registers are read.
+         */
+        BUILD_HANDLER watch watch cli silent            /* #23 */
 #else
         BUILD_HANDLER watch watch sti verbose           /* #23 */
 #endif
diff --git a/arch/mips/kernel/irq-gic.c b/arch/mips/kernel/irq-gic.c
index 494a49a317e..87deb8f6c45 100644
--- a/arch/mips/kernel/irq-gic.c
+++ b/arch/mips/kernel/irq-gic.c
@@ -187,7 +187,7 @@ static void gic_set_affinity(unsigned int irq, const struct cpumask *cpumask)
                 set_bit(irq, pcpu_masks[first_cpu(tmp)].pcpu_mask);
 
         }
-        irq_desc[irq].affinity = *cpumask;
+        cpumask_copy(irq_desc[irq].affinity, cpumask);
         spin_unlock_irqrestore(&gic_lock, flags);
 
 }
diff --git a/arch/mips/kernel/mips-mt-fpaff.c b/arch/mips/kernel/mips-mt-fpaff.c
index 5e77a3a21f9..42461310b18 100644
--- a/arch/mips/kernel/mips-mt-fpaff.c
+++ b/arch/mips/kernel/mips-mt-fpaff.c
@@ -79,7 +79,8 @@ asmlinkage long mipsmt_sys_sched_setaffinity(pid_t pid, unsigned int len,
 
         euid = current_euid();
         retval = -EPERM;
-        if (euid != p->euid && euid != p->uid && !capable(CAP_SYS_NICE)) {
+        if (euid != p->cred->euid && euid != p->cred->uid &&
+            !capable(CAP_SYS_NICE)) {
                 read_unlock(&tasklist_lock);
                 goto out_unlock;
         }
diff --git a/arch/mips/kernel/smtc.c b/arch/mips/kernel/smtc.c
index b6cca01ff82..5f5af7d4c89 100644
--- a/arch/mips/kernel/smtc.c
+++ b/arch/mips/kernel/smtc.c
@@ -686,7 +686,7 @@ void smtc_forward_irq(unsigned int irq)
          * and efficiency, we just pick the easiest one to find.
          */
 
-        target = first_cpu(irq_desc[irq].affinity);
+        target = cpumask_first(irq_desc[irq].affinity);
 
         /*
          * We depend on the platform code to have correctly processed
@@ -921,11 +921,13 @@ void ipi_decode(struct smtc_ipi *pipi)
         struct clock_event_device *cd;
         void *arg_copy = pipi->arg;
         int type_copy = pipi->type;
+        int irq = MIPS_CPU_IRQ_BASE + 1;
+
         smtc_ipi_nq(&freeIPIq, pipi);
         switch (type_copy) {
         case SMTC_CLOCK_TICK:
                 irq_enter();
-                kstat_this_cpu.irqs[MIPS_CPU_IRQ_BASE + 1]++;
+                kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
                 cd = &per_cpu(mips_clockevent_device, cpu);
                 cd->event_handler(cd);
                 irq_exit();
diff --git a/arch/mips/kernel/traps.c b/arch/mips/kernel/traps.c
index f6083c6bfaa..b2d7041341b 100644
--- a/arch/mips/kernel/traps.c
+++ b/arch/mips/kernel/traps.c
@@ -944,6 +944,9 @@ asmlinkage void do_mdmx(struct pt_regs *regs)
         force_sig(SIGILL, current);
 }
 
+/*
+ * Called with interrupts disabled.
+ */
 asmlinkage void do_watch(struct pt_regs *regs)
 {
         u32 cause;
@@ -963,9 +966,12 @@ asmlinkage void do_watch(struct pt_regs *regs)
          */
         if (test_tsk_thread_flag(current, TIF_LOAD_WATCH)) {
                 mips_read_watch_registers();
+                local_irq_enable();
                 force_sig(SIGTRAP, current);
-        } else
+        } else {
                 mips_clear_watch_registers();
+                local_irq_enable();
+        }
 }
 
 asmlinkage void do_mcheck(struct pt_regs *regs)
@@ -1582,7 +1588,11 @@ void __init set_handler(unsigned long offset, void *addr, unsigned long size)
 static char panic_null_cerr[] __cpuinitdata =
         "Trying to set NULL cache error exception handler";
 
-/* Install uncached CPU exception handler */
+/*
+ * Install uncached CPU exception handler.
+ * This is suitable only for the cache error exception which is the only
+ * exception handler that is being run uncached.
+ */
 void __cpuinit set_uncached_handler(unsigned long offset, void *addr,
         unsigned long size)
 {
@@ -1593,7 +1603,7 @@ void __cpuinit set_uncached_handler(unsigned long offset, void *addr,
         unsigned long uncached_ebase = TO_UNCAC(ebase);
 #endif
         if (cpu_has_mips_r2)
-                ebase += (read_c0_ebase() & 0x3ffff000);
+                uncached_ebase += (read_c0_ebase() & 0x3ffff000);
 
         if (!addr)
                 panic(panic_null_cerr);
diff --git a/arch/mips/lib/memcpy-inatomic.S b/arch/mips/lib/memcpy-inatomic.S
index 736d0fb56a9..68853a038d3 100644
--- a/arch/mips/lib/memcpy-inatomic.S
+++ b/arch/mips/lib/memcpy-inatomic.S
@@ -21,7 +21,7 @@
  * end of memory on some systems.  It's also a seriously bad idea on non
  * dma-coherent systems.
  */
-#if !defined(CONFIG_DMA_COHERENT) || !defined(CONFIG_DMA_IP27)
+#ifdef CONFIG_DMA_NONCOHERENT
 #undef CONFIG_CPU_HAS_PREFETCH
 #endif
 #ifdef CONFIG_MIPS_MALTA
diff --git a/arch/mips/lib/memcpy.S b/arch/mips/lib/memcpy.S
index c06cccf60be..56a1f85a1ce 100644
--- a/arch/mips/lib/memcpy.S
+++ b/arch/mips/lib/memcpy.S
@@ -21,7 +21,7 @@
  * end of memory on some systems.  It's also a seriously bad idea on non
  * dma-coherent systems.
  */
-#if !defined(CONFIG_DMA_COHERENT) || !defined(CONFIG_DMA_IP27)
+#ifdef CONFIG_DMA_NONCOHERENT
 #undef CONFIG_CPU_HAS_PREFETCH
 #endif
 #ifdef CONFIG_MIPS_MALTA
diff --git a/arch/mips/mm/c-r4k.c b/arch/mips/mm/c-r4k.c
index 6e99665ae86..c43f4b26a69 100644
--- a/arch/mips/mm/c-r4k.c
+++ b/arch/mips/mm/c-r4k.c
@@ -618,15 +618,35 @@ static void r4k_dma_cache_inv(unsigned long addr, unsigned long size)
         if (cpu_has_inclusive_pcaches) {
                 if (size >= scache_size)
                         r4k_blast_scache();
-                else
+                else {
+                        unsigned long lsize = cpu_scache_line_size();
+                        unsigned long almask = ~(lsize - 1);
+
+                        /*
+                         * There is no clearly documented alignment requirement
+                         * for the cache instruction on MIPS processors and
+                         * some processors, among them the RM5200 and RM7000
+                         * QED processors will throw an address error for cache
+                         * hit ops with insufficient alignment.  Solved by
+                         * aligning the address to cache line size.
+                         */
+                        cache_op(Hit_Writeback_Inv_SD, addr & almask);
+                        cache_op(Hit_Writeback_Inv_SD,
+                                 (addr + size - 1) & almask);
                         blast_inv_scache_range(addr, addr + size);
+                }
                 return;
         }
 
         if (cpu_has_safe_index_cacheops && size >= dcache_size) {
                 r4k_blast_dcache();
         } else {
+                unsigned long lsize = cpu_dcache_line_size();
+                unsigned long almask = ~(lsize - 1);
+
                 R4600_HIT_CACHEOP_WAR_IMPL;
+                cache_op(Hit_Writeback_Inv_D, addr & almask);
+                cache_op(Hit_Writeback_Inv_D, (addr + size - 1)  & almask);
                 blast_inv_dcache_range(addr, addr + size);
         }
 
diff --git a/arch/mips/mm/fault.c b/arch/mips/mm/fault.c
index fa636fc6b7b..55767ad9f00 100644
--- a/arch/mips/mm/fault.c
+++ b/arch/mips/mm/fault.c
@@ -97,7 +97,6 @@ good_area:
                         goto bad_area;
         }
 
-survive:
         /*
          * If for any reason at all we couldn't handle the fault,
          * make sure we exit gracefully rather than endlessly redo
@@ -167,21 +166,13 @@ no_context:
                field,  regs->regs[31]);
         die("Oops", regs);
 
-/*
- * We ran out of memory, or some other thing happened to us that made
- * us unable to handle the page fault gracefully.
- */
 out_of_memory:
-        up_read(&mm->mmap_sem);
-        if (is_global_init(tsk)) {
-                yield();
-                down_read(&mm->mmap_sem);
-                goto survive;
-        }
-        printk("VM: killing process %s\n", tsk->comm);
-        if (user_mode(regs))
-                do_group_exit(SIGKILL);
-        goto no_context;
+        /*
+         * We ran out of memory, call the OOM killer, and return the userspace
+         * (which will retry the fault, or kill us if we got oom-killed).
+         */
+        pagefault_out_of_memory();
+        return;
 
 do_sigbus:
         up_read(&mm->mmap_sem);
diff --git a/arch/mips/mti-malta/malta-smtc.c b/arch/mips/mti-malta/malta-smtc.c
index aabd7274507..5ba31888fef 100644
--- a/arch/mips/mti-malta/malta-smtc.c
+++ b/arch/mips/mti-malta/malta-smtc.c
@@ -116,7 +116,7 @@ struct plat_smp_ops msmtc_smp_ops = {
 
 void plat_set_irq_affinity(unsigned int irq, const struct cpumask *affinity)
 {
-        cpumask_t tmask = *affinity;
+        cpumask_t tmask;
         int cpu = 0;
         void smtc_set_irq_affinity(unsigned int irq, cpumask_t aff);
 
@@ -139,11 +139,12 @@ void plat_set_irq_affinity(unsigned int irq, const struct cpumask *affinity)
          * be made to forward to an offline "CPU".
          */
 
+        cpumask_copy(&tmask, affinity);
         for_each_cpu(cpu, affinity) {
                 if ((cpu_data[cpu].vpe_id != 0) || !cpu_online(cpu))
                         cpu_clear(cpu, tmask);
         }
-        irq_desc[irq].affinity = tmask;
+        cpumask_copy(irq_desc[irq].affinity, &tmask);
 
         if (cpus_empty(tmask))
                 /*
diff --git a/arch/mips/pci/pci-rc32434.c b/arch/mips/pci/pci-rc32434.c
index 1c2821e2f49..71f7d27b0d4 100644
--- a/arch/mips/pci/pci-rc32434.c
+++ b/arch/mips/pci/pci-rc32434.c
@@ -205,6 +205,8 @@ static int __init rc32434_pcibridge_init(void)
 
 static int __init rc32434_pci_init(void)
 {
+        void __iomem *io_map_base;
+
         pr_info("PCI: Initializing PCI\n");
 
         ioport_resource.start = rc32434_res_pci_io1.start;
@@ -212,6 +214,15 @@ static int __init rc32434_pci_init(void)
 
         rc32434_pcibridge_init();
 
+        io_map_base = ioremap(rc32434_res_pci_io1.start,
+                rc32434_res_pci_io1.end - rc32434_res_pci_io1.start + 1);
+
+        if (!io_map_base)
+                return -ENOMEM;
+
+        rc32434_controller.io_map_base =
+                (unsigned long)io_map_base - rc32434_res_pci_io1.start;
+
         register_pci_controller(&rc32434_controller);
         rc32434_sync();
 
diff --git a/arch/mips/rb532/devices.c b/arch/mips/rb532/devices.c
index c1c29181bd4..4a5f05b662a 100644
--- a/arch/mips/rb532/devices.c
+++ b/arch/mips/rb532/devices.c
@@ -24,6 +24,7 @@
 #include <linux/mtd/partitions.h>
 #include <linux/gpio_keys.h>
 #include <linux/input.h>
+#include <linux/serial_8250.h>
 
 #include <asm/bootinfo.h>
 
@@ -39,6 +40,29 @@
 #define ETH0_RX_DMA_ADDR  (DMA0_BASE_ADDR + 0 * DMA_CHAN_OFFSET)
 #define ETH0_TX_DMA_ADDR  (DMA0_BASE_ADDR + 1 * DMA_CHAN_OFFSET)
 
+extern unsigned int idt_cpu_freq;
+
+static struct mpmc_device dev3;
+
+void set_latch_u5(unsigned char or_mask, unsigned char nand_mask)
+{
+        unsigned long flags;
+
+        spin_lock_irqsave(&dev3.lock, flags);
+
+        dev3.state = (dev3.state | or_mask) & ~nand_mask;
+        writeb(dev3.state, dev3.base);
+
+        spin_unlock_irqrestore(&dev3.lock, flags);
+}
+EXPORT_SYMBOL(set_latch_u5);
+
+unsigned char get_latch_u5(void)
+{
+        return dev3.state;
+}
+EXPORT_SYMBOL(get_latch_u5);
+
 static struct resource korina_dev0_res[] = {
         {
                 .name = "korina_regs",
@@ -86,7 +110,7 @@ static struct korina_device korina_dev0_data = {
 static struct platform_device korina_dev0 = {
         .id = -1,
         .name = "korina",
-        .dev.platform_data = &korina_dev0_data,
+        .dev.driver_data = &korina_dev0_data,
         .resource = korina_dev0_res,
         .num_resources = ARRAY_SIZE(korina_dev0_res),
 };
@@ -214,12 +238,32 @@ static struct platform_device rb532_wdt = {
         .num_resources  = ARRAY_SIZE(rb532_wdt_res),
 };
 
+static struct plat_serial8250_port rb532_uart_res[] = {
+        {
+                .membase        = (char *)KSEG1ADDR(REGBASE + UART0BASE),
+                .irq            = UART0_IRQ,
+                .regshift       = 2,
+                .iotype         = UPIO_MEM,
+                .flags          = UPF_BOOT_AUTOCONF,
+        },
+        {
+                .flags          = 0,
+        }
+};
+
+static struct platform_device rb532_uart = {
+        .name              = "serial8250",
+        .id                = PLAT8250_DEV_PLATFORM,
+        .dev.platform_data = &rb532_uart_res,
+};
+
 static struct platform_device *rb532_devs[] = {
         &korina_dev0,
         &nand_slot0,
         &cf_slot0,
         &rb532_led,
         &rb532_button,
+        &rb532_uart,
         &rb532_wdt
 };
 
@@ -291,9 +335,20 @@ static int __init plat_setup_devices(void)
         nand_slot0_res[0].start = readl(IDT434_REG_BASE + DEV2BASE);
         nand_slot0_res[0].end = nand_slot0_res[0].start + 0x1000;
 
+        /* Read and map device controller 3 */
+        dev3.base = ioremap_nocache(readl(IDT434_REG_BASE + DEV3BASE), 1);
+
+        if (!dev3.base) {
+                printk(KERN_ERR "rb532: cannot remap device controller 3\n");
+                return -ENXIO;
+        }
+
         /* Initialise the NAND device */
         rb532_nand_setup();
 
+        /* set the uart clock to the current cpu frequency */
+        rb532_uart_res[0].uartclk = idt_cpu_freq;
+
         return platform_add_devices(rb532_devs, ARRAY_SIZE(rb532_devs));
 }
 
diff --git a/arch/mips/rb532/gpio.c b/arch/mips/rb532/gpio.c
index 0e84c8ab6a3..37de05d595e 100644
--- a/arch/mips/rb532/gpio.c
+++ b/arch/mips/rb532/gpio.c
@@ -41,8 +41,6 @@ struct rb532_gpio_chip {
         void __iomem     *regbase;
 };
 
-struct mpmc_device dev3;
-
 static struct resource rb532_gpio_reg0_res[] = {
         {
                 .name   = "gpio_reg0",
@@ -52,61 +50,6 @@ static struct resource rb532_gpio_reg0_res[] = {
         }
 };
 
-static struct resource rb532_dev3_ctl_res[] = {
-        {
-                .name   = "dev3_ctl",
-                .start  = REGBASE + DEV3BASE,
-                .end    = REGBASE + DEV3BASE + sizeof(struct dev_reg) - 1,
-                .flags  = IORESOURCE_MEM,
-        }
-};
-
-void set_434_reg(unsigned reg_offs, unsigned bit, unsigned len, unsigned val)
-{
-        unsigned long flags;
-        unsigned data;
-        unsigned i = 0;
-
-        spin_lock_irqsave(&dev3.lock, flags);
-
-        data = readl(IDT434_REG_BASE + reg_offs);
-        for (i = 0; i != len; ++i) {
-                if (val & (1 << i))
-                        data |= (1 << (i + bit));
-                else
-                        data &= ~(1 << (i + bit));
-        }
-        writel(data, (IDT434_REG_BASE + reg_offs));
-
-        spin_unlock_irqrestore(&dev3.lock, flags);
-}
-EXPORT_SYMBOL(set_434_reg);
-
-unsigned get_434_reg(unsigned reg_offs)
-{
-        return readl(IDT434_REG_BASE + reg_offs);
-}
-EXPORT_SYMBOL(get_434_reg);
-
-void set_latch_u5(unsigned char or_mask, unsigned char nand_mask)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&dev3.lock, flags);
-
-        dev3.state = (dev3.state | or_mask) & ~nand_mask;
-        writel(dev3.state, &dev3.base);
-
-        spin_unlock_irqrestore(&dev3.lock, flags);
-}
-EXPORT_SYMBOL(set_latch_u5);
-
-unsigned char get_latch_u5(void)
-{
-        return dev3.state;
-}
-EXPORT_SYMBOL(get_latch_u5);
-
 /* rb532_set_bit - sanely set a bit
  *
  * bitval: new value for the bit
@@ -119,13 +62,11 @@ static inline void rb532_set_bit(unsigned bitval,
         unsigned long flags;
         u32 val;
 
-        bitval = !!bitval;              /* map parameter to {0,1} */
-
         local_irq_save(flags);
 
         val = readl(ioaddr);
-        val &= ~( ~bitval << offset );   /* unset bit if bitval == 0 */
-        val |=  (  bitval << offset );   /* set bit if bitval == 1 */
+        val &= ~(!bitval << offset);   /* unset bit if bitval == 0 */
+        val |= (!!bitval << offset);   /* set bit if bitval == 1 */
         writel(val, ioaddr);
 
         local_irq_restore(flags);
@@ -171,8 +112,8 @@ static int rb532_gpio_direction_input(struct gpio_chip *chip, unsigned offset)
 
         gpch = container_of(chip, struct rb532_gpio_chip, chip);
 
-        if (rb532_get_bit(offset, gpch->regbase + GPIOFUNC))
-                return 1;       /* alternate function, GPIOCFG is ignored */
+        /* disable alternate function in case it's set */
+        rb532_set_bit(0, offset, gpch->regbase + GPIOFUNC);
 
         rb532_set_bit(0, offset, gpch->regbase + GPIOCFG);
         return 0;
@@ -188,8 +129,8 @@ static int rb532_gpio_direction_output(struct gpio_chip *chip,
 
         gpch = container_of(chip, struct rb532_gpio_chip, chip);
 
-        if (rb532_get_bit(offset, gpch->regbase + GPIOFUNC))
-                return 1;       /* alternate function, GPIOCFG is ignored */
+        /* disable alternate function in case it's set */
+        rb532_set_bit(0, offset, gpch->regbase + GPIOFUNC);
 
         /* set the initial output value */
         rb532_set_bit(value, offset, gpch->regbase + GPIOD);
@@ -233,10 +174,11 @@ EXPORT_SYMBOL(rb532_gpio_set_istat);
 /*
  * Configure GPIO alternate function
  */
-static void rb532_gpio_set_func(int bit, unsigned gpio)
+void rb532_gpio_set_func(unsigned gpio)
 {
-       rb532_set_bit(bit, gpio, rb532_gpio_chip->regbase + GPIOFUNC);
+       rb532_set_bit(1, gpio, rb532_gpio_chip->regbase + GPIOFUNC);
 }
+EXPORT_SYMBOL(rb532_gpio_set_func);
 
 int __init rb532_gpio_init(void)
 {
@@ -253,20 +195,6 @@ int __init rb532_gpio_init(void)
         /* Register our GPIO chip */
         gpiochip_add(&rb532_gpio_chip->chip);
 
-        r = rb532_dev3_ctl_res;
-        dev3.base = ioremap_nocache(r->start, r->end - r->start);
-
-        if (!dev3.base) {
-                printk(KERN_ERR "rb532: cannot remap device controller 3\n");
-                return -ENXIO;
-        }
-
-        /* configure CF_GPIO_NUM as CFRDY IRQ source */
-        rb532_gpio_set_func(0, CF_GPIO_NUM);
-        rb532_gpio_direction_input(&rb532_gpio_chip->chip, CF_GPIO_NUM);
-        rb532_gpio_set_ilevel(1, CF_GPIO_NUM);
-        rb532_gpio_set_istat(0, CF_GPIO_NUM);
-
         return 0;
 }
 arch_initcall(rb532_gpio_init);
diff --git a/arch/mips/rb532/irq.c b/arch/mips/rb532/irq.c
index 549b46d2fce..53eeb5e7bc5 100644
--- a/arch/mips/rb532/irq.c
+++ b/arch/mips/rb532/irq.c
@@ -46,6 +46,7 @@
 #include <asm/system.h>
 
 #include <asm/mach-rc32434/irq.h>
+#include <asm/mach-rc32434/gpio.h>
 
 struct intr_group {
         u32 mask;       /* mask of valid bits in pending/mask registers */
@@ -150,6 +151,9 @@ static void rb532_disable_irq(unsigned int irq_nr)
                 mask |= intr_bit;
                 WRITE_MASK(addr, mask);
 
+                if (group == GPIO_MAPPED_IRQ_GROUP)
+                        rb532_gpio_set_istat(0, irq_nr - GPIO_MAPPED_IRQ_BASE);
+
                 /*
                  * if there are no more interrupts enabled in this
                  * group, disable corresponding IP
@@ -165,12 +169,35 @@ static void rb532_mask_and_ack_irq(unsigned int irq_nr)
         ack_local_irq(group_to_ip(irq_to_group(irq_nr)));
 }
 
+static int rb532_set_type(unsigned int irq_nr, unsigned type)
+{
+        int gpio = irq_nr - GPIO_MAPPED_IRQ_BASE;
+        int group = irq_to_group(irq_nr);
+
+        if (group != GPIO_MAPPED_IRQ_GROUP)
+                return (type == IRQ_TYPE_LEVEL_HIGH) ? 0 : -EINVAL;
+
+        switch (type) {
+        case IRQ_TYPE_LEVEL_HIGH:
+                rb532_gpio_set_ilevel(1, gpio);
+                break;
+        case IRQ_TYPE_LEVEL_LOW:
+                rb532_gpio_set_ilevel(0, gpio);
+                break;
+        default:
+                return -EINVAL;
+        }
+
+        return 0;
+}
+
 static struct irq_chip rc32434_irq_type = {
         .name           = "RB532",
         .ack            = rb532_disable_irq,
         .mask           = rb532_disable_irq,
         .mask_ack       = rb532_mask_and_ack_irq,
         .unmask         = rb532_enable_irq,
+        .set_type       = rb532_set_type,
 };
 
 void __init arch_init_irq(void)
diff --git a/arch/mips/rb532/serial.c b/arch/mips/rb532/serial.c
index 3e0d7ec3a57..00ed19f0bdb 100644
--- a/arch/mips/rb532/serial.c
+++ b/arch/mips/rb532/serial.c
@@ -36,7 +36,7 @@
 extern unsigned int idt_cpu_freq;
 
 static struct uart_port rb532_uart = {
-        .type = PORT_16550A,
+        .flags = UPF_BOOT_AUTOCONF,
         .line = 0,
         .irq = UART0_IRQ,
         .iotype = UPIO_MEM,
diff --git a/arch/mips/sgi-ip22/ip22-int.c b/arch/mips/sgi-ip22/ip22-int.c
index f8b18af141a..0ecd5fe9486 100644
--- a/arch/mips/sgi-ip22/ip22-int.c
+++ b/arch/mips/sgi-ip22/ip22-int.c
@@ -155,7 +155,7 @@ static void indy_buserror_irq(void)
         int irq = SGI_BUSERR_IRQ;
 
         irq_enter();
-        kstat_this_cpu.irqs[irq]++;
+        kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
         ip22_be_interrupt(irq);
         irq_exit();
 }
diff --git a/arch/mips/sgi-ip22/ip22-time.c b/arch/mips/sgi-ip22/ip22-time.c
index 3dcb27ec0c5..c8f7d2328b2 100644
--- a/arch/mips/sgi-ip22/ip22-time.c
+++ b/arch/mips/sgi-ip22/ip22-time.c
@@ -122,7 +122,7 @@ void indy_8254timer_irq(void)
         char c;
 
         irq_enter();
-        kstat_this_cpu.irqs[irq]++;
+        kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
         printk(KERN_ALERT "Oops, got 8254 interrupt.\n");
         ArcRead(0, &c, 1, &cnt);
         ArcEnterInteractiveMode();
diff --git a/arch/mips/sibyte/bcm1480/smp.c b/arch/mips/sibyte/bcm1480/smp.c
index dddfda8e829..314691648c9 100644
--- a/arch/mips/sibyte/bcm1480/smp.c
+++ b/arch/mips/sibyte/bcm1480/smp.c
@@ -178,9 +178,10 @@ struct plat_smp_ops bcm1480_smp_ops = {
 void bcm1480_mailbox_interrupt(void)
 {
         int cpu = smp_processor_id();
+        int irq = K_BCM1480_INT_MBOX_0_0;
         unsigned int action;
 
-        kstat_this_cpu.irqs[K_BCM1480_INT_MBOX_0_0]++;
+        kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
         /* Load the mailbox register to figure out what we're supposed to do */
         action = (__raw_readq(mailbox_0_regs[cpu]) >> 48) & 0xffff;
 
diff --git a/arch/mips/sibyte/sb1250/smp.c b/arch/mips/sibyte/sb1250/smp.c
index 5950a288a7d..cad14003b84 100644
--- a/arch/mips/sibyte/sb1250/smp.c
+++ b/arch/mips/sibyte/sb1250/smp.c
@@ -166,9 +166,10 @@ struct plat_smp_ops sb_smp_ops = {
 void sb1250_mailbox_interrupt(void)
 {
         int cpu = smp_processor_id();
+        int irq = K_INT_MBOX_0;
         unsigned int action;
 
-        kstat_this_cpu.irqs[K_INT_MBOX_0]++;
+        kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
         /* Load the mailbox register to figure out what we're supposed to do */
         action = (____raw_readq(mailbox_regs[cpu]) >> 48) & 0xffff;
 
diff --git a/arch/mips/txx9/generic/setup_tx4939.c b/arch/mips/txx9/generic/setup_tx4939.c
index 6c0049a5bbc..55440967b3a 100644
--- a/arch/mips/txx9/generic/setup_tx4939.c
+++ b/arch/mips/txx9/generic/setup_tx4939.c
@@ -435,6 +435,28 @@ void __init tx4939_ata_init(void)
                 platform_device_register(&ata1_dev);
 }
 
+void __init tx4939_rtc_init(void)
+{
+        static struct resource res[] = {
+                {
+                        .start = TX4939_RTC_REG & 0xfffffffffULL,
+                        .end = (TX4939_RTC_REG & 0xfffffffffULL) + 0x100 - 1,
+                        .flags = IORESOURCE_MEM,
+                }, {
+                        .start = TXX9_IRQ_BASE + TX4939_IR_RTC,
+                        .flags = IORESOURCE_IRQ,
+                },
+        };
+        static struct platform_device rtc_dev = {
+                .name = "tx4939rtc",
+                .id = -1,
+                .num_resources = ARRAY_SIZE(res),
+                .resource = res,
+        };
+
+        platform_device_register(&rtc_dev);
+}
+
 static void __init tx4939_stop_unused_modules(void)
 {
         __u64 pcfg, rst = 0, ckd = 0;
diff --git a/arch/mips/txx9/rbtx4939/setup.c b/arch/mips/txx9/rbtx4939/setup.c
index 98fbd9391bf..656603b85b7 100644
--- a/arch/mips/txx9/rbtx4939/setup.c
+++ b/arch/mips/txx9/rbtx4939/setup.c
@@ -336,6 +336,7 @@ static void __init rbtx4939_device_init(void)
         rbtx4939_led_setup();
         tx4939_wdt_init();
         tx4939_ata_init();
+        tx4939_rtc_init();
 }
 
 static void __init rbtx4939_setup(void)
diff --git a/arch/mn10300/kernel/mn10300-watchdog.c b/arch/mn10300/kernel/mn10300-watchdog.c
index 10811e981d2..2e370d88a87 100644
--- a/arch/mn10300/kernel/mn10300-watchdog.c
+++ b/arch/mn10300/kernel/mn10300-watchdog.c
@@ -130,6 +130,7 @@ void watchdog_interrupt(struct pt_regs *regs, enum exception_code excep)
          * the stack NMI-atomically, it's safe to use smp_processor_id().
          */
         int sum, cpu = smp_processor_id();
+        int irq = NMIIRQ;
         u8 wdt, tmp;
 
         wdt = WDCTR & ~WDCTR_WDCNE;
@@ -138,7 +139,7 @@ void watchdog_interrupt(struct pt_regs *regs, enum exception_code excep)
         NMICR = NMICR_WDIF;
 
         nmi_count(cpu)++;
-        kstat_this_cpu.irqs[NMIIRQ]++;
+        kstat_incr_irqs_this_cpu(irq, irq_to_desc(irq));
         sum = irq_stat[cpu].__irq_count;
 
         if (last_irq_sums[cpu] == sum) {
diff --git a/arch/parisc/kernel/irq.c b/arch/parisc/kernel/irq.c
index ac2c822928c..49482806863 100644
--- a/arch/parisc/kernel/irq.c
+++ b/arch/parisc/kernel/irq.c
@@ -120,7 +120,7 @@ int cpu_check_affinity(unsigned int irq, cpumask_t *dest)
         if (CHECK_IRQ_PER_CPU(irq)) {
                 /* Bad linux design decision.  The mask has already
                  * been set; we must reset it */
-                irq_desc[irq].affinity = CPU_MASK_ALL;
+                cpumask_setall(irq_desc[irq].affinity);
                 return -EINVAL;
         }
 
@@ -136,7 +136,7 @@ static void cpu_set_affinity_irq(unsigned int irq, const struct cpumask *dest)
         if (cpu_check_affinity(irq, dest))
                 return;
 
-        irq_desc[irq].affinity = *dest;
+        cpumask_copy(irq_desc[irq].affinity, dest);
 }
 #endif
 
@@ -295,7 +295,7 @@ int txn_alloc_irq(unsigned int bits_wide)
 unsigned long txn_affinity_addr(unsigned int irq, int cpu)
 {
 #ifdef CONFIG_SMP
-        irq_desc[irq].affinity = cpumask_of_cpu(cpu);
+        cpumask_copy(irq_desc[irq].affinity, cpumask_of(cpu));
 #endif
 
         return per_cpu(cpu_data, cpu).txn_addr;
@@ -352,7 +352,7 @@ void do_cpu_irq_mask(struct pt_regs *regs)
         irq = eirr_to_irq(eirr_val);
 
 #ifdef CONFIG_SMP
-        dest = irq_desc[irq].affinity;
+        cpumask_copy(&dest, irq_desc[irq].affinity);
         if (CHECK_IRQ_PER_CPU(irq_desc[irq].status) &&
             !cpu_isset(smp_processor_id(), dest)) {
                 int cpu = first_cpu(dest);
diff --git a/arch/powerpc/boot/dts/mpc8313erdb.dts b/arch/powerpc/boot/dts/mpc8313erdb.dts
index 909a89cab9a..3ebf7ec0484 100644
--- a/arch/powerpc/boot/dts/mpc8313erdb.dts
+++ b/arch/powerpc/boot/dts/mpc8313erdb.dts
@@ -191,7 +191,8 @@
                         interrupts = <37 0x8 36 0x8 35 0x8>;
                         interrupt-parent = <&ipic>;
                         tbi-handle = < &tbi0 >;
-                        phy-handle = < &phy1 >;
+                        /* Vitesse 7385 isn't on the MDIO bus */
+                        fixed-link = <1 1 1000 0 0>;
                         fsl,magic-packet;
 
                         mdio@24520 {
@@ -199,12 +200,6 @@
                                 #size-cells = <0>;
                                 compatible = "fsl,gianfar-mdio";
                                 reg = <0x24520 0x20>;
-                                phy1: ethernet-phy@1 {
-                                        interrupt-parent = <&ipic>;
-                                        interrupts = <19 0x8>;
-                                        reg = <0x1>;
-                                        device_type = "ethernet-phy";
-                                };
                                 phy4: ethernet-phy@4 {
                                         interrupt-parent = <&ipic>;
                                         interrupts = <20 0x8>;
@@ -219,6 +214,8 @@
                 };
 
                 enet1: ethernet@25000 {
+                        #address-cells = <1>;
+                        #size-cells = <1>;
                         cell-index = <1>;
                         device_type = "network";
                         model = "eTSEC";
diff --git a/arch/powerpc/configs/52xx/cm5200_defconfig b/arch/powerpc/configs/52xx/cm5200_defconfig
index 99c495ad9c7..1239c6132b4 100644
--- a/arch/powerpc/configs/52xx/cm5200_defconfig
+++ b/arch/powerpc/configs/52xx/cm5200_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc4
-# Thu Nov 13 02:12:40 2008
+# Linux kernel version: 2.6.29-rc2
+# Mon Jan 26 21:41:58 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -43,7 +43,7 @@ CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_GENERIC_NVRAM=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_OF=y
@@ -71,14 +71,23 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -110,7 +119,6 @@ CONFIG_SLUB_DEBUG=y
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
 CONFIG_HAVE_IOREMAP_PROT=y
@@ -121,13 +129,11 @@ CONFIG_HAVE_CLK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_MODULES is not set
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -143,7 +149,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
 # CONFIG_FREEZER is not set
 
 #
@@ -182,9 +187,8 @@ CONFIG_PPC_MPC5200_SIMPLE=y
 # CONFIG_TAU is not set
 # CONFIG_FSL_ULI1575 is not set
 CONFIG_PPC_BESTCOMM=y
-# CONFIG_PPC_BESTCOMM_ATA is not set
 CONFIG_PPC_BESTCOMM_FEC=y
-# CONFIG_PPC_BESTCOMM_GEN_BD is not set
+# CONFIG_SIMPLE_GPIO is not set
 
 #
 # Kernel options
@@ -211,6 +215,7 @@ CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
 # CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -222,12 +227,14 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-# CONFIG_RESOURCES_64BIT is not set
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_UNEVICTABLE_LRU=y
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_64K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -268,6 +275,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -324,6 +332,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -336,6 +345,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
 # CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -427,6 +437,12 @@ CONFIG_MTD_PHYSMAP_OF=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -514,6 +530,9 @@ CONFIG_LXT_PHY=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -539,6 +558,10 @@ CONFIG_FEC_MPC52xx_MDIO=y
 # CONFIG_IWLWIFI_LEDS is not set
 
 #
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+
+#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -588,8 +611,10 @@ CONFIG_SERIAL_MPC52xx=y
 CONFIG_SERIAL_MPC52xx_CONSOLE=y
 CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=57600
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
@@ -629,8 +654,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -675,10 +698,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -736,6 +761,7 @@ CONFIG_USB_DEVICEFS=y
 # USB Host Controller Drivers
 #
 # CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=y
@@ -760,18 +786,17 @@ CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
 # CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
-# CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
@@ -817,6 +842,10 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_ISIGHTFW is not set
 # CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
@@ -826,7 +855,6 @@ CONFIG_USB_STORAGE=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -847,6 +875,7 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -883,10 +912,7 @@ CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -906,6 +932,7 @@ CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 CONFIG_CRAMFS=y
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1002,6 +1029,7 @@ CONFIG_NLS_ISO8859_1=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_T10DIF is not set
@@ -1053,6 +1081,7 @@ CONFIG_SCHED_DEBUG=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -1061,6 +1090,8 @@ CONFIG_SCHED_DEBUG=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 
 #
 # Tracers
@@ -1069,11 +1100,13 @@ CONFIG_HAVE_FUNCTION_TRACER=y
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
 # CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
+CONFIG_PRINT_STACK_DEPTH=64
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
@@ -1100,11 +1133,15 @@ CONFIG_CRYPTO=y
 #
 # CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/arch/powerpc/configs/52xx/lite5200b_defconfig b/arch/powerpc/configs/52xx/lite5200b_defconfig
index 9796220032f..b7b88056290 100644
--- a/arch/powerpc/configs/52xx/lite5200b_defconfig
+++ b/arch/powerpc/configs/52xx/lite5200b_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc4
-# Thu Nov 13 02:10:16 2008
+# Linux kernel version: 2.6.29-rc2
+# Mon Jan 26 21:41:14 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -43,7 +43,7 @@ CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_GENERIC_NVRAM=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_OF=y
@@ -72,14 +72,23 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 # CONFIG_FAIR_GROUP_SCHED is not set
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -112,7 +121,6 @@ CONFIG_SLUB_DEBUG=y
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
 CONFIG_HAVE_IOREMAP_PROT=y
@@ -123,7 +131,6 @@ CONFIG_HAVE_CLK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -131,11 +138,9 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -151,7 +156,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
 CONFIG_FREEZER=y
 
 #
@@ -192,7 +196,7 @@ CONFIG_PPC_LITE5200=y
 CONFIG_PPC_BESTCOMM=y
 CONFIG_PPC_BESTCOMM_ATA=y
 CONFIG_PPC_BESTCOMM_FEC=y
-CONFIG_PPC_BESTCOMM_GEN_BD=y
+# CONFIG_SIMPLE_GPIO is not set
 
 #
 # Kernel options
@@ -220,6 +224,7 @@ CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
 # CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -231,12 +236,14 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-# CONFIG_RESOURCES_64BIT is not set
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_UNEVICTABLE_LRU=y
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_64K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -264,6 +271,7 @@ CONFIG_ARCH_SUPPORTS_MSI=y
 # CONFIG_PCI_MSI is not set
 CONFIG_PCI_LEGACY=y
 # CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_STUB is not set
 # CONFIG_PCCARD is not set
 # CONFIG_HOTPLUG_PCI is not set
 # CONFIG_HAS_RAPIDIO is not set
@@ -286,6 +294,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -342,6 +351,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -354,6 +364,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
 # CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -396,13 +407,19 @@ CONFIG_BLK_DEV_RAM_SIZE=32768
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -445,6 +462,7 @@ CONFIG_SCSI_WAIT_SCAN=m
 # CONFIG_SCSI_SRP_ATTRS is not set
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
+# CONFIG_SCSI_CXGB3_ISCSI is not set
 # CONFIG_BLK_DEV_3W_XXXX_RAID is not set
 # CONFIG_SCSI_3W_9XXX is not set
 # CONFIG_SCSI_ACARD is not set
@@ -461,6 +479,8 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_LIBFC is not set
+# CONFIG_FCOE is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_EATA is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
@@ -580,6 +600,9 @@ CONFIG_LXT_PHY=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -626,6 +649,7 @@ CONFIG_NETDEV_1000=y
 # CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
+CONFIG_CHELSIO_T3_DEPENDS=y
 # CONFIG_CHELSIO_T3 is not set
 # CONFIG_ENIC is not set
 # CONFIG_IXGBE is not set
@@ -648,6 +672,10 @@ CONFIG_NETDEV_10000=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_FDDI is not set
 # CONFIG_HIPPI is not set
@@ -695,8 +723,10 @@ CONFIG_SERIAL_MPC52xx_CONSOLE=y
 CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=115200
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
@@ -762,8 +792,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -796,10 +824,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -846,9 +876,13 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 #
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
 # CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
@@ -860,7 +894,6 @@ CONFIG_USB_ARCH_HAS_EHCI=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -881,6 +914,7 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -914,10 +948,7 @@ CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -926,6 +957,7 @@ CONFIG_TMPFS=y
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -967,6 +999,7 @@ CONFIG_MSDOS_PARTITION=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_T10DIF is not set
@@ -1016,6 +1049,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -1024,6 +1058,8 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 
 #
 # Tracers
@@ -1032,11 +1068,13 @@ CONFIG_HAVE_FUNCTION_TRACER=y
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
 # CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
+CONFIG_PRINT_STACK_DEPTH=64
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
@@ -1063,11 +1101,15 @@ CONFIG_CRYPTO=y
 #
 # CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/arch/powerpc/configs/52xx/motionpro_defconfig b/arch/powerpc/configs/52xx/motionpro_defconfig
index d081e003105..fb10f22fd0d 100644
--- a/arch/powerpc/configs/52xx/motionpro_defconfig
+++ b/arch/powerpc/configs/52xx/motionpro_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc4
-# Thu Nov 13 02:11:02 2008
+# Linux kernel version: 2.6.29-rc2
+# Mon Jan 26 21:42:29 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -43,7 +43,7 @@ CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_GENERIC_NVRAM=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_OF=y
@@ -71,14 +71,23 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -110,7 +119,6 @@ CONFIG_SLUB_DEBUG=y
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
 CONFIG_HAVE_IOREMAP_PROT=y
@@ -121,13 +129,11 @@ CONFIG_HAVE_CLK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 # CONFIG_MODULES is not set
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -143,7 +149,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
 # CONFIG_FREEZER is not set
 
 #
@@ -182,9 +187,9 @@ CONFIG_PPC_MPC5200_SIMPLE=y
 # CONFIG_TAU is not set
 # CONFIG_FSL_ULI1575 is not set
 CONFIG_PPC_BESTCOMM=y
-# CONFIG_PPC_BESTCOMM_ATA is not set
+CONFIG_PPC_BESTCOMM_ATA=y
 CONFIG_PPC_BESTCOMM_FEC=y
-# CONFIG_PPC_BESTCOMM_GEN_BD is not set
+# CONFIG_SIMPLE_GPIO is not set
 
 #
 # Kernel options
@@ -211,6 +216,7 @@ CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
 # CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -222,12 +228,14 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-# CONFIG_RESOURCES_64BIT is not set
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_UNEVICTABLE_LRU=y
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_64K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -268,6 +276,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -324,6 +333,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -336,6 +346,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
 # CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -427,6 +438,12 @@ CONFIG_MTD_ROM=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -447,10 +464,16 @@ CONFIG_BLK_DEV_RAM_SIZE=32768
 # CONFIG_ATA_OVER_ETH is not set
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+CONFIG_EEPROM_LEGACY=y
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -492,6 +515,7 @@ CONFIG_CHR_DEV_SG=y
 # CONFIG_SCSI_SRP_ATTRS is not set
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
+# CONFIG_LIBFC is not set
 # CONFIG_SCSI_DEBUG is not set
 # CONFIG_SCSI_DH is not set
 CONFIG_ATA=y
@@ -525,6 +549,9 @@ CONFIG_SMSC_PHY=y
 CONFIG_BROADCOM_PHY=y
 CONFIG_ICPLUS_PHY=y
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 CONFIG_MDIO_BITBANG=y
 CONFIG_NET_ETHERNET=y
@@ -548,6 +575,10 @@ CONFIG_FEC_MPC52xx_MDIO=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
@@ -590,8 +621,10 @@ CONFIG_SERIAL_MPC52xx=y
 CONFIG_SERIAL_MPC52xx_CONSOLE=y
 CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=115200
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
@@ -629,8 +662,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-CONFIG_EEPROM_LEGACY=y
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -659,6 +690,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ADT7462 is not set
 # CONFIG_SENSORS_ADT7470 is not set
 # CONFIG_SENSORS_ADT7473 is not set
+# CONFIG_SENSORS_ADT7475 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
 # CONFIG_SENSORS_F71805F is not set
@@ -678,6 +710,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LM90 is not set
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LTC4245 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_MAX6650 is not set
 # CONFIG_SENSORS_PC87360 is not set
@@ -721,10 +754,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -835,7 +870,6 @@ CONFIG_RTC_DRV_DS1307=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -856,6 +890,7 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -892,10 +927,7 @@ CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -915,6 +947,7 @@ CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 CONFIG_CRAMFS=y
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1011,6 +1044,7 @@ CONFIG_NLS_ISO8859_1=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_T10DIF is not set
@@ -1062,6 +1096,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -1070,6 +1105,8 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 
 #
 # Tracers
@@ -1078,11 +1115,13 @@ CONFIG_HAVE_FUNCTION_TRACER=y
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
 # CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
+CONFIG_PRINT_STACK_DEPTH=64
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
@@ -1109,11 +1148,15 @@ CONFIG_CRYPTO=y
 #
 # CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/arch/powerpc/configs/52xx/pcm030_defconfig b/arch/powerpc/configs/52xx/pcm030_defconfig
index b21b8e8c3a7..00944c09a0a 100644
--- a/arch/powerpc/configs/52xx/pcm030_defconfig
+++ b/arch/powerpc/configs/52xx/pcm030_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc4
-# Thu Nov 13 02:13:16 2008
+# Linux kernel version: 2.6.29-rc2
+# Mon Jan 26 21:41:33 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -43,7 +43,7 @@ CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_GENERIC_NVRAM=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_OF=y
@@ -72,15 +72,24 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -112,7 +121,6 @@ CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 # CONFIG_KPROBES is not set
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
@@ -124,7 +132,6 @@ CONFIG_HAVE_CLK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -132,11 +139,9 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -152,7 +157,6 @@ CONFIG_IOSCHED_NOOP=y
 # CONFIG_DEFAULT_CFQ is not set
 CONFIG_DEFAULT_NOOP=y
 CONFIG_DEFAULT_IOSCHED="noop"
-CONFIG_CLASSIC_RCU=y
 # CONFIG_FREEZER is not set
 
 #
@@ -191,9 +195,9 @@ CONFIG_PPC_MPC5200_SIMPLE=y
 # CONFIG_TAU is not set
 # CONFIG_FSL_ULI1575 is not set
 CONFIG_PPC_BESTCOMM=y
-CONFIG_PPC_BESTCOMM_ATA=y
+CONFIG_PPC_BESTCOMM_ATA=m
 CONFIG_PPC_BESTCOMM_FEC=y
-CONFIG_PPC_BESTCOMM_GEN_BD=y
+# CONFIG_SIMPLE_GPIO is not set
 
 #
 # Kernel options
@@ -212,7 +216,6 @@ CONFIG_SCHED_HRTICK=y
 # CONFIG_PREEMPT_NONE is not set
 # CONFIG_PREEMPT_VOLUNTARY is not set
 CONFIG_PREEMPT=y
-# CONFIG_PREEMPT_RCU is not set
 CONFIG_BINFMT_ELF=y
 # CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS is not set
 # CONFIG_HAVE_AOUT is not set
@@ -222,6 +225,7 @@ CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
 # CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -233,12 +237,14 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-# CONFIG_RESOURCES_64BIT is not set
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_UNEVICTABLE_LRU=y
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_64K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -261,6 +267,7 @@ CONFIG_PCI_SYSCALL=y
 CONFIG_ARCH_SUPPORTS_MSI=y
 # CONFIG_PCI_MSI is not set
 CONFIG_PCI_LEGACY=y
+# CONFIG_PCI_STUB is not set
 # CONFIG_PCCARD is not set
 # CONFIG_HOTPLUG_PCI is not set
 # CONFIG_HAS_RAPIDIO is not set
@@ -283,6 +290,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -333,6 +341,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -345,6 +354,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
 # CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -365,6 +375,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 # CONFIG_MTD_CONCAT is not set
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_OF_PARTS is not set
@@ -413,9 +424,7 @@ CONFIG_MTD_CFI_UTIL=y
 #
 # CONFIG_MTD_COMPLEX_MAPPINGS is not set
 CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PHYSMAP_START=0x0
-CONFIG_MTD_PHYSMAP_LEN=0x0
-CONFIG_MTD_PHYSMAP_BANKWIDTH=1
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
 # CONFIG_MTD_PHYSMAP_OF is not set
 # CONFIG_MTD_INTEL_VR_NOR is not set
 # CONFIG_MTD_PLATRAM is not set
@@ -439,6 +448,12 @@ CONFIG_MTD_PHYSMAP_BANKWIDTH=1
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -587,6 +602,9 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -621,6 +639,10 @@ CONFIG_FEC_MPC52xx_MDIO=y
 # CONFIG_IWLWIFI_LEDS is not set
 
 #
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+
+#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -675,7 +697,9 @@ CONFIG_SERIAL_MPC52xx_CONSOLE=y
 CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=9600
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 # CONFIG_LEGACY_PTYS is not set
+# CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 CONFIG_HW_RANDOM=y
 # CONFIG_NVRAM is not set
@@ -740,8 +764,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-CONFIG_EEPROM_LEGACY=m
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -774,10 +796,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -837,6 +861,7 @@ CONFIG_USB_DEVICEFS=y
 #
 # CONFIG_USB_C67X00_HCD is not set
 # CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=m
@@ -864,18 +889,17 @@ CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
 # CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=m
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
-# CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
@@ -921,6 +945,10 @@ CONFIG_USB_STORAGE=m
 # CONFIG_USB_ISIGHTFW is not set
 # CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
 # CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
@@ -983,7 +1011,6 @@ CONFIG_RTC_DRV_PCF8563=m
 # CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -1004,6 +1031,7 @@ CONFIG_FS_MBCACHE=m
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
 # CONFIG_QUOTA is not set
@@ -1039,10 +1067,7 @@ CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -1062,6 +1087,7 @@ CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1141,6 +1167,7 @@ CONFIG_NLS_ISO8859_1=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_T10DIF is not set
@@ -1173,6 +1200,8 @@ CONFIG_FRAME_WARN=1024
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 
 #
 # Tracers
@@ -1180,6 +1209,7 @@ CONFIG_HAVE_FUNCTION_TRACER=y
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
+CONFIG_PRINT_STACK_DEPTH=64
 # CONFIG_IRQSTACKS is not set
 # CONFIG_BOOTX_TEXT is not set
 # CONFIG_PPC_EARLY_DEBUG is not set
diff --git a/arch/powerpc/configs/52xx/tqm5200_defconfig b/arch/powerpc/configs/52xx/tqm5200_defconfig
index 79954579f5e..65237ad6f07 100644
--- a/arch/powerpc/configs/52xx/tqm5200_defconfig
+++ b/arch/powerpc/configs/52xx/tqm5200_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc4
-# Thu Nov 13 02:09:30 2008
+# Linux kernel version: 2.6.29-rc2
+# Mon Jan 26 21:42:58 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -43,7 +43,7 @@ CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_GENERIC_NVRAM=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_OF=y
@@ -71,14 +71,23 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -110,7 +119,6 @@ CONFIG_SLUB_DEBUG=y
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
 CONFIG_HAVE_IOREMAP_PROT=y
@@ -121,7 +129,6 @@ CONFIG_HAVE_CLK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -129,11 +136,9 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -149,7 +154,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
 # CONFIG_FREEZER is not set
 
 #
@@ -188,9 +192,9 @@ CONFIG_PPC_MPC5200_BUGFIX=y
 # CONFIG_TAU is not set
 # CONFIG_FSL_ULI1575 is not set
 CONFIG_PPC_BESTCOMM=y
-# CONFIG_PPC_BESTCOMM_ATA is not set
+CONFIG_PPC_BESTCOMM_ATA=y
 CONFIG_PPC_BESTCOMM_FEC=y
-# CONFIG_PPC_BESTCOMM_GEN_BD is not set
+# CONFIG_SIMPLE_GPIO is not set
 
 #
 # Kernel options
@@ -217,6 +221,7 @@ CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
 # CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -228,12 +233,14 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-# CONFIG_RESOURCES_64BIT is not set
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_UNEVICTABLE_LRU=y
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_64K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -274,6 +281,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -330,6 +338,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -342,6 +351,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
 # CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -364,6 +374,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_OF_PARTS is not set
@@ -433,6 +444,12 @@ CONFIG_MTD_PHYSMAP_OF=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -496,6 +513,7 @@ CONFIG_SCSI_WAIT_SCAN=m
 # CONFIG_SCSI_SRP_ATTRS is not set
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
+# CONFIG_LIBFC is not set
 # CONFIG_SCSI_DEBUG is not set
 # CONFIG_SCSI_DH is not set
 CONFIG_ATA=y
@@ -530,6 +548,9 @@ CONFIG_LXT_PHY=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -555,6 +576,10 @@ CONFIG_FEC_MPC52xx_MDIO=y
 # CONFIG_IWLWIFI_LEDS is not set
 
 #
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+
+#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -604,8 +629,10 @@ CONFIG_SERIAL_MPC52xx=y
 CONFIG_SERIAL_MPC52xx_CONSOLE=y
 CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=115200
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
+# CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
@@ -645,8 +672,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -675,6 +700,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ADT7462 is not set
 # CONFIG_SENSORS_ADT7470 is not set
 # CONFIG_SENSORS_ADT7473 is not set
+# CONFIG_SENSORS_ADT7475 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
 # CONFIG_SENSORS_F71805F is not set
@@ -694,6 +720,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LM90 is not set
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LTC4245 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_MAX6650 is not set
 # CONFIG_SENSORS_PC87360 is not set
@@ -742,10 +769,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -803,6 +832,7 @@ CONFIG_USB_MON=y
 # USB Host Controller Drivers
 #
 # CONFIG_USB_C67X00_HCD is not set
+# CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=y
@@ -827,18 +857,17 @@ CONFIG_USB_OHCI_BIG_ENDIAN_MMIO=y
 # CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
-# CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
@@ -884,6 +913,10 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_ISIGHTFW is not set
 # CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
@@ -947,7 +980,6 @@ CONFIG_RTC_DRV_DS1307=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -968,6 +1000,7 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -1004,10 +1037,7 @@ CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -1027,6 +1057,7 @@ CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 CONFIG_CRAMFS=y
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1123,6 +1154,7 @@ CONFIG_NLS_ISO8859_1=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_T10DIF is not set
@@ -1174,6 +1206,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -1182,6 +1215,8 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 
 #
 # Tracers
@@ -1190,11 +1225,13 @@ CONFIG_HAVE_FUNCTION_TRACER=y
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
 # CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
+CONFIG_PRINT_STACK_DEPTH=64
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
@@ -1221,11 +1258,15 @@ CONFIG_CRYPTO=y
 #
 # CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig b/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
index 9e47ae957e2..409d017621a 100644
--- a/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
+++ b/arch/powerpc/configs/83xx/mpc8313_rdb_defconfig
@@ -651,7 +651,7 @@ CONFIG_CICADA_PHY=y
 # CONFIG_NATIONAL_PHY is not set
 # CONFIG_STE10XP is not set
 # CONFIG_LSI_ET1011C_PHY is not set
-# CONFIG_FIXED_PHY is not set
+CONFIG_FIXED_PHY=y
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
 CONFIG_MII=y
diff --git a/arch/powerpc/configs/mpc5200_defconfig b/arch/powerpc/configs/mpc5200_defconfig
index 5ff3de205d6..81afc8b373d 100644
--- a/arch/powerpc/configs/mpc5200_defconfig
+++ b/arch/powerpc/configs/mpc5200_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc4
-# Thu Nov 13 02:09:07 2008
+# Linux kernel version: 2.6.29-rc2
+# Mon Jan 26 21:40:44 2009
 #
 # CONFIG_PPC64 is not set
 
@@ -43,7 +43,7 @@ CONFIG_GENERIC_FIND_NEXT_BIT=y
 CONFIG_PPC=y
 CONFIG_EARLY_PRINTK=y
 CONFIG_GENERIC_NVRAM=y
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_PPC_OF=y
 CONFIG_OF=y
@@ -72,10 +72,19 @@ CONFIG_SYSVIPC_SYSCTL=y
 # CONFIG_BSD_PROCESS_ACCT is not set
 # CONFIG_TASKSTATS is not set
 # CONFIG_AUDIT is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -108,7 +117,6 @@ CONFIG_SLUB_DEBUG=y
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_HAVE_EFFICIENT_UNALIGNED_ACCESS=y
 CONFIG_HAVE_IOREMAP_PROT=y
@@ -119,7 +127,6 @@ CONFIG_HAVE_CLK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -127,11 +134,9 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 # CONFIG_BLK_DEV_IO_TRACE is not set
-# CONFIG_LSF is not set
 # CONFIG_BLK_DEV_BSG is not set
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -147,7 +152,6 @@ CONFIG_DEFAULT_AS=y
 # CONFIG_DEFAULT_CFQ is not set
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="anticipatory"
-CONFIG_CLASSIC_RCU=y
 CONFIG_FREEZER=y
 
 #
@@ -192,7 +196,7 @@ CONFIG_RTAS_PROC=y
 CONFIG_PPC_BESTCOMM=y
 CONFIG_PPC_BESTCOMM_ATA=y
 CONFIG_PPC_BESTCOMM_FEC=y
-CONFIG_PPC_BESTCOMM_GEN_BD=y
+# CONFIG_SIMPLE_GPIO is not set
 
 #
 # Kernel options
@@ -220,6 +224,7 @@ CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_ARCH_HAS_WALK_MEMORY=y
 CONFIG_ARCH_ENABLE_MEMORY_HOTREMOVE=y
 # CONFIG_KEXEC is not set
+# CONFIG_CRASH_DUMP is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_SELECT_MEMORY_MODEL=y
@@ -231,12 +236,14 @@ CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-# CONFIG_RESOURCES_64BIT is not set
 # CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
 CONFIG_UNEVICTABLE_LRU=y
+CONFIG_PPC_4K_PAGES=y
+# CONFIG_PPC_16K_PAGES is not set
+# CONFIG_PPC_64K_PAGES is not set
 CONFIG_FORCE_MAX_ZONEORDER=11
 CONFIG_PROC_DEVICETREE=y
 # CONFIG_CMDLINE_BOOL is not set
@@ -264,6 +271,7 @@ CONFIG_ARCH_SUPPORTS_MSI=y
 # CONFIG_PCI_MSI is not set
 CONFIG_PCI_LEGACY=y
 # CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_STUB is not set
 # CONFIG_PCCARD is not set
 # CONFIG_HOTPLUG_PCI is not set
 # CONFIG_HAS_RAPIDIO is not set
@@ -286,6 +294,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -342,6 +351,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_ECONET is not set
 # CONFIG_WAN_ROUTER is not set
 # CONFIG_NET_SCHED is not set
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -354,6 +364,7 @@ CONFIG_DEFAULT_TCP_CONG="cubic"
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
 # CONFIG_WIRELESS is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -376,6 +387,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_OF_PARTS is not set
@@ -447,6 +459,12 @@ CONFIG_MTD_PHYSMAP_OF=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -474,13 +492,19 @@ CONFIG_BLK_DEV_RAM_SIZE=32768
 # CONFIG_BLK_DEV_HD is not set
 CONFIG_MISC_DEVICES=y
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
 # CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -539,6 +563,8 @@ CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_MEGARAID_SAS is not set
 # CONFIG_SCSI_HPTIOP is not set
 # CONFIG_SCSI_BUSLOGIC is not set
+# CONFIG_LIBFC is not set
+# CONFIG_FCOE is not set
 # CONFIG_SCSI_DMX3191D is not set
 # CONFIG_SCSI_EATA is not set
 # CONFIG_SCSI_FUTURE_DOMAIN is not set
@@ -659,6 +685,9 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -693,6 +722,10 @@ CONFIG_FEC_MPC52xx_MDIO=y
 # CONFIG_IWLWIFI_LEDS is not set
 
 #
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+
+#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -774,9 +807,11 @@ CONFIG_SERIAL_MPC52xx_CONSOLE=y
 CONFIG_SERIAL_MPC52xx_CONSOLE_BAUD=115200
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 # CONFIG_HVC_RTAS is not set
+# CONFIG_HVC_UDBG is not set
 # CONFIG_IPMI_HANDLER is not set
 # CONFIG_HW_RANDOM is not set
 # CONFIG_NVRAM is not set
@@ -844,8 +879,6 @@ CONFIG_I2C_MPC=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -874,6 +907,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_ADT7462 is not set
 # CONFIG_SENSORS_ADT7470 is not set
 # CONFIG_SENSORS_ADT7473 is not set
+# CONFIG_SENSORS_ADT7475 is not set
 # CONFIG_SENSORS_ATXP1 is not set
 # CONFIG_SENSORS_DS1621 is not set
 # CONFIG_SENSORS_I5K_AMB is not set
@@ -894,6 +928,7 @@ CONFIG_HWMON=y
 # CONFIG_SENSORS_LM90 is not set
 # CONFIG_SENSORS_LM92 is not set
 # CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LTC4245 is not set
 # CONFIG_SENSORS_MAX1619 is not set
 # CONFIG_SENSORS_MAX6650 is not set
 # CONFIG_SENSORS_PC87360 is not set
@@ -953,10 +988,12 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -1051,7 +1088,7 @@ CONFIG_LCD_CLASS_DEVICE=m
 # CONFIG_LCD_ILI9320 is not set
 # CONFIG_LCD_PLATFORM is not set
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
-# CONFIG_BACKLIGHT_CORGI is not set
+CONFIG_BACKLIGHT_GENERIC=y
 
 #
 # Display device support
@@ -1093,21 +1130,22 @@ CONFIG_HID_COMPAT=y
 CONFIG_HID_A4TECH=y
 # CONFIG_HID_APPLE is not set
 CONFIG_HID_BELKIN=y
-CONFIG_HID_BRIGHT=y
 CONFIG_HID_CHERRY=y
 # CONFIG_HID_CHICONY is not set
 CONFIG_HID_CYPRESS=y
-CONFIG_HID_DELL=y
 CONFIG_HID_EZKEY=y
 # CONFIG_HID_GYRATION is not set
 # CONFIG_HID_LOGITECH is not set
 # CONFIG_HID_MICROSOFT is not set
 # CONFIG_HID_MONTEREY is not set
+# CONFIG_HID_NTRIG is not set
 # CONFIG_HID_PANTHERLORD is not set
 # CONFIG_HID_PETALYNX is not set
 # CONFIG_HID_SAMSUNG is not set
 # CONFIG_HID_SONY is not set
 # CONFIG_HID_SUNPLUS is not set
+# CONFIG_GREENASIA_FF is not set
+# CONFIG_HID_TOPSEED is not set
 # CONFIG_THRUSTMASTER_FF is not set
 # CONFIG_ZEROPLUS_FF is not set
 CONFIG_USB_SUPPORT=y
@@ -1137,6 +1175,7 @@ CONFIG_USB_MON=y
 #
 # CONFIG_USB_C67X00_HCD is not set
 # CONFIG_USB_EHCI_HCD is not set
+# CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=y
@@ -1164,18 +1203,17 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 # CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
-# CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
@@ -1222,6 +1260,10 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_ISIGHTFW is not set
 # CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
 # CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
@@ -1243,7 +1285,6 @@ CONFIG_NEW_LEDS=y
 # CONFIG_DMADEVICES is not set
 # CONFIG_UIO is not set
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -1264,6 +1305,7 @@ CONFIG_FS_MBCACHE=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -1300,10 +1342,7 @@ CONFIG_TMPFS=y
 # CONFIG_TMPFS_POSIX_ACL is not set
 # CONFIG_HUGETLB_PAGE is not set
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -1323,6 +1362,7 @@ CONFIG_JFFS2_ZLIB=y
 CONFIG_JFFS2_RTIME=y
 # CONFIG_JFFS2_RUBIN is not set
 CONFIG_CRAMFS=y
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1403,6 +1443,7 @@ CONFIG_NLS_ISO8859_1=y
 # Library routines
 #
 CONFIG_BITREVERSE=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 # CONFIG_CRC_T10DIF is not set
@@ -1454,6 +1495,7 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_DEBUG_MEMORY_INIT is not set
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -1462,6 +1504,8 @@ CONFIG_DEBUG_INFO=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_DYNAMIC_FTRACE=y
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
 
 #
 # Tracers
@@ -1470,11 +1514,13 @@ CONFIG_HAVE_FUNCTION_TRACER=y
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
 # CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
+CONFIG_PRINT_STACK_DEPTH=64
 # CONFIG_DEBUG_STACKOVERFLOW is not set
 # CONFIG_DEBUG_STACK_USAGE is not set
 # CONFIG_DEBUG_PAGEALLOC is not set
@@ -1501,11 +1547,15 @@ CONFIG_CRYPTO=y
 #
 # CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
diff --git a/arch/powerpc/kernel/ftrace.c b/arch/powerpc/kernel/ftrace.c
index 5355244c99f..60c60ccf5e3 100644
--- a/arch/powerpc/kernel/ftrace.c
+++ b/arch/powerpc/kernel/ftrace.c
@@ -195,8 +195,9 @@ __ftrace_make_nop(struct module *mod,
                 return -EINVAL;
         }
 
-        offset = (unsigned)((unsigned short)jmp[0]) << 16 |
-                (unsigned)((unsigned short)jmp[1]);
+        /* The bottom half is signed extended */
+        offset = ((unsigned)((unsigned short)jmp[0]) << 16) +
+                (int)((short)jmp[1]);
 
         DEBUGP(" %x ", offset);
 
diff --git a/arch/powerpc/kernel/irq.c b/arch/powerpc/kernel/irq.c
index 23b8b5e36f9..ad1e5ac721d 100644
--- a/arch/powerpc/kernel/irq.c
+++ b/arch/powerpc/kernel/irq.c
@@ -231,7 +231,7 @@ void fixup_irqs(cpumask_t map)
                 if (irq_desc[irq].status & IRQ_PER_CPU)
                         continue;
 
-                cpus_and(mask, irq_desc[irq].affinity, map);
+                cpumask_and(&mask, irq_desc[irq].affinity, &map);
                 if (any_online_cpu(mask) == NR_CPUS) {
                         printk("Breaking affinity for irq %i\n", irq);
                         mask = map;
diff --git a/arch/powerpc/kernel/pci-common.c b/arch/powerpc/kernel/pci-common.c
index da5a3855a0c..0f418127231 100644
--- a/arch/powerpc/kernel/pci-common.c
+++ b/arch/powerpc/kernel/pci-common.c
@@ -16,8 +16,6 @@
  * 2 of the License, or (at your option) any later version.
  */
 
-#define DEBUG
-
 #include <linux/kernel.h>
 #include <linux/pci.h>
 #include <linux/string.h>
@@ -258,7 +256,8 @@ int pci_read_irq_line(struct pci_dev *pci_dev)
         } else {
                 pr_debug(" Got one, spec %d cells (0x%08x 0x%08x...) on %s\n",
                          oirq.size, oirq.specifier[0], oirq.specifier[1],
-                    oirq.controller->full_name);
+                         oirq.controller ? oirq.controller->full_name :
+                         "<default>");
 
                 virq = irq_create_of_mapping(oirq.controller, oirq.specifier,
                                              oirq.size);
@@ -562,8 +561,21 @@ int pci_mmap_legacy_page_range(struct pci_bus *bus,
                  (unsigned long long)(offset + size - 1));
 
         if (mmap_state == pci_mmap_mem) {
-                if ((offset + size) > hose->isa_mem_size)
-                        return -ENXIO;
+                /* Hack alert !
+                 *
+                 * Because X is lame and can fail starting if it gets an error trying
+                 * to mmap legacy_mem (instead of just moving on without legacy memory
+                 * access) we fake it here by giving it anonymous memory, effectively
+                 * behaving just like /dev/zero
+                 */
+                if ((offset + size) > hose->isa_mem_size) {
+                        printk(KERN_DEBUG
+                               "Process %s (pid:%d) mapped non-existing PCI legacy memory for 0%04x:%02x\n",
+                               current->comm, current->pid, pci_domain_nr(bus), bus->number);
+                        if (vma->vm_flags & VM_SHARED)
+                                return shmem_zero_setup(vma);
+                        return 0;
+                }
                 offset += hose->isa_mem_phys;
         } else {
                 unsigned long io_offset = (unsigned long)hose->io_base_virt - _IO_BASE;
diff --git a/arch/powerpc/kernel/vmlinux.lds.S b/arch/powerpc/kernel/vmlinux.lds.S
index 161b9b9691f..295ccc5e86b 100644
--- a/arch/powerpc/kernel/vmlinux.lds.S
+++ b/arch/powerpc/kernel/vmlinux.lds.S
@@ -184,6 +184,7 @@ SECTIONS
         . = ALIGN(PAGE_SIZE);
         .data.percpu  : AT(ADDR(.data.percpu) - LOAD_OFFSET) {
                 __per_cpu_start = .;
+                *(.data.percpu.page_aligned)
                 *(.data.percpu)
                 *(.data.percpu.shared_aligned)
                 __per_cpu_end = .;
diff --git a/arch/powerpc/lib/sstep.c b/arch/powerpc/lib/sstep.c
index 4aae0c38764..13b7d54f185 100644
--- a/arch/powerpc/lib/sstep.c
+++ b/arch/powerpc/lib/sstep.c
@@ -172,6 +172,8 @@ int __kprobes emulate_step(struct pt_regs *regs, unsigned int instr)
                         }
                         break;
                 case 0x378:     /* orx */
+                        if (instr & 1)
+                                break;
                         rs = (instr >> 21) & 0x1f;
                         rb = (instr >> 11) & 0x1f;
                         if (rs == rb) {         /* mr */
diff --git a/arch/powerpc/mm/fsl_booke_mmu.c b/arch/powerpc/mm/fsl_booke_mmu.c
index 1971e4ee3d6..ea6e41e39d9 100644
--- a/arch/powerpc/mm/fsl_booke_mmu.c
+++ b/arch/powerpc/mm/fsl_booke_mmu.c
@@ -73,7 +73,7 @@ extern unsigned int tlbcam_index;
 /*
  * Return PA for this VA if it is mapped by a CAM, or 0
  */
-unsigned long v_mapped_by_tlbcam(unsigned long va)
+phys_addr_t v_mapped_by_tlbcam(unsigned long va)
 {
         int b;
         for (b = 0; b < tlbcam_index; ++b)
@@ -85,7 +85,7 @@ unsigned long v_mapped_by_tlbcam(unsigned long va)
 /*
  * Return VA for a given PA or 0 if not mapped
  */
-unsigned long p_mapped_by_tlbcam(unsigned long pa)
+unsigned long p_mapped_by_tlbcam(phys_addr_t pa)
 {
         int b;
         for (b = 0; b < tlbcam_index; ++b)
diff --git a/arch/powerpc/mm/hash_low_32.S b/arch/powerpc/mm/hash_low_32.S
index 67850ec9feb..14af8cedab7 100644
--- a/arch/powerpc/mm/hash_low_32.S
+++ b/arch/powerpc/mm/hash_low_32.S
@@ -320,7 +320,7 @@ _GLOBAL(create_hpte)
         and     r8,r8,r0                /* writable if _RW & _DIRTY */
         rlwimi  r5,r5,32-1,30,30        /* _PAGE_USER -> PP msb */
         rlwimi  r5,r5,32-2,31,31        /* _PAGE_USER -> PP lsb */
-        ori     r8,r8,0xe14             /* clear out reserved bits and M */
+        ori     r8,r8,0xe04             /* clear out reserved bits */
         andc    r8,r5,r8                /* PP = user? (rw&dirty? 2: 3): 0 */
 BEGIN_FTR_SECTION
         rlwinm  r8,r8,0,~_PAGE_COHERENT /* clear M (coherence not required) */
diff --git a/arch/powerpc/mm/pgtable_32.c b/arch/powerpc/mm/pgtable_32.c
index 22972cd83cc..58bcaeba728 100644
--- a/arch/powerpc/mm/pgtable_32.c
+++ b/arch/powerpc/mm/pgtable_32.c
@@ -61,8 +61,8 @@ void setbat(int index, unsigned long virt, phys_addr_t phys,
 
 #ifdef HAVE_TLBCAM
 extern unsigned int tlbcam_index;
-extern unsigned long v_mapped_by_tlbcam(unsigned long va);
-extern unsigned long p_mapped_by_tlbcam(unsigned long pa);
+extern phys_addr_t v_mapped_by_tlbcam(unsigned long va);
+extern unsigned long p_mapped_by_tlbcam(phys_addr_t pa);
 #else /* !HAVE_TLBCAM */
 #define v_mapped_by_tlbcam(x)   (0UL)
 #define p_mapped_by_tlbcam(x)   (0UL)
diff --git a/arch/powerpc/oprofile/cell/spu_profiler.c b/arch/powerpc/oprofile/cell/spu_profiler.c
index 9305ddaac51..b129d007e7f 100644
--- a/arch/powerpc/oprofile/cell/spu_profiler.c
+++ b/arch/powerpc/oprofile/cell/spu_profiler.c
@@ -16,6 +16,7 @@
 #include <linux/smp.h>
 #include <linux/slab.h>
 #include <asm/cell-pmu.h>
+#include <asm/time.h>
 #include "pr_util.h"
 
 #define SCALE_SHIFT 14
diff --git a/arch/powerpc/platforms/52xx/mpc52xx_pci.c b/arch/powerpc/platforms/52xx/mpc52xx_pci.c
index c3f2c21024e..87ff522f28b 100644
--- a/arch/powerpc/platforms/52xx/mpc52xx_pci.c
+++ b/arch/powerpc/platforms/52xx/mpc52xx_pci.c
@@ -20,14 +20,6 @@
 
 
 /* ======================================================================== */
-/* PCI windows config                                                       */
-/* ======================================================================== */
-
-#define MPC52xx_PCI_TARGET_IO   0xf0000000
-#define MPC52xx_PCI_TARGET_MEM  0x00000000
-
-
-/* ======================================================================== */
 /* Structures mapping & Defines for PCI Unit                                */
 /* ======================================================================== */
 
@@ -244,7 +236,7 @@ static struct pci_ops mpc52xx_pci_ops = {
 
 static void __init
 mpc52xx_pci_setup(struct pci_controller *hose,
-                  struct mpc52xx_pci __iomem *pci_regs)
+                  struct mpc52xx_pci __iomem *pci_regs, phys_addr_t pci_phys)
 {
         struct resource *res;
         u32 tmp;
@@ -314,10 +306,14 @@ mpc52xx_pci_setup(struct pci_controller *hose,
         /* Set all the IWCR fields at once; they're in the same reg */
         out_be32(&pci_regs->iwcr, MPC52xx_PCI_IWCR_PACK(iwcr0, iwcr1, iwcr2));
 
-        out_be32(&pci_regs->tbatr0,
-                MPC52xx_PCI_TBATR_ENABLE | MPC52xx_PCI_TARGET_IO );
-        out_be32(&pci_regs->tbatr1,
-                MPC52xx_PCI_TBATR_ENABLE | MPC52xx_PCI_TARGET_MEM );
+        /* Map IMMR onto PCI bus */
+        pci_phys &= 0xfffc0000; /* bar0 has only 14 significant bits */
+        out_be32(&pci_regs->tbatr0, MPC52xx_PCI_TBATR_ENABLE | pci_phys);
+        out_be32(&pci_regs->bar0, PCI_BASE_ADDRESS_MEM_PREFETCH | pci_phys);
+
+        /* Map memory onto PCI bus */
+        out_be32(&pci_regs->tbatr1, MPC52xx_PCI_TBATR_ENABLE);
+        out_be32(&pci_regs->bar1, PCI_BASE_ADDRESS_MEM_PREFETCH);
 
         out_be32(&pci_regs->tcr, MPC52xx_PCI_TCR_LD | MPC52xx_PCI_TCR_WCT8);
 
@@ -414,7 +410,7 @@ mpc52xx_add_bridge(struct device_node *node)
 
         /* Finish setting up PCI using values obtained by
          * pci_proces_bridge_OF_ranges */
-        mpc52xx_pci_setup(hose, pci_regs);
+        mpc52xx_pci_setup(hose, pci_regs, rsrc.start);
 
         return 0;
 }
diff --git a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
index 9876d7e072f..ddf0bdc0fc8 100644
--- a/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
+++ b/arch/powerpc/platforms/82xx/pq2ads-pci-pic.c
@@ -186,7 +186,7 @@ out_unmap_regs:
         iounmap(priv->regs);
 out_free_bootmem:
         free_bootmem((unsigned long)priv,
-                     sizeof(sizeof(struct pq2ads_pci_pic)));
+                     sizeof(struct pq2ads_pci_pic));
         of_node_put(np);
 out_unmap_irq:
         irq_dispose_mapping(irq);
diff --git a/arch/powerpc/platforms/pseries/hotplug-memory.c b/arch/powerpc/platforms/pseries/hotplug-memory.c
index a623ad256e9..9b21ee68ea5 100644
--- a/arch/powerpc/platforms/pseries/hotplug-memory.c
+++ b/arch/powerpc/platforms/pseries/hotplug-memory.c
@@ -14,6 +14,7 @@
 #include <asm/firmware.h>
 #include <asm/machdep.h>
 #include <asm/pSeries_reconfig.h>
+#include <asm/sparsemem.h>
 
 static int pseries_remove_lmb(unsigned long base, unsigned int lmb_size)
 {
diff --git a/arch/powerpc/platforms/pseries/xics.c b/arch/powerpc/platforms/pseries/xics.c
index 84e058f1e1c..80b513449f4 100644
--- a/arch/powerpc/platforms/pseries/xics.c
+++ b/arch/powerpc/platforms/pseries/xics.c
@@ -153,9 +153,10 @@ static int get_irq_server(unsigned int virq, unsigned int strict_check)
 {
         int server;
         /* For the moment only implement delivery to all cpus or one cpu */
-        cpumask_t cpumask = irq_desc[virq].affinity;
+        cpumask_t cpumask;
         cpumask_t tmp = CPU_MASK_NONE;
 
+        cpumask_copy(&cpumask, irq_desc[virq].affinity);
         if (!distribute_irqs)
                 return default_server;
 
@@ -869,7 +870,7 @@ void xics_migrate_irqs_away(void)
                        virq, cpu);
 
                 /* Reset affinity to all cpus */
-                irq_desc[virq].affinity = CPU_MASK_ALL;
+                cpumask_setall(irq_desc[virq].affinity);
                 desc->chip->set_affinity(virq, cpu_all_mask);
 unlock:
                 spin_unlock_irqrestore(&desc->lock, flags);
diff --git a/arch/powerpc/sysdev/cpm2_pic.c b/arch/powerpc/sysdev/cpm2_pic.c
index b16ca3ed65d..78f1f7cca0a 100644
--- a/arch/powerpc/sysdev/cpm2_pic.c
+++ b/arch/powerpc/sysdev/cpm2_pic.c
@@ -165,7 +165,7 @@ static int cpm2_set_irq_type(unsigned int virq, unsigned int flow_type)
                         edibit = (14 - (src - CPM2_IRQ_EXT1));
         else
                 if (src >= CPM2_IRQ_PORTC15 && src <= CPM2_IRQ_PORTC0)
-                        edibit = (31 - (src - CPM2_IRQ_PORTC15));
+                        edibit = (31 - (CPM2_IRQ_PORTC0 - src));
                 else
                         return (flow_type & IRQ_TYPE_LEVEL_LOW) ? 0 : -EINVAL;
 
diff --git a/arch/powerpc/sysdev/ipic.c b/arch/powerpc/sysdev/ipic.c
index 88a983ece5c..9a89cd3e80a 100644
--- a/arch/powerpc/sysdev/ipic.c
+++ b/arch/powerpc/sysdev/ipic.c
@@ -890,7 +890,7 @@ unsigned int ipic_get_irq(void)
         return irq_linear_revmap(primary_ipic->irqhost, irq);
 }
 
-#ifdef CONFIG_PM
+#ifdef CONFIG_SUSPEND
 static struct {
         u32 sicfr;
         u32 siprr[2];
diff --git a/arch/powerpc/sysdev/mpic.c b/arch/powerpc/sysdev/mpic.c
index a35297dbac2..532e205303a 100644
--- a/arch/powerpc/sysdev/mpic.c
+++ b/arch/powerpc/sysdev/mpic.c
@@ -566,9 +566,10 @@ static void __init mpic_scan_ht_pics(struct mpic *mpic)
 #ifdef CONFIG_SMP
 static int irq_choose_cpu(unsigned int virt_irq)
 {
-        cpumask_t mask = irq_desc[virt_irq].affinity;
+        cpumask_t mask;
         int cpuid;
 
+        cpumask_copy(&mask, irq_desc[virt_irq].affinity);
         if (cpus_equal(mask, CPU_MASK_ALL)) {
                 static int irq_rover;
                 static DEFINE_SPINLOCK(irq_rover_lock);
diff --git a/arch/s390/defconfig b/arch/s390/defconfig
index a0e748da990..31e809c7779 100644
--- a/arch/s390/defconfig
+++ b/arch/s390/defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28-rc6
-# Thu Nov 27 11:00:49 2008
+# Linux kernel version: 2.6.29-rc4
+# Wed Feb 11 10:07:16 2009
 #
 CONFIG_SCHED_MC=y
 CONFIG_MMU=y
@@ -14,12 +14,14 @@ CONFIG_RWSEM_XCHGADD_ALGORITHM=y
 # CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_GENERIC_HWEIGHT=y
 CONFIG_GENERIC_TIME=y
+CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_GENERIC_CLOCKEVENTS=y
 CONFIG_GENERIC_BUG=y
 CONFIG_NO_IOMEM=y
 CONFIG_NO_DMA=y
 CONFIG_GENERIC_LOCKBREAK=y
 CONFIG_PGSTE=y
+CONFIG_VIRT_CPU_ACCOUNTING=y
 CONFIG_S390=y
 CONFIG_DEFCONFIG_LIST="/lib/modules/$UNAME_RELEASE/.config"
 
@@ -39,20 +41,29 @@ CONFIG_POSIX_MQUEUE=y
 # CONFIG_TASKSTATS is not set
 CONFIG_AUDIT=y
 # CONFIG_AUDITSYSCALL is not set
+
+#
+# RCU Subsystem
+#
+CONFIG_CLASSIC_RCU=y
+# CONFIG_TREE_RCU is not set
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=17
+CONFIG_GROUP_SCHED=y
+CONFIG_FAIR_GROUP_SCHED=y
+# CONFIG_RT_GROUP_SCHED is not set
+CONFIG_USER_SCHED=y
+# CONFIG_CGROUP_SCHED is not set
 CONFIG_CGROUPS=y
 # CONFIG_CGROUP_DEBUG is not set
 CONFIG_CGROUP_NS=y
 # CONFIG_CGROUP_FREEZER is not set
 # CONFIG_CGROUP_DEVICE is not set
 # CONFIG_CPUSETS is not set
-CONFIG_GROUP_SCHED=y
-CONFIG_FAIR_GROUP_SCHED=y
-# CONFIG_RT_GROUP_SCHED is not set
-CONFIG_USER_SCHED=y
-# CONFIG_CGROUP_SCHED is not set
 # CONFIG_CGROUP_CPUACCT is not set
 # CONFIG_RESOURCE_COUNTERS is not set
 CONFIG_SYSFS_DEPRECATED=y
@@ -63,6 +74,7 @@ CONFIG_UTS_NS=y
 CONFIG_IPC_NS=y
 # CONFIG_USER_NS is not set
 # CONFIG_PID_NS is not set
+# CONFIG_NET_NS is not set
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 # CONFIG_CC_OPTIMIZE_FOR_SIZE is not set
@@ -91,17 +103,17 @@ CONFIG_SLAB=y
 # CONFIG_SLUB is not set
 # CONFIG_SLOB is not set
 # CONFIG_PROFILING is not set
-# CONFIG_MARKERS is not set
 CONFIG_HAVE_OPROFILE=y
 CONFIG_KPROBES=y
+CONFIG_HAVE_SYSCALL_WRAPPERS=y
 CONFIG_KRETPROBES=y
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
 CONFIG_HAVE_ARCH_TRACEHOOK=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -109,7 +121,7 @@ CONFIG_MODULE_UNLOAD=y
 # CONFIG_MODULE_FORCE_UNLOAD is not set
 CONFIG_MODVERSIONS=y
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
+CONFIG_INIT_ALL_POSSIBLE=y
 CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
 # CONFIG_BLK_DEV_IO_TRACE is not set
@@ -130,7 +142,6 @@ CONFIG_DEFAULT_DEADLINE=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="deadline"
 CONFIG_PREEMPT_NOTIFIERS=y
-CONFIG_CLASSIC_RCU=y
 # CONFIG_FREEZER is not set
 
 #
@@ -161,6 +172,7 @@ CONFIG_S390_EXEC_PROTECT=y
 CONFIG_MARCH_Z900=y
 # CONFIG_MARCH_Z990 is not set
 # CONFIG_MARCH_Z9_109 is not set
+# CONFIG_MARCH_Z10 is not set
 CONFIG_PACK_STACK=y
 # CONFIG_SMALL_STACK is not set
 CONFIG_CHECK_STACK=y
@@ -174,7 +186,6 @@ CONFIG_ARCH_POPULATES_NODE_MAP=y
 # CONFIG_PREEMPT_NONE is not set
 # CONFIG_PREEMPT_VOLUNTARY is not set
 CONFIG_PREEMPT=y
-# CONFIG_PREEMPT_RCU is not set
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_DEFAULT=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -195,7 +206,6 @@ CONFIG_MEMORY_HOTREMOVE=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-CONFIG_RESOURCES_64BIT=y
 CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
@@ -207,7 +217,6 @@ CONFIG_UNEVICTABLE_LRU=y
 #
 CONFIG_MACHCHK_WARNING=y
 CONFIG_QDIO=y
-# CONFIG_QDIO_DEBUG is not set
 CONFIG_CHSC_SCH=m
 
 #
@@ -227,15 +236,13 @@ CONFIG_PFAULT=y
 # CONFIG_SHARED_KERNEL is not set
 # CONFIG_CMM is not set
 # CONFIG_PAGE_STATES is not set
-CONFIG_VIRT_TIMER=y
-CONFIG_VIRT_CPU_ACCOUNTING=y
 # CONFIG_APPLDATA_BASE is not set
 CONFIG_HZ_100=y
 # CONFIG_HZ_250 is not set
 # CONFIG_HZ_300 is not set
 # CONFIG_HZ_1000 is not set
 CONFIG_HZ=100
-# CONFIG_SCHED_HRTICK is not set
+CONFIG_SCHED_HRTICK=y
 CONFIG_S390_HYPFS_FS=y
 CONFIG_KEXEC=y
 # CONFIG_ZFCPDUMP is not set
@@ -245,6 +252,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 # CONFIG_PACKET_MMAP is not set
 CONFIG_UNIX=y
@@ -383,6 +391,7 @@ CONFIG_NET_SCH_TBF=m
 CONFIG_NET_SCH_GRED=m
 CONFIG_NET_SCH_DSMARK=m
 # CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_DRR is not set
 # CONFIG_NET_SCH_INGRESS is not set
 
 #
@@ -400,6 +409,7 @@ CONFIG_CLS_U32_MARK=y
 CONFIG_NET_CLS_RSVP=m
 CONFIG_NET_CLS_RSVP6=m
 CONFIG_NET_CLS_FLOW=m
+# CONFIG_NET_CLS_CGROUP is not set
 # CONFIG_NET_EMATCH is not set
 CONFIG_NET_CLS_ACT=y
 CONFIG_NET_ACT_POLICE=y
@@ -411,6 +421,7 @@ CONFIG_NET_ACT_NAT=m
 # CONFIG_NET_ACT_SKBEDIT is not set
 # CONFIG_NET_CLS_IND is not set
 CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -428,6 +439,7 @@ CONFIG_CAN_VCAN=m
 # CONFIG_CAN_DEBUG_DEVICES is not set
 # CONFIG_AF_RXRPC is not set
 # CONFIG_PHONET is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 # CONFIG_PCMCIA is not set
@@ -475,11 +487,15 @@ CONFIG_DASD_DIAG=y
 CONFIG_DASD_EER=y
 CONFIG_VIRTIO_BLK=m
 CONFIG_MISC_DEVICES=y
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_C2PORT is not set
 
 #
+# EEPROM support
+#
+# CONFIG_EEPROM_93CX6 is not set
+
+#
 # SCSI device support
 #
 # CONFIG_RAID_ATTRS is not set
@@ -520,6 +536,7 @@ CONFIG_SCSI_FC_ATTRS=y
 # CONFIG_SCSI_SRP_ATTRS is not set
 CONFIG_SCSI_LOWLEVEL=y
 # CONFIG_ISCSI_TCP is not set
+# CONFIG_LIBFC is not set
 # CONFIG_SCSI_DEBUG is not set
 CONFIG_ZFCP=y
 CONFIG_SCSI_DH=m
@@ -566,6 +583,10 @@ CONFIG_NET_ETHERNET=y
 CONFIG_NETDEV_1000=y
 CONFIG_NETDEV_10000=y
 # CONFIG_TR is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 
 #
@@ -593,9 +614,11 @@ CONFIG_VIRTIO_NET=m
 #
 CONFIG_DEVKMEM=y
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 CONFIG_LEGACY_PTYS=y
 CONFIG_LEGACY_PTY_COUNT=256
 CONFIG_HVC_DRIVER=y
+CONFIG_HVC_IUCV=y
 CONFIG_VIRTIO_CONSOLE=y
 CONFIG_HW_RANDOM=m
 CONFIG_HW_RANDOM_VIRTIO=m
@@ -645,7 +668,6 @@ CONFIG_S390_VMUR=m
 # CONFIG_NEW_LEDS is not set
 CONFIG_ACCESSIBILITY=y
 # CONFIG_STAGING is not set
-CONFIG_STAGING_EXCLUDE_BUILD=y
 
 #
 # File systems
@@ -668,6 +690,7 @@ CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -703,10 +726,7 @@ CONFIG_TMPFS_POSIX_ACL=y
 # CONFIG_HUGETLBFS is not set
 # CONFIG_HUGETLB_PAGE is not set
 CONFIG_CONFIGFS_FS=m
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_HFS_FS is not set
@@ -715,6 +735,7 @@ CONFIG_CONFIGFS_FS=m
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -808,6 +829,7 @@ CONFIG_DEBUG_BUGVERBOSE=y
 CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
 # CONFIG_FRAME_POINTER is not set
 # CONFIG_RCU_TORTURE_TEST is not set
 # CONFIG_RCU_CPU_STALL_DETECTOR is not set
@@ -818,15 +840,19 @@ CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
+CONFIG_HAVE_FUNCTION_TRACER=y
 
 #
 # Tracers
 #
+# CONFIG_FUNCTION_TRACER is not set
 # CONFIG_IRQSOFF_TRACER is not set
 # CONFIG_PREEMPT_TRACER is not set
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
 # CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
+# CONFIG_STACK_TRACER is not set
 # CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 CONFIG_SAMPLES=y
 # CONFIG_SAMPLE_KOBJECT is not set
@@ -847,11 +873,17 @@ CONFIG_CRYPTO=y
 #
 CONFIG_CRYPTO_FIPS=y
 CONFIG_CRYPTO_ALGAPI=y
-CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_ALGAPI2=y
+CONFIG_CRYPTO_AEAD=m
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
-CONFIG_CRYPTO_HASH=y
-CONFIG_CRYPTO_RNG=y
+CONFIG_CRYPTO_BLKCIPHER2=y
+CONFIG_CRYPTO_HASH=m
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG=m
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 CONFIG_CRYPTO_GF128MUL=m
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
@@ -885,7 +917,7 @@ CONFIG_CRYPTO_HMAC=m
 #
 # Digest
 #
-# CONFIG_CRYPTO_CRC32C is not set
+CONFIG_CRYPTO_CRC32C=m
 # CONFIG_CRYPTO_MD4 is not set
 CONFIG_CRYPTO_MD5=m
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
@@ -942,6 +974,7 @@ CONFIG_S390_PRNG=m
 # Library routines
 #
 CONFIG_BITREVERSE=m
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 CONFIG_CRC_T10DIF=y
diff --git a/arch/s390/include/asm/lowcore.h b/arch/s390/include/asm/lowcore.h
index ffdef5fe858..f3720defdd1 100644
--- a/arch/s390/include/asm/lowcore.h
+++ b/arch/s390/include/asm/lowcore.h
@@ -384,8 +384,8 @@ struct _lowcore
         __u32        panic_magic;              /* 0xe00 */
 
         /* Per cpu primary space access list */
-        __u8         pad_0xe04[0xe3c-0xe04];   /* 0xe04 */
-        __u32        vdso_per_cpu_data;        /* 0xe3c */
+        __u8         pad_0xe04[0xe38-0xe04];   /* 0xe04 */
+        __u64        vdso_per_cpu_data;        /* 0xe38 */
         __u32        paste[16];                /* 0xe40 */
 
         __u8         pad13[0x11b8-0xe80];      /* 0xe80 */
diff --git a/arch/s390/kernel/irq.c b/arch/s390/kernel/irq.c
index e7c5bfb7c75..026a37a94fc 100644
--- a/arch/s390/kernel/irq.c
+++ b/arch/s390/kernel/irq.c
@@ -95,6 +95,7 @@ asmlinkage void do_softirq(void)
         local_irq_restore(flags);
 }
 
+#ifdef CONFIG_PROC_FS
 void init_irq_proc(void)
 {
         struct proc_dir_entry *root_irq_dir;
@@ -102,3 +103,4 @@ void init_irq_proc(void)
         root_irq_dir = proc_mkdir("irq", NULL);
         create_prof_cpu_mask(root_irq_dir);
 }
+#endif
diff --git a/arch/sh/boards/board-ap325rxa.c b/arch/sh/boards/board-ap325rxa.c
index caf4c33f4e8..7c35787d29b 100644
--- a/arch/sh/boards/board-ap325rxa.c
+++ b/arch/sh/boards/board-ap325rxa.c
@@ -22,6 +22,7 @@
 #include <linux/gpio.h>
 #include <linux/spi/spi.h>
 #include <linux/spi/spi_gpio.h>
+#include <media/ov772x.h>
 #include <media/soc_camera_platform.h>
 #include <media/sh_mobile_ceu.h>
 #include <video/sh_mobile_lcdc.h>
@@ -216,7 +217,14 @@ static struct platform_device lcdc_device = {
         },
 };
 
+static void camera_power(int val)
+{
+        gpio_set_value(GPIO_PTZ5, val); /* RST_CAM/RSTB */
+        mdelay(10);
+}
+
 #ifdef CONFIG_I2C
+/* support for the old ncm03j camera */
 static unsigned char camera_ncm03j_magic[] =
 {
         0x87, 0x00, 0x88, 0x08, 0x89, 0x01, 0x8A, 0xE8,
@@ -237,6 +245,23 @@ static unsigned char camera_ncm03j_magic[] =
         0x63, 0xD4, 0x64, 0xEA, 0xD6, 0x0F,
 };
 
+static int camera_probe(void)
+{
+        struct i2c_adapter *a = i2c_get_adapter(0);
+        struct i2c_msg msg;
+        int ret;
+
+        camera_power(1);
+        msg.addr = 0x6e;
+        msg.buf = camera_ncm03j_magic;
+        msg.len = 2;
+        msg.flags = 0;
+        ret = i2c_transfer(a, &msg, 1);
+        camera_power(0);
+
+        return ret;
+}
+
 static int camera_set_capture(struct soc_camera_platform_info *info,
                               int enable)
 {
@@ -245,9 +270,11 @@ static int camera_set_capture(struct soc_camera_platform_info *info,
         int ret = 0;
         int i;
 
+        camera_power(0);
         if (!enable)
                 return 0; /* no disable for now */
 
+        camera_power(1);
         for (i = 0; i < ARRAY_SIZE(camera_ncm03j_magic); i += 2) {
                 u_int8_t buf[8];
 
@@ -286,8 +313,35 @@ static struct platform_device camera_device = {
                 .platform_data  = &camera_info,
         },
 };
+
+static int __init camera_setup(void)
+{
+        if (camera_probe() > 0)
+                platform_device_register(&camera_device);
+
+        return 0;
+}
+late_initcall(camera_setup);
+
 #endif /* CONFIG_I2C */
 
+static int ov7725_power(struct device *dev, int mode)
+{
+        camera_power(0);
+        if (mode)
+                camera_power(1);
+
+        return 0;
+}
+
+static struct ov772x_camera_info ov7725_info = {
+        .buswidth  = SOCAM_DATAWIDTH_8,
+        .flags = OV772X_FLAG_VFLIP | OV772X_FLAG_HFLIP,
+        .link = {
+                .power  = ov7725_power,
+        },
+};
+
 static struct sh_mobile_ceu_info sh_mobile_ceu_info = {
         .flags = SOCAM_PCLK_SAMPLE_RISING | SOCAM_HSYNC_ACTIVE_HIGH |
         SOCAM_VSYNC_ACTIVE_HIGH | SOCAM_MASTER | SOCAM_DATAWIDTH_8,
@@ -338,9 +392,6 @@ static struct platform_device *ap325rxa_devices[] __initdata = {
         &ap325rxa_nor_flash_device,
         &lcdc_device,
         &ceu_device,
-#ifdef CONFIG_I2C
-        &camera_device,
-#endif
         &nand_flash_device,
         &sdcard_cn3_device,
 };
@@ -349,6 +400,10 @@ static struct i2c_board_info __initdata ap325rxa_i2c_devices[] = {
         {
                 I2C_BOARD_INFO("pcf8563", 0x51),
         },
+        {
+                I2C_BOARD_INFO("ov772x", 0x21),
+                .platform_data = &ov7725_info,
+        },
 };
 
 static struct spi_board_info ap325rxa_spi_devices[] = {
@@ -426,7 +481,7 @@ static int __init ap325rxa_devices_setup(void)
         gpio_request(GPIO_PTZ6, NULL);
         gpio_direction_output(GPIO_PTZ6, 0); /* STBY_CAM */
         gpio_request(GPIO_PTZ5, NULL);
-        gpio_direction_output(GPIO_PTZ5, 1); /* RST_CAM */
+        gpio_direction_output(GPIO_PTZ5, 0); /* RST_CAM */
         gpio_request(GPIO_PTZ4, NULL);
         gpio_direction_output(GPIO_PTZ4, 0); /* SADDR */
 
diff --git a/arch/sh/configs/ap325rxa_defconfig b/arch/sh/configs/ap325rxa_defconfig
index 5c423fa8e6b..352f87d50fd 100644
--- a/arch/sh/configs/ap325rxa_defconfig
+++ b/arch/sh/configs/ap325rxa_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28
-# Fri Jan  9 16:54:19 2009
+# Linux kernel version: 2.6.29-rc2
+# Tue Jan 27 11:45:08 2009
 #
 CONFIG_SUPERH=y
 CONFIG_SUPERH32=y
@@ -45,12 +45,12 @@ CONFIG_BSD_PROCESS_ACCT=y
 # CONFIG_AUDIT is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 CONFIG_USER_SCHED=y
 # CONFIG_CGROUP_SCHED is not set
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -378,6 +378,7 @@ CONFIG_WIRELESS=y
 # CONFIG_WIRELESS_EXT is not set
 # CONFIG_LIB80211 is not set
 # CONFIG_MAC80211 is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -400,6 +401,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_AR7_PARTS is not set
@@ -447,9 +449,7 @@ CONFIG_MTD_CFI_UTIL=y
 #
 # CONFIG_MTD_COMPLEX_MAPPINGS is not set
 CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PHYSMAP_START=0xffffffff
-CONFIG_MTD_PHYSMAP_LEN=0
-CONFIG_MTD_PHYSMAP_BANKWIDTH=0
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
 # CONFIG_MTD_PLATRAM is not set
 
 #
@@ -480,6 +480,12 @@ CONFIG_MTD_NAND_SH_FLCTL=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 CONFIG_MTD_UBI=y
@@ -607,6 +613,10 @@ CONFIG_SMSC911X=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
@@ -790,6 +800,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -837,7 +848,7 @@ CONFIG_SOC_CAMERA=y
 # CONFIG_SOC_CAMERA_MT9V022 is not set
 # CONFIG_SOC_CAMERA_TW9910 is not set
 CONFIG_SOC_CAMERA_PLATFORM=y
-# CONFIG_SOC_CAMERA_OV772X is not set
+CONFIG_SOC_CAMERA_OV772X=y
 CONFIG_VIDEO_SH_MOBILE_CEU=y
 # CONFIG_RADIO_ADAPTERS is not set
 # CONFIG_DAB is not set
@@ -1012,6 +1023,7 @@ CONFIG_FS_POSIX_ACL=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
@@ -1060,6 +1072,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_JFFS2_FS is not set
 # CONFIG_UBIFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
diff --git a/arch/sh/configs/migor_defconfig b/arch/sh/configs/migor_defconfig
index 7758263514b..678576796bd 100644
--- a/arch/sh/configs/migor_defconfig
+++ b/arch/sh/configs/migor_defconfig
@@ -1,7 +1,7 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.28
-# Fri Jan  9 17:09:35 2009
+# Linux kernel version: 2.6.29-rc1
+# Thu Jan 22 09:16:16 2009
 #
 CONFIG_SUPERH=y
 CONFIG_SUPERH32=y
@@ -45,8 +45,12 @@ CONFIG_SYSVIPC_SYSCTL=y
 CONFIG_IKCONFIG=y
 CONFIG_IKCONFIG_PROC=y
 CONFIG_LOG_BUF_SHIFT=14
-# CONFIG_CGROUPS is not set
 # CONFIG_GROUP_SCHED is not set
+
+#
+# Control Group support
+#
+# CONFIG_CGROUPS is not set
 CONFIG_SYSFS_DEPRECATED=y
 CONFIG_SYSFS_DEPRECATED_V2=y
 # CONFIG_RELAY is not set
@@ -389,6 +393,7 @@ CONFIG_WIRELESS_EXT=y
 CONFIG_WIRELESS_EXT_SYSFS=y
 # CONFIG_LIB80211 is not set
 # CONFIG_MAC80211 is not set
+# CONFIG_WIMAX is not set
 # CONFIG_RFKILL is not set
 # CONFIG_NET_9P is not set
 
@@ -411,6 +416,7 @@ CONFIG_MTD=y
 # CONFIG_MTD_DEBUG is not set
 CONFIG_MTD_CONCAT=y
 CONFIG_MTD_PARTITIONS=y
+# CONFIG_MTD_TESTS is not set
 # CONFIG_MTD_REDBOOT_PARTS is not set
 CONFIG_MTD_CMDLINE_PARTS=y
 # CONFIG_MTD_AR7_PARTS is not set
@@ -458,9 +464,7 @@ CONFIG_MTD_CFI_UTIL=y
 #
 # CONFIG_MTD_COMPLEX_MAPPINGS is not set
 CONFIG_MTD_PHYSMAP=y
-CONFIG_MTD_PHYSMAP_START=0xffffffff
-CONFIG_MTD_PHYSMAP_LEN=0
-CONFIG_MTD_PHYSMAP_BANKWIDTH=0
+# CONFIG_MTD_PHYSMAP_COMPAT is not set
 # CONFIG_MTD_PLATRAM is not set
 
 #
@@ -488,6 +492,12 @@ CONFIG_MTD_NAND_PLATFORM=y
 # CONFIG_MTD_ONENAND is not set
 
 #
+# LPDDR flash memory drivers
+#
+# CONFIG_MTD_LPDDR is not set
+# CONFIG_MTD_QINFO_PROBE is not set
+
+#
 # UBI - Unsorted block images
 #
 # CONFIG_MTD_UBI is not set
@@ -587,6 +597,10 @@ CONFIG_SMC91X=y
 # CONFIG_WLAN_PRE80211 is not set
 # CONFIG_WLAN_80211 is not set
 # CONFIG_IWLWIFI_LEDS is not set
+
+#
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
 # CONFIG_WAN is not set
 # CONFIG_PPP is not set
 # CONFIG_SLIP is not set
@@ -761,6 +775,7 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_PMIC_DA903X is not set
 # CONFIG_MFD_WM8400 is not set
 # CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
 # CONFIG_REGULATOR is not set
 
 #
@@ -806,9 +821,9 @@ CONFIG_SOC_CAMERA=y
 # CONFIG_SOC_CAMERA_MT9M111 is not set
 # CONFIG_SOC_CAMERA_MT9T031 is not set
 # CONFIG_SOC_CAMERA_MT9V022 is not set
-# CONFIG_SOC_CAMERA_TW9910 is not set
-CONFIG_SOC_CAMERA_PLATFORM=y
-# CONFIG_SOC_CAMERA_OV772X is not set
+CONFIG_SOC_CAMERA_TW9910=y
+# CONFIG_SOC_CAMERA_PLATFORM is not set
+CONFIG_SOC_CAMERA_OV772X=y
 CONFIG_VIDEO_SH_MOBILE_CEU=y
 # CONFIG_RADIO_ADAPTERS is not set
 # CONFIG_DAB is not set
@@ -866,11 +881,13 @@ CONFIG_USB_GADGET_SELECTED=y
 # CONFIG_USB_GADGET_PXA25X is not set
 # CONFIG_USB_GADGET_PXA27X is not set
 # CONFIG_USB_GADGET_S3C2410 is not set
+# CONFIG_USB_GADGET_IMX is not set
 CONFIG_USB_GADGET_M66592=y
 CONFIG_USB_M66592=y
 CONFIG_SUPERH_BUILT_IN_M66592=y
 # CONFIG_USB_GADGET_AMD5536UDC is not set
 # CONFIG_USB_GADGET_FSL_QE is not set
+# CONFIG_USB_GADGET_CI13XXX is not set
 # CONFIG_USB_GADGET_NET2280 is not set
 # CONFIG_USB_GADGET_GOKU is not set
 # CONFIG_USB_GADGET_DUMMY_HCD is not set
@@ -883,6 +900,11 @@ CONFIG_USB_G_SERIAL=y
 # CONFIG_USB_MIDI_GADGET is not set
 # CONFIG_USB_G_PRINTER is not set
 # CONFIG_USB_CDC_COMPOSITE is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_USB_GPIO_VBUS is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 # CONFIG_NEW_LEDS is not set
@@ -961,6 +983,7 @@ CONFIG_UIO_PDRV_GENIRQ=y
 CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 # CONFIG_DNOTIFY is not set
 # CONFIG_INOTIFY is not set
 # CONFIG_QUOTA is not set
@@ -1004,6 +1027,7 @@ CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_EFS_FS is not set
 # CONFIG_JFFS2_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
diff --git a/arch/sh/include/asm/mutex-llsc.h b/arch/sh/include/asm/mutex-llsc.h
index ee839ee58ac..090358a7e1b 100644
--- a/arch/sh/include/asm/mutex-llsc.h
+++ b/arch/sh/include/asm/mutex-llsc.h
@@ -21,38 +21,36 @@
 static inline void
 __mutex_fastpath_lock(atomic_t *count, void (*fail_fn)(atomic_t *))
 {
-        int __ex_flag, __res;
+        int __done, __res;
 
         __asm__ __volatile__ (
                 "movli.l        @%2, %0 \n"
                 "add            #-1, %0 \n"
                 "movco.l        %0, @%2 \n"
                 "movt           %1      \n"
-                : "=&z" (__res), "=&r" (__ex_flag)
+                : "=&z" (__res), "=&r" (__done)
                 : "r" (&(count)->counter)
                 : "t");
 
-        __res |= !__ex_flag;
-        if (unlikely(__res != 0))
+        if (unlikely(!__done || __res != 0))
                 fail_fn(count);
 }
 
 static inline int
 __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
 {
-        int __ex_flag, __res;
+        int __done, __res;
 
         __asm__ __volatile__ (
                 "movli.l        @%2, %0 \n"
                 "add            #-1, %0 \n"
                 "movco.l        %0, @%2 \n"
                 "movt           %1      \n"
-                : "=&z" (__res), "=&r" (__ex_flag)
+                : "=&z" (__res), "=&r" (__done)
                 : "r" (&(count)->counter)
                 : "t");
 
-        __res |= !__ex_flag;
-        if (unlikely(__res != 0))
+        if (unlikely(!__done || __res != 0))
                 __res = fail_fn(count);
 
         return __res;
@@ -61,19 +59,18 @@ __mutex_fastpath_lock_retval(atomic_t *count, int (*fail_fn)(atomic_t *))
 static inline void
 __mutex_fastpath_unlock(atomic_t *count, void (*fail_fn)(atomic_t *))
 {
-        int __ex_flag, __res;
+        int __done, __res;
 
         __asm__ __volatile__ (
                 "movli.l        @%2, %0 \n\t"
                 "add            #1, %0  \n\t"
                 "movco.l        %0, @%2 \n\t"
                 "movt           %1      \n\t"
-                : "=&z" (__res), "=&r" (__ex_flag)
+                : "=&z" (__res), "=&r" (__done)
                 : "r" (&(count)->counter)
                 : "t");
 
-        __res |= !__ex_flag;
-        if (unlikely(__res <= 0))
+        if (unlikely(!__done || __res <= 0))
                 fail_fn(count);
 }
 
diff --git a/arch/sh/include/asm/syscall_32.h b/arch/sh/include/asm/syscall_32.h
index 05a868a71ef..5bc34681d99 100644
--- a/arch/sh/include/asm/syscall_32.h
+++ b/arch/sh/include/asm/syscall_32.h
@@ -21,23 +21,10 @@ static inline void syscall_rollback(struct task_struct *task,
          */
 }
 
-static inline bool syscall_has_error(struct pt_regs *regs)
-{
-        return (regs->sr & 0x1) ? true : false;
-}
-static inline void syscall_set_error(struct pt_regs *regs)
-{
-        regs->sr |= 0x1;
-}
-static inline void syscall_clear_error(struct pt_regs *regs)
-{
-        regs->sr &= ~0x1;
-}
-
 static inline long syscall_get_error(struct task_struct *task,
                                      struct pt_regs *regs)
 {
-        return syscall_has_error(regs) ? regs->regs[0] : 0;
+        return IS_ERR_VALUE(regs->regs[0]) ? regs->regs[0] : 0;
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -50,13 +37,10 @@ static inline void syscall_set_return_value(struct task_struct *task,
                                             struct pt_regs *regs,
                                             int error, long val)
 {
-        if (error) {
-                syscall_set_error(regs);
+        if (error)
                 regs->regs[0] = -error;
-        } else {
-                syscall_clear_error(regs);
+        else
                 regs->regs[0] = val;
-        }
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
diff --git a/arch/sh/include/asm/syscall_64.h b/arch/sh/include/asm/syscall_64.h
index e1143b9784d..c3561ca72be 100644
--- a/arch/sh/include/asm/syscall_64.h
+++ b/arch/sh/include/asm/syscall_64.h
@@ -21,23 +21,10 @@ static inline void syscall_rollback(struct task_struct *task,
          */
 }
 
-static inline bool syscall_has_error(struct pt_regs *regs)
-{
-        return (regs->sr & 0x1) ? true : false;
-}
-static inline void syscall_set_error(struct pt_regs *regs)
-{
-        regs->sr |= 0x1;
-}
-static inline void syscall_clear_error(struct pt_regs *regs)
-{
-        regs->sr &= ~0x1;
-}
-
 static inline long syscall_get_error(struct task_struct *task,
                                      struct pt_regs *regs)
 {
-        return syscall_has_error(regs) ? regs->regs[9] : 0;
+        return IS_ERR_VALUE(regs->regs[9]) ? regs->regs[9] : 0;
 }
 
 static inline long syscall_get_return_value(struct task_struct *task,
@@ -50,13 +37,10 @@ static inline void syscall_set_return_value(struct task_struct *task,
                                             struct pt_regs *regs,
                                             int error, long val)
 {
-        if (error) {
-                syscall_set_error(regs);
+        if (error)
                 regs->regs[9] = -error;
-        } else {
-                syscall_clear_error(regs);
+        else
                 regs->regs[9] = val;
-        }
 }
 
 static inline void syscall_get_arguments(struct task_struct *task,
diff --git a/arch/sh/kernel/cpu/sh4/fpu.c b/arch/sh/kernel/cpu/sh4/fpu.c
index 2780917c008..e3ea5411da6 100644
--- a/arch/sh/kernel/cpu/sh4/fpu.c
+++ b/arch/sh/kernel/cpu/sh4/fpu.c
@@ -423,7 +423,7 @@ static int ieee_fpe_handler(struct pt_regs *regs)
                 int m;
                 unsigned int hx;
 
-                m = (finsn >> 9) & 0x7;
+                m = (finsn >> 8) & 0x7;
                 hx = tsk->thread.fpu.hard.fp_regs[m];
 
                 if ((tsk->thread.fpu.hard.fpscr & FPSCR_CAUSE_ERROR)
diff --git a/arch/sh/kernel/setup.c b/arch/sh/kernel/setup.c
index 53424750857..370d2cfa34e 100644
--- a/arch/sh/kernel/setup.c
+++ b/arch/sh/kernel/setup.c
@@ -262,11 +262,11 @@ void __init setup_bootmem_allocator(unsigned long free_pfn)
                         BOOTMEM_DEFAULT);
 
         /*
-         * reserve physical page 0 - it's a special BIOS page on many boxes,
-         * enabling clean reboots, SMP operation, laptop functions.
+         * Reserve physical pages below CONFIG_ZERO_PAGE_OFFSET.
          */
-        reserve_bootmem(__MEMORY_START, CONFIG_ZERO_PAGE_OFFSET,
-                        BOOTMEM_DEFAULT);
+        if (CONFIG_ZERO_PAGE_OFFSET != 0)
+                reserve_bootmem(__MEMORY_START, CONFIG_ZERO_PAGE_OFFSET,
+                                BOOTMEM_DEFAULT);
 
         sparse_memory_present_with_active_regions(0);
 
diff --git a/arch/sh/kernel/signal_32.c b/arch/sh/kernel/signal_32.c
index 77c21bde376..17784e19ae3 100644
--- a/arch/sh/kernel/signal_32.c
+++ b/arch/sh/kernel/signal_32.c
@@ -510,7 +510,6 @@ handle_syscall_restart(unsigned long save_r0, struct pt_regs *regs,
                 case -ERESTARTNOHAND:
                 no_system_call_restart:
                         regs->regs[0] = -EINTR;
-                        regs->sr |= 1;
                         break;
 
                 case -ERESTARTSYS:
@@ -589,8 +588,7 @@ static void do_signal(struct pt_regs *regs, unsigned int save_r0)
 
         signr = get_signal_to_deliver(&info, &ka, regs, NULL);
         if (signr > 0) {
-                if (regs->sr & 1)
-                        handle_syscall_restart(save_r0, regs, &ka.sa);
+                handle_syscall_restart(save_r0, regs, &ka.sa);
 
                 /* Whee!  Actually deliver the signal.  */
                 if (handle_signal(signr, &ka, &info, oldset,
diff --git a/arch/sh/kernel/signal_64.c b/arch/sh/kernel/signal_64.c
index b22fdfaaa19..0663a0ee602 100644
--- a/arch/sh/kernel/signal_64.c
+++ b/arch/sh/kernel/signal_64.c
@@ -60,7 +60,6 @@ handle_syscall_restart(struct pt_regs *regs, struct sigaction *sa)
                 case -ERESTARTNOHAND:
                 no_system_call_restart:
                         regs->regs[REG_RET] = -EINTR;
-                        regs->sr |= 1;
                         break;
 
                 case -ERESTARTSYS:
@@ -109,8 +108,7 @@ static int do_signal(struct pt_regs *regs, sigset_t *oldset)
 
         signr = get_signal_to_deliver(&info, &ka, regs, 0);
         if (signr > 0) {
-                if (regs->sr & 1)
-                        handle_syscall_restart(regs, &ka.sa);
+                handle_syscall_restart(regs, &ka.sa);
 
                 /* Whee!  Actually deliver the signal.  */
                 if (handle_signal(signr, &info, &ka, oldset, regs) == 0) {
diff --git a/arch/sh/lib/checksum.S b/arch/sh/lib/checksum.S
index cbdd0d40e54..356c8ec9289 100644
--- a/arch/sh/lib/checksum.S
+++ b/arch/sh/lib/checksum.S
@@ -36,8 +36,7 @@
  */
 
 /*      
- * unsigned int csum_partial(const unsigned char *buf, int len,
- *                           unsigned int sum);
+ * asmlinkage __wsum csum_partial(const void *buf, int len, __wsum sum);
  */
 
 .text
@@ -49,11 +48,31 @@ ENTRY(csum_partial)
            * Fortunately, it is easy to convert 2-byte alignment to 4-byte
            * alignment for the unrolled loop.
            */
-        mov     r5, r1
         mov     r4, r0
-        tst     #2, r0          ! Check alignment.
-        bt      2f              ! Jump if alignment is ok.
+        tst     #3, r0          ! Check alignment.
+        bt/s    2f              ! Jump if alignment is ok.
+         mov    r4, r7          ! Keep a copy to check for alignment
         !
+        tst     #1, r0          ! Check alignment.
+        bt      21f             ! Jump if alignment is boundary of 2bytes.
+
+        ! buf is odd
+        tst     r5, r5
+        add     #-1, r5
+        bt      9f
+        mov.b   @r4+, r0
+        extu.b  r0, r0
+        addc    r0, r6          ! t=0 from previous tst
+        mov     r6, r0
+        shll8   r6
+        shlr16  r0
+        shlr8   r0
+        or      r0, r6
+        mov     r4, r0
+        tst     #2, r0
+        bt      2f
+21:
+        ! buf is 2 byte aligned (len could be 0)
         add     #-2, r5         ! Alignment uses up two bytes.
         cmp/pz  r5              !
         bt/s    1f              ! Jump if we had at least two bytes.
@@ -61,16 +80,17 @@ ENTRY(csum_partial)
         bra     6f
          add    #2, r5          ! r5 was < 2.  Deal with it.
 1:
-        mov     r5, r1          ! Save new len for later use.
         mov.w   @r4+, r0
         extu.w  r0, r0
         addc    r0, r6
         bf      2f
         add     #1, r6
 2:
+        ! buf is 4 byte aligned (len could be 0)
+        mov     r5, r1
         mov     #-5, r0
-        shld    r0, r5
-        tst     r5, r5
+        shld    r0, r1
+        tst     r1, r1
         bt/s    4f              ! if it's =0, go to 4f
          clrt
         .align  2
@@ -92,30 +112,31 @@ ENTRY(csum_partial)
         addc    r0, r6
         addc    r2, r6
         movt    r0
-        dt      r5
+        dt      r1
         bf/s    3b
          cmp/eq #1, r0
-        ! here, we know r5==0
-        addc    r5, r6                  ! add carry to r6
+        ! here, we know r1==0
+        addc    r1, r6                  ! add carry to r6
 4:
-        mov     r1, r0
+        mov     r5, r0
         and     #0x1c, r0
         tst     r0, r0
-        bt/s    6f
-         mov    r0, r5
-        shlr2   r5
+        bt      6f
+        ! 4 bytes or more remaining
+        mov     r0, r1
+        shlr2   r1
         mov     #0, r2
 5:
         addc    r2, r6
         mov.l   @r4+, r2
         movt    r0
-        dt      r5
+        dt      r1
         bf/s    5b
          cmp/eq #1, r0
         addc    r2, r6
-        addc    r5, r6          ! r5==0 here, so it means add carry-bit
+        addc    r1, r6          ! r1==0 here, so it means add carry-bit
 6:
-        mov     r1, r5
+        ! 3 bytes or less remaining
         mov     #3, r0
         and     r0, r5
         tst     r5, r5
@@ -139,8 +160,18 @@ ENTRY(csum_partial)
 8:
         addc    r0, r6
         mov     #0, r0
-        addc    r0, r6 
+        addc    r0, r6
 9:
+        ! Check if the buffer was misaligned, if so realign sum
+        mov     r7, r0
+        tst     #1, r0
+        bt      10f
+        mov     r6, r0
+        shll8   r6
+        shlr16  r0
+        shlr8   r0
+        or      r0, r6
+10:
         rts
          mov    r6, r0
 
diff --git a/arch/sparc/include/asm/cpudata_64.h b/arch/sparc/include/asm/cpudata_64.h
index 7da7c13d23c..a11b89ee9ef 100644
--- a/arch/sparc/include/asm/cpudata_64.h
+++ b/arch/sparc/include/asm/cpudata_64.h
@@ -17,7 +17,7 @@
 typedef struct {
         /* Dcache line 1 */
         unsigned int    __softirq_pending; /* must be 1st, see rtrap.S */
-        unsigned int    __pad0;
+        unsigned int    __nmi_count;
         unsigned long   clock_tick;     /* %tick's per second */
         unsigned long   __pad;
         unsigned int    __pad1;
diff --git a/arch/sparc/include/asm/irq_64.h b/arch/sparc/include/asm/irq_64.h
index d47d4a1955a..1934f2cbf51 100644
--- a/arch/sparc/include/asm/irq_64.h
+++ b/arch/sparc/include/asm/irq_64.h
@@ -66,9 +66,6 @@ extern void virt_irq_free(unsigned int virt_irq);
 extern void __init init_IRQ(void);
 extern void fixup_irqs(void);
 
-extern int register_perfctr_intr(void (*handler)(struct pt_regs *));
-extern void release_perfctr_intr(void (*handler)(struct pt_regs *));
-
 static inline void set_softint(unsigned long bits)
 {
         __asm__ __volatile__("wr        %0, 0x0, %%set_softint"
@@ -98,5 +95,6 @@ void __trigger_all_cpu_backtrace(void);
 extern void *hardirq_stack[NR_CPUS];
 extern void *softirq_stack[NR_CPUS];
 #define __ARCH_HAS_DO_SOFTIRQ
+#define ARCH_HAS_NMI_WATCHDOG
 
 #endif
diff --git a/arch/sparc/include/asm/kdebug_64.h b/arch/sparc/include/asm/kdebug_64.h
index f905b773235..feb3578e12c 100644
--- a/arch/sparc/include/asm/kdebug_64.h
+++ b/arch/sparc/include/asm/kdebug_64.h
@@ -14,6 +14,8 @@ enum die_val {
         DIE_TRAP,
         DIE_TRAP_TL1,
         DIE_CALL,
+        DIE_NMI,
+        DIE_NMIWATCHDOG,
 };
 
 #endif
diff --git a/arch/sparc/include/asm/nmi.h b/arch/sparc/include/asm/nmi.h
new file mode 100644
index 00000000000..fbd546dd4fe
--- /dev/null
+++ b/arch/sparc/include/asm/nmi.h
@@ -0,0 +1,10 @@
+#ifndef __NMI_H
+#define __NMI_H
+
+extern int __init nmi_init(void);
+extern void perfctr_irq(int irq, struct pt_regs *regs);
+extern void nmi_adjust_hz(unsigned int new_hz);
+
+extern int nmi_usable;
+
+#endif /* __NMI_H */
diff --git a/arch/sparc/include/asm/pcr.h b/arch/sparc/include/asm/pcr.h
new file mode 100644
index 00000000000..a2f5c61f924
--- /dev/null
+++ b/arch/sparc/include/asm/pcr.h
@@ -0,0 +1,46 @@
+#ifndef __PCR_H
+#define __PCR_H
+
+struct pcr_ops {
+        u64 (*read)(void);
+        void (*write)(u64);
+};
+extern const struct pcr_ops *pcr_ops;
+
+extern void deferred_pcr_work_irq(int irq, struct pt_regs *regs);
+extern void schedule_deferred_pcr_work(void);
+
+#define PCR_PIC_PRIV            0x00000001 /* PIC access is privileged */
+#define PCR_STRACE              0x00000002 /* Trace supervisor events  */
+#define PCR_UTRACE              0x00000004 /* Trace user events        */
+#define PCR_N2_HTRACE           0x00000008 /* Trace hypervisor events  */
+#define PCR_N2_TOE_OV0          0x00000010 /* Trap if PIC 0 overflows  */
+#define PCR_N2_TOE_OV1          0x00000020 /* Trap if PIC 1 overflows  */
+#define PCR_N2_MASK0            0x00003fc0
+#define PCR_N2_MASK0_SHIFT      6
+#define PCR_N2_SL0              0x0003c000
+#define PCR_N2_SL0_SHIFT        14
+#define PCR_N2_OV0              0x00040000
+#define PCR_N2_MASK1            0x07f80000
+#define PCR_N2_MASK1_SHIFT      19
+#define PCR_N2_SL1              0x78000000
+#define PCR_N2_SL1_SHIFT        27
+#define PCR_N2_OV1              0x80000000
+
+extern unsigned int picl_shift;
+
+/* In order to commonize as much of the implementation as
+ * possible, we use PICH as our counter.  Mostly this is
+ * to accomodate Niagara-1 which can only count insn cycles
+ * in PICH.
+ */
+static inline u64 picl_value(unsigned int nmi_hz)
+{
+        u32 delta = local_cpu_data().clock_tick / (nmi_hz << picl_shift);
+
+        return ((u64)((0 - delta) & 0xffffffff)) << 32;
+}
+
+extern u64 pcr_enable;
+
+#endif /* __PCR_H */
diff --git a/arch/sparc/include/asm/pil.h b/arch/sparc/include/asm/pil.h
index d573820c0ff..32a7efe76d0 100644
--- a/arch/sparc/include/asm/pil.h
+++ b/arch/sparc/include/asm/pil.h
@@ -23,6 +23,7 @@
 #define PIL_SMP_CTX_NEW_VERSION 4
 #define PIL_DEVICE_IRQ          5
 #define PIL_SMP_CALL_FUNC_SNGL  6
+#define PIL_DEFERRED_PCR_WORK   7
 #define PIL_NORMAL_MAX          14
 #define PIL_NMI                 15
 
diff --git a/arch/sparc/kernel/Makefile b/arch/sparc/kernel/Makefile
index 53adcaa0348..54742e58831 100644
--- a/arch/sparc/kernel/Makefile
+++ b/arch/sparc/kernel/Makefile
@@ -52,6 +52,8 @@ obj-$(CONFIG_SPARC64)   += visemul.o
 obj-$(CONFIG_SPARC64)   += hvapi.o
 obj-$(CONFIG_SPARC64)   += sstate.o
 obj-$(CONFIG_SPARC64)   += mdesc.o
+obj-$(CONFIG_SPARC64)   += pcr.o
+obj-$(CONFIG_SPARC64)   += nmi.o
 
 # sparc32 do not use GENERIC_HARDIRQS but uses the generic devres implementation
 obj-$(CONFIG_SPARC32)     += devres.o
diff --git a/arch/sparc/kernel/cpu.c b/arch/sparc/kernel/cpu.c
index 32d32b4824f..d85c3dc4953 100644
--- a/arch/sparc/kernel/cpu.c
+++ b/arch/sparc/kernel/cpu.c
@@ -26,6 +26,7 @@ EXPORT_PER_CPU_SYMBOL(__cpu_data);
 struct cpu_info {
         int psr_vers;
         const char *name;
+        const char *pmu_name;
 };
 
 struct fpu_info {
@@ -45,6 +46,9 @@ struct manufacturer_info {
 #define CPU(ver, _name) \
 { .psr_vers = ver, .name = _name }
 
+#define CPU_PMU(ver, _name, _pmu_name)  \
+{ .psr_vers = ver, .name = _name, .pmu_name = _pmu_name }
+
 #define FPU(ver, _name) \
 { .fp_vers = ver, .name = _name }
 
@@ -183,10 +187,10 @@ static const struct manufacturer_info __initconst manufacturer_info[] = {
 },{
         0x17,
         .cpu_info = {
-                CPU(0x10, "TI UltraSparc I   (SpitFire)"),
-                CPU(0x11, "TI UltraSparc II  (BlackBird)"),
-                CPU(0x12, "TI UltraSparc IIi (Sabre)"),
-                CPU(0x13, "TI UltraSparc IIe (Hummingbird)"),
+                CPU_PMU(0x10, "TI UltraSparc I   (SpitFire)", "ultra12"),
+                CPU_PMU(0x11, "TI UltraSparc II  (BlackBird)", "ultra12"),
+                CPU_PMU(0x12, "TI UltraSparc IIi (Sabre)", "ultra12"),
+                CPU_PMU(0x13, "TI UltraSparc IIe (Hummingbird)", "ultra12"),
                 CPU(-1, NULL)
         },
         .fpu_info = {
@@ -199,7 +203,7 @@ static const struct manufacturer_info __initconst manufacturer_info[] = {
 },{
         0x22,
         .cpu_info = {
-                CPU(0x10, "TI UltraSparc I   (SpitFire)"),
+                CPU_PMU(0x10, "TI UltraSparc I   (SpitFire)", "ultra12"),
                 CPU(-1, NULL)
         },
         .fpu_info = {
@@ -209,12 +213,12 @@ static const struct manufacturer_info __initconst manufacturer_info[] = {
 },{
         0x3e,
         .cpu_info = {
-                CPU(0x14, "TI UltraSparc III (Cheetah)"),
-                CPU(0x15, "TI UltraSparc III+ (Cheetah+)"),
-                CPU(0x16, "TI UltraSparc IIIi (Jalapeno)"),
-                CPU(0x18, "TI UltraSparc IV (Jaguar)"),
-                CPU(0x19, "TI UltraSparc IV+ (Panther)"),
-                CPU(0x22, "TI UltraSparc IIIi+ (Serrano)"),
+                CPU_PMU(0x14, "TI UltraSparc III (Cheetah)", "ultra3"),
+                CPU_PMU(0x15, "TI UltraSparc III+ (Cheetah+)", "ultra3+"),
+                CPU_PMU(0x16, "TI UltraSparc IIIi (Jalapeno)", "ultra3i"),
+                CPU_PMU(0x18, "TI UltraSparc IV (Jaguar)", "ultra3+"),
+                CPU_PMU(0x19, "TI UltraSparc IV+ (Panther)", "ultra4+"),
+                CPU_PMU(0x22, "TI UltraSparc IIIi+ (Serrano)", "ultra3i"),
                 CPU(-1, NULL)
         },
         .fpu_info = {
@@ -234,6 +238,7 @@ static const struct manufacturer_info __initconst manufacturer_info[] = {
 
 const char *sparc_cpu_type;
 const char *sparc_fpu_type;
+const char *sparc_pmu_type;
 
 unsigned int fsr_storage;
 
@@ -244,6 +249,7 @@ static void set_cpu_and_fpu(int psr_impl, int psr_vers, int fpu_vers)
 
         sparc_cpu_type = NULL;
         sparc_fpu_type = NULL;
+        sparc_pmu_type = NULL;
         manuf = NULL;
 
         for (i = 0; i < ARRAY_SIZE(manufacturer_info); i++)
@@ -263,6 +269,7 @@ static void set_cpu_and_fpu(int psr_impl, int psr_vers, int fpu_vers)
                 {
                         if (cpu->psr_vers == psr_vers) {
                                 sparc_cpu_type = cpu->name;
+                                sparc_pmu_type = cpu->pmu_name;
                                 sparc_fpu_type = "No FPU";
                                 break;
                         }
@@ -290,6 +297,8 @@ static void set_cpu_and_fpu(int psr_impl, int psr_vers, int fpu_vers)
                        psr_impl, fpu_vers);
                 sparc_fpu_type = "Unknown FPU";
         }
+        if (sparc_pmu_type == NULL)
+                sparc_pmu_type = "Unknown PMU";
 }
 
 #ifdef CONFIG_SPARC32
@@ -315,11 +324,13 @@ static void __init sun4v_cpu_probe(void)
         case SUN4V_CHIP_NIAGARA1:
                 sparc_cpu_type = "UltraSparc T1 (Niagara)";
                 sparc_fpu_type = "UltraSparc T1 integrated FPU";
+                sparc_pmu_type = "niagara";
                 break;
 
         case SUN4V_CHIP_NIAGARA2:
                 sparc_cpu_type = "UltraSparc T2 (Niagara2)";
                 sparc_fpu_type = "UltraSparc T2 integrated FPU";
+                sparc_pmu_type = "niagara2";
                 break;
 
         default:
diff --git a/arch/sparc/kernel/head_64.S b/arch/sparc/kernel/head_64.S
index 8ffee714f93..a46c3a21e26 100644
--- a/arch/sparc/kernel/head_64.S
+++ b/arch/sparc/kernel/head_64.S
@@ -891,10 +891,35 @@ prom_tba:	.xword	0
 tlb_type:       .word   0       /* Must NOT end up in BSS */
         .section        ".fixup",#alloc,#execinstr
 
-        .globl  __ret_efault, __retl_efault
-__ret_efault:
+        .globl  __ret_efault, __retl_efault, __ret_one, __retl_one
+ENTRY(__ret_efault)
         ret
          restore %g0, -EFAULT, %o0
-__retl_efault:
+ENDPROC(__ret_efault)
+
+ENTRY(__retl_efault)
         retl
          mov    -EFAULT, %o0
+ENDPROC(__retl_efault)
+
+ENTRY(__retl_one)
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one)
+
+ENTRY(__ret_one_asi)
+        wr      %g0, ASI_AIUS, %asi
+        ret
+         restore %g0, 1, %o0
+ENDPROC(__ret_one_asi)
+
+ENTRY(__retl_one_asi)
+        wr      %g0, ASI_AIUS, %asi
+        retl
+         mov    1, %o0
+ENDPROC(__retl_one_asi)
+
+ENTRY(__retl_o1)
+        retl
+         mov    %o1, %o0
+ENDPROC(__retl_o1)
diff --git a/arch/sparc/kernel/irq_64.c b/arch/sparc/kernel/irq_64.c
index cab8e028687..3d2c6baae96 100644
--- a/arch/sparc/kernel/irq_64.c
+++ b/arch/sparc/kernel/irq_64.c
@@ -196,6 +196,11 @@ int show_interrupts(struct seq_file *p, void *v)
                 seq_putc(p, '\n');
 skip:
                 spin_unlock_irqrestore(&irq_desc[i].lock, flags);
+        } else if (i == NR_IRQS) {
+                seq_printf(p, "NMI: ");
+                for_each_online_cpu(j)
+                        seq_printf(p, "%10u ", cpu_data(j).__nmi_count);
+                seq_printf(p, "     Non-maskable interrupts\n");
         }
         return 0;
 }
@@ -247,9 +252,10 @@ struct irq_handler_data {
 #ifdef CONFIG_SMP
 static int irq_choose_cpu(unsigned int virt_irq)
 {
-        cpumask_t mask = irq_desc[virt_irq].affinity;
+        cpumask_t mask;
         int cpuid;
 
+        cpumask_copy(&mask, irq_desc[virt_irq].affinity);
         if (cpus_equal(mask, CPU_MASK_ALL)) {
                 static int irq_rover;
                 static DEFINE_SPINLOCK(irq_rover_lock);
@@ -778,69 +784,6 @@ void do_softirq(void)
         local_irq_restore(flags);
 }
 
-static void unhandled_perf_irq(struct pt_regs *regs)
-{
-        unsigned long pcr, pic;
-
-        read_pcr(pcr);
-        read_pic(pic);
-
-        write_pcr(0);
-
-        printk(KERN_EMERG "CPU %d: Got unexpected perf counter IRQ.\n",
-               smp_processor_id());
-        printk(KERN_EMERG "CPU %d: PCR[%016lx] PIC[%016lx]\n",
-               smp_processor_id(), pcr, pic);
-}
-
-/* Almost a direct copy of the powerpc PMC code.  */
-static DEFINE_SPINLOCK(perf_irq_lock);
-static void *perf_irq_owner_caller; /* mostly for debugging */
-static void (*perf_irq)(struct pt_regs *regs) = unhandled_perf_irq;
-
-/* Invoked from level 15 PIL handler in trap table.  */
-void perfctr_irq(int irq, struct pt_regs *regs)
-{
-        clear_softint(1 << irq);
-        perf_irq(regs);
-}
-
-int register_perfctr_intr(void (*handler)(struct pt_regs *))
-{
-        int ret;
-
-        if (!handler)
-                return -EINVAL;
-
-        spin_lock(&perf_irq_lock);
-        if (perf_irq != unhandled_perf_irq) {
-                printk(KERN_WARNING "register_perfctr_intr: "
-                       "perf IRQ busy (reserved by caller %p)\n",
-                       perf_irq_owner_caller);
-                ret = -EBUSY;
-                goto out;
-        }
-
-        perf_irq_owner_caller = __builtin_return_address(0);
-        perf_irq = handler;
-
-        ret = 0;
-out:
-        spin_unlock(&perf_irq_lock);
-
-        return ret;
-}
-EXPORT_SYMBOL_GPL(register_perfctr_intr);
-
-void release_perfctr_intr(void (*handler)(struct pt_regs *))
-{
-        spin_lock(&perf_irq_lock);
-        perf_irq_owner_caller = NULL;
-        perf_irq = unhandled_perf_irq;
-        spin_unlock(&perf_irq_lock);
-}
-EXPORT_SYMBOL_GPL(release_perfctr_intr);
-
 #ifdef CONFIG_HOTPLUG_CPU
 void fixup_irqs(void)
 {
@@ -854,7 +797,7 @@ void fixup_irqs(void)
                     !(irq_desc[irq].status & IRQ_PER_CPU)) {
                         if (irq_desc[irq].chip->set_affinity)
                                 irq_desc[irq].chip->set_affinity(irq,
-                                        &irq_desc[irq].affinity);
+                                        irq_desc[irq].affinity);
                 }
                 spin_unlock_irqrestore(&irq_desc[irq].lock, flags);
         }
diff --git a/arch/sparc/kernel/kernel.h b/arch/sparc/kernel/kernel.h
index 81a972e8d8e..15d8a3f645c 100644
--- a/arch/sparc/kernel/kernel.h
+++ b/arch/sparc/kernel/kernel.h
@@ -5,6 +5,7 @@
 
 /* cpu.c */
 extern const char *sparc_cpu_type;
+extern const char *sparc_pmu_type;
 extern const char *sparc_fpu_type;
 
 extern unsigned int fsr_storage;
diff --git a/arch/sparc/kernel/nmi.c b/arch/sparc/kernel/nmi.c
new file mode 100644
index 00000000000..f3577223c86
--- /dev/null
+++ b/arch/sparc/kernel/nmi.c
@@ -0,0 +1,225 @@
+/* Pseudo NMI support on sparc64 systems.
+ *
+ * Copyright (C) 2009 David S. Miller <davem@davemloft.net>
+ *
+ * The NMI watchdog support and infrastructure is based almost
+ * entirely upon the x86 NMI support code.
+ */
+#include <linux/kernel.h>
+#include <linux/param.h>
+#include <linux/init.h>
+#include <linux/percpu.h>
+#include <linux/nmi.h>
+#include <linux/module.h>
+#include <linux/kprobes.h>
+#include <linux/kernel_stat.h>
+#include <linux/slab.h>
+#include <linux/kdebug.h>
+#include <linux/delay.h>
+#include <linux/smp.h>
+
+#include <asm/ptrace.h>
+#include <asm/local.h>
+#include <asm/pcr.h>
+
+/* We don't have a real NMI on sparc64, but we can fake one
+ * up using profiling counter overflow interrupts and interrupt
+ * levels.
+ *
+ * The profile overflow interrupts at level 15, so we use
+ * level 14 as our IRQ off level.
+ */
+
+static int nmi_watchdog_active;
+static int panic_on_timeout;
+
+int nmi_usable;
+EXPORT_SYMBOL_GPL(nmi_usable);
+
+static unsigned int nmi_hz = HZ;
+
+static DEFINE_PER_CPU(unsigned int, last_irq_sum);
+static DEFINE_PER_CPU(local_t, alert_counter);
+static DEFINE_PER_CPU(int, nmi_touch);
+
+void touch_nmi_watchdog(void)
+{
+        if (nmi_watchdog_active) {
+                int cpu;
+
+                for_each_present_cpu(cpu) {
+                        if (per_cpu(nmi_touch, cpu) != 1)
+                                per_cpu(nmi_touch, cpu) = 1;
+                }
+        }
+
+        touch_softlockup_watchdog();
+}
+EXPORT_SYMBOL(touch_nmi_watchdog);
+
+static void die_nmi(const char *str, struct pt_regs *regs, int do_panic)
+{
+        if (notify_die(DIE_NMIWATCHDOG, str, regs, 0,
+                       pt_regs_trap_type(regs), SIGINT) == NOTIFY_STOP)
+                return;
+
+        console_verbose();
+        bust_spinlocks(1);
+
+        printk(KERN_EMERG "%s", str);
+        printk(" on CPU%d, ip %08lx, registers:\n",
+               smp_processor_id(), regs->tpc);
+        show_regs(regs);
+        dump_stack();
+
+        bust_spinlocks(0);
+
+        if (do_panic || panic_on_oops)
+                panic("Non maskable interrupt");
+
+        local_irq_enable();
+        do_exit(SIGBUS);
+}
+
+notrace __kprobes void perfctr_irq(int irq, struct pt_regs *regs)
+{
+        unsigned int sum, touched = 0;
+        int cpu = smp_processor_id();
+
+        clear_softint(1 << irq);
+        pcr_ops->write(PCR_PIC_PRIV);
+
+        local_cpu_data().__nmi_count++;
+
+        if (notify_die(DIE_NMI, "nmi", regs, 0,
+                       pt_regs_trap_type(regs), SIGINT) == NOTIFY_STOP)
+                touched = 1;
+
+        sum = kstat_irqs_cpu(0, cpu);
+        if (__get_cpu_var(nmi_touch)) {
+                __get_cpu_var(nmi_touch) = 0;
+                touched = 1;
+        }
+        if (!touched && __get_cpu_var(last_irq_sum) == sum) {
+                local_inc(&__get_cpu_var(alert_counter));
+                if (local_read(&__get_cpu_var(alert_counter)) == 5 * nmi_hz)
+                        die_nmi("BUG: NMI Watchdog detected LOCKUP",
+                                regs, panic_on_timeout);
+        } else {
+                __get_cpu_var(last_irq_sum) = sum;
+                local_set(&__get_cpu_var(alert_counter), 0);
+        }
+        if (nmi_usable) {
+                write_pic(picl_value(nmi_hz));
+                pcr_ops->write(pcr_enable);
+        }
+}
+
+static inline unsigned int get_nmi_count(int cpu)
+{
+        return cpu_data(cpu).__nmi_count;
+}
+
+static int endflag __initdata;
+
+static __init void nmi_cpu_busy(void *data)
+{
+        local_irq_enable_in_hardirq();
+        while (endflag == 0)
+                mb();
+}
+
+static void report_broken_nmi(int cpu, int *prev_nmi_count)
+{
+        printk(KERN_CONT "\n");
+
+        printk(KERN_WARNING
+                "WARNING: CPU#%d: NMI appears to be stuck (%d->%d)!\n",
+                        cpu, prev_nmi_count[cpu], get_nmi_count(cpu));
+
+        printk(KERN_WARNING
+                "Please report this to bugzilla.kernel.org,\n");
+        printk(KERN_WARNING
+                "and attach the output of the 'dmesg' command.\n");
+
+        nmi_usable = 0;
+}
+
+static void stop_watchdog(void *unused)
+{
+        pcr_ops->write(PCR_PIC_PRIV);
+}
+
+static int __init check_nmi_watchdog(void)
+{
+        unsigned int *prev_nmi_count;
+        int cpu, err;
+
+        prev_nmi_count = kmalloc(nr_cpu_ids * sizeof(unsigned int), GFP_KERNEL);
+        if (!prev_nmi_count) {
+                err = -ENOMEM;
+                goto error;
+        }
+
+        printk(KERN_INFO "Testing NMI watchdog ... ");
+
+        smp_call_function(nmi_cpu_busy, (void *)&endflag, 0);
+
+        for_each_possible_cpu(cpu)
+                prev_nmi_count[cpu] = get_nmi_count(cpu);
+        local_irq_enable();
+        mdelay((20 * 1000) / nmi_hz); /* wait 20 ticks */
+
+        for_each_online_cpu(cpu) {
+                if (get_nmi_count(cpu) - prev_nmi_count[cpu] <= 5)
+                        report_broken_nmi(cpu, prev_nmi_count);
+        }
+        endflag = 1;
+        if (!nmi_usable) {
+                kfree(prev_nmi_count);
+                err = -ENODEV;
+                goto error;
+        }
+        printk("OK.\n");
+
+        nmi_hz = 1;
+
+        kfree(prev_nmi_count);
+        return 0;
+error:
+        on_each_cpu(stop_watchdog, NULL, 1);
+        return err;
+}
+
+static void start_watchdog(void *unused)
+{
+        pcr_ops->write(PCR_PIC_PRIV);
+        write_pic(picl_value(nmi_hz));
+
+        pcr_ops->write(pcr_enable);
+}
+
+void nmi_adjust_hz(unsigned int new_hz)
+{
+        nmi_hz = new_hz;
+        on_each_cpu(start_watchdog, NULL, 1);
+}
+EXPORT_SYMBOL_GPL(nmi_adjust_hz);
+
+int __init nmi_init(void)
+{
+        nmi_usable = 1;
+
+        on_each_cpu(start_watchdog, NULL, 1);
+
+        return check_nmi_watchdog();
+}
+
+static int __init setup_nmi_watchdog(char *str)
+{
+        if (!strncmp(str, "panic", 5))
+                panic_on_timeout = 1;
+
+        return 0;
+}
+__setup("nmi_watchdog=", setup_nmi_watchdog);
diff --git a/arch/sparc/kernel/pcr.c b/arch/sparc/kernel/pcr.c
new file mode 100644
index 00000000000..1ae8cdd7e70
--- /dev/null
+++ b/arch/sparc/kernel/pcr.c
@@ -0,0 +1,158 @@
+/* pcr.c: Generic sparc64 performance counter infrastructure.
+ *
+ * Copyright (C) 2009 David S. Miller (davem@davemloft.net)
+ */
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/irq.h>
+
+#include <asm/pil.h>
+#include <asm/pcr.h>
+#include <asm/nmi.h>
+
+/* This code is shared between various users of the performance
+ * counters.  Users will be oprofile, pseudo-NMI watchdog, and the
+ * perf_counter support layer.
+ */
+
+#define PCR_SUN4U_ENABLE        (PCR_PIC_PRIV | PCR_STRACE | PCR_UTRACE)
+#define PCR_N2_ENABLE           (PCR_PIC_PRIV | PCR_STRACE | PCR_UTRACE | \
+                                 PCR_N2_TOE_OV1 | \
+                                 (2 << PCR_N2_SL1_SHIFT) | \
+                                 (0xff << PCR_N2_MASK1_SHIFT))
+
+u64 pcr_enable;
+unsigned int picl_shift;
+
+/* Performance counter interrupts run unmasked at PIL level 15.
+ * Therefore we can't do things like wakeups and other work
+ * that expects IRQ disabling to be adhered to in locking etc.
+ *
+ * Therefore in such situations we defer the work by signalling
+ * a lower level cpu IRQ.
+ */
+void deferred_pcr_work_irq(int irq, struct pt_regs *regs)
+{
+        clear_softint(1 << PIL_DEFERRED_PCR_WORK);
+}
+
+void schedule_deferred_pcr_work(void)
+{
+        set_softint(1 << PIL_DEFERRED_PCR_WORK);
+}
+
+const struct pcr_ops *pcr_ops;
+EXPORT_SYMBOL_GPL(pcr_ops);
+
+static u64 direct_pcr_read(void)
+{
+        u64 val;
+
+        read_pcr(val);
+        return val;
+}
+
+static void direct_pcr_write(u64 val)
+{
+        write_pcr(val);
+}
+
+static const struct pcr_ops direct_pcr_ops = {
+        .read   = direct_pcr_read,
+        .write  = direct_pcr_write,
+};
+
+static void n2_pcr_write(u64 val)
+{
+        unsigned long ret;
+
+        ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val);
+        if (val != HV_EOK)
+                write_pcr(val);
+}
+
+static const struct pcr_ops n2_pcr_ops = {
+        .read   = direct_pcr_read,
+        .write  = n2_pcr_write,
+};
+
+static unsigned long perf_hsvc_group;
+static unsigned long perf_hsvc_major;
+static unsigned long perf_hsvc_minor;
+
+static int __init register_perf_hsvc(void)
+{
+        if (tlb_type == hypervisor) {
+                switch (sun4v_chip_type) {
+                case SUN4V_CHIP_NIAGARA1:
+                        perf_hsvc_group = HV_GRP_NIAG_PERF;
+                        break;
+
+                case SUN4V_CHIP_NIAGARA2:
+                        perf_hsvc_group = HV_GRP_N2_CPU;
+                        break;
+
+                default:
+                        return -ENODEV;
+                }
+
+
+                perf_hsvc_major = 1;
+                perf_hsvc_minor = 0;
+                if (sun4v_hvapi_register(perf_hsvc_group,
+                                         perf_hsvc_major,
+                                         &perf_hsvc_minor)) {
+                        printk("perfmon: Could not register hvapi.\n");
+                        return -ENODEV;
+                }
+        }
+        return 0;
+}
+
+static void __init unregister_perf_hsvc(void)
+{
+        if (tlb_type != hypervisor)
+                return;
+        sun4v_hvapi_unregister(perf_hsvc_group);
+}
+
+int __init pcr_arch_init(void)
+{
+        int err = register_perf_hsvc();
+
+        if (err)
+                return err;
+
+        switch (tlb_type) {
+        case hypervisor:
+                pcr_ops = &n2_pcr_ops;
+                pcr_enable = PCR_N2_ENABLE;
+                picl_shift = 2;
+                break;
+
+        case cheetah:
+        case cheetah_plus:
+                pcr_ops = &direct_pcr_ops;
+                pcr_enable = PCR_SUN4U_ENABLE;
+                break;
+
+        case spitfire:
+                /* UltraSPARC-I/II and derivatives lack a profile
+                 * counter overflow interrupt so we can't make use of
+                 * their hardware currently.
+                 */
+                /* fallthrough */
+        default:
+                err = -ENODEV;
+                goto out_unregister;
+        }
+
+        return nmi_init();
+
+out_unregister:
+        unregister_perf_hsvc();
+        return err;
+}
+
+arch_initcall(pcr_arch_init);
diff --git a/arch/sparc/kernel/process_64.c b/arch/sparc/kernel/process_64.c
index cc8b5604442..a73954b87f0 100644
--- a/arch/sparc/kernel/process_64.c
+++ b/arch/sparc/kernel/process_64.c
@@ -29,6 +29,7 @@
 #include <linux/cpu.h>
 #include <linux/elfcore.h>
 #include <linux/sysrq.h>
+#include <linux/nmi.h>
 
 #include <asm/uaccess.h>
 #include <asm/system.h>
@@ -52,8 +53,10 @@
 
 static void sparc64_yield(int cpu)
 {
-        if (tlb_type != hypervisor)
+        if (tlb_type != hypervisor) {
+                touch_nmi_watchdog();
                 return;
+        }
 
         clear_thread_flag(TIF_POLLING_NRFLAG);
         smp_mb__after_clear_bit();
diff --git a/arch/sparc/kernel/setup_64.c b/arch/sparc/kernel/setup_64.c
index 49d061f4ae9..f2bcfd2967d 100644
--- a/arch/sparc/kernel/setup_64.c
+++ b/arch/sparc/kernel/setup_64.c
@@ -354,6 +354,7 @@ static int show_cpuinfo(struct seq_file *m, void *__unused)
         seq_printf(m, 
                    "cpu\t\t: %s\n"
                    "fpu\t\t: %s\n"
+                   "pmu\t\t: %s\n"
                    "prom\t\t: %s\n"
                    "type\t\t: %s\n"
                    "ncpus probed\t: %d\n"
@@ -366,6 +367,7 @@ static int show_cpuinfo(struct seq_file *m, void *__unused)
                    ,
                    sparc_cpu_type,
                    sparc_fpu_type,
+                   sparc_pmu_type,
                    prom_version,
                    ((tlb_type == hypervisor) ?
                     "sun4v" :
diff --git a/arch/sparc/kernel/time_64.c b/arch/sparc/kernel/time_64.c
index 2db3c2229b9..db310aa0018 100644
--- a/arch/sparc/kernel/time_64.c
+++ b/arch/sparc/kernel/time_64.c
@@ -729,7 +729,7 @@ void timer_interrupt(int irq, struct pt_regs *regs)
 
         irq_enter();
 
-        kstat_this_cpu.irqs[0]++;
+        kstat_incr_irqs_this_cpu(0, irq_to_desc(0));
 
         if (unlikely(!evt->event_handler)) {
                 printk(KERN_WARNING
diff --git a/arch/sparc/kernel/ttable.S b/arch/sparc/kernel/ttable.S
index ea925503b42..d9bdfb9d5c1 100644
--- a/arch/sparc/kernel/ttable.S
+++ b/arch/sparc/kernel/ttable.S
@@ -63,7 +63,8 @@ tl0_irq6:	TRAP_IRQ(smp_call_function_single_client, 6)
 #else
 tl0_irq6:       BTRAP(0x46)
 #endif
-tl0_irq7:       BTRAP(0x47) BTRAP(0x48) BTRAP(0x49)
+tl0_irq7:       TRAP_IRQ(deferred_pcr_work_irq, 7)
+tl0_irq8:       BTRAP(0x48) BTRAP(0x49)
 tl0_irq10:      BTRAP(0x4a) BTRAP(0x4b) BTRAP(0x4c) BTRAP(0x4d)
 tl0_irq14:      TRAP_IRQ(timer_interrupt, 14)
 tl0_irq15:      TRAP_NMI_IRQ(perfctr_irq, 15)
diff --git a/arch/sparc/lib/GENbzero.S b/arch/sparc/lib/GENbzero.S
index 6a4f956a2f7..8e7a843ddd8 100644
--- a/arch/sparc/lib/GENbzero.S
+++ b/arch/sparc/lib/GENbzero.S
@@ -6,13 +6,9 @@
 
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/GENcopy_from_user.S b/arch/sparc/lib/GENcopy_from_user.S
index 2b9df99e87f..b7d0bd6b140 100644
--- a/arch/sparc/lib/GENcopy_from_user.S
+++ b/arch/sparc/lib/GENcopy_from_user.S
@@ -5,13 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/GENcopy_to_user.S b/arch/sparc/lib/GENcopy_to_user.S
index bb3f7084daf..780550e1afc 100644
--- a/arch/sparc/lib/GENcopy_to_user.S
+++ b/arch/sparc/lib/GENcopy_to_user.S
@@ -5,13 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -31,7 +27,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NG2copy_from_user.S b/arch/sparc/lib/NG2copy_from_user.S
index c77ef5f2210..119ccb9a54f 100644
--- a/arch/sparc/lib/NG2copy_from_user.S
+++ b/arch/sparc/lib/NG2copy_from_user.S
@@ -5,14 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one_asi;\
         .text;                  \
         .align 4;
 
@@ -33,7 +28,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NG2copy_to_user.S b/arch/sparc/lib/NG2copy_to_user.S
index 4bd4093acbb..7fe1ccefd9d 100644
--- a/arch/sparc/lib/NG2copy_to_user.S
+++ b/arch/sparc/lib/NG2copy_to_user.S
@@ -5,14 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one_asi;\
         .text;                  \
         .align 4;
 
@@ -42,7 +37,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NGbzero.S b/arch/sparc/lib/NGbzero.S
index 814d5f7a45e..beab29bf419 100644
--- a/arch/sparc/lib/NGbzero.S
+++ b/arch/sparc/lib/NGbzero.S
@@ -6,13 +6,9 @@
 
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/NGcopy_from_user.S b/arch/sparc/lib/NGcopy_from_user.S
index e7f433f71b4..5d1e4d1ac21 100644
--- a/arch/sparc/lib/NGcopy_from_user.S
+++ b/arch/sparc/lib/NGcopy_from_user.S
@@ -5,14 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        ret;                    \
-         restore %g0, 1, %o0;   \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __ret_one_asi;\
         .text;                  \
         .align 4;
 
@@ -30,7 +25,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/NGcopy_to_user.S b/arch/sparc/lib/NGcopy_to_user.S
index 6ea01c5532a..ff630dcb273 100644
--- a/arch/sparc/lib/NGcopy_to_user.S
+++ b/arch/sparc/lib/NGcopy_to_user.S
@@ -5,14 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     wr      %g0, ASI_AIUS, %asi;\
-        ret;                    \
-         restore %g0, 1, %o0;   \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __ret_one_asi;\
         .text;                  \
         .align 4;
 
@@ -33,7 +28,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop
 #endif
 
diff --git a/arch/sparc/lib/U1copy_from_user.S b/arch/sparc/lib/U1copy_from_user.S
index 3192b0bf4fa..a6ae2ea04bf 100644
--- a/arch/sparc/lib/U1copy_from_user.S
+++ b/arch/sparc/lib/U1copy_from_user.S
@@ -5,13 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop;                                           \
 
 #include "U1memcpy.S"
diff --git a/arch/sparc/lib/U1copy_to_user.S b/arch/sparc/lib/U1copy_to_user.S
index d1210ffb0b8..f4b970eeb48 100644
--- a/arch/sparc/lib/U1copy_to_user.S
+++ b/arch/sparc/lib/U1copy_to_user.S
@@ -5,13 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop;                                           \
 
 #include "U1memcpy.S"
diff --git a/arch/sparc/lib/U3copy_from_user.S b/arch/sparc/lib/U3copy_from_user.S
index f5bfc8d9d21..b1acd1331c3 100644
--- a/arch/sparc/lib/U3copy_from_user.S
+++ b/arch/sparc/lib/U3copy_from_user.S
@@ -5,13 +5,9 @@
 
 #define EX_LD(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/U3copy_to_user.S b/arch/sparc/lib/U3copy_to_user.S
index 2334f111bb0..ef1e493afdf 100644
--- a/arch/sparc/lib/U3copy_to_user.S
+++ b/arch/sparc/lib/U3copy_to_user.S
@@ -5,13 +5,9 @@
 
 #define EX_ST(x)                \
 98:     x;                      \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    1, %o0;         \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -27,7 +23,7 @@
 #define PREAMBLE                                        \
         rd              %asi, %g1;                      \
         cmp             %g1, ASI_AIUS;                  \
-        bne,pn          %icc, memcpy_user_stub;         \
+        bne,pn          %icc, ___copy_in_user;          \
          nop;                                           \
 
 #include "U3memcpy.S"
diff --git a/arch/sparc/lib/bzero.S b/arch/sparc/lib/bzero.S
index c7bbae8c590..b6557297440 100644
--- a/arch/sparc/lib/bzero.S
+++ b/arch/sparc/lib/bzero.S
@@ -88,13 +88,9 @@ __bzero_done:
 
 #define EX_ST(x,y)              \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov    %o1, %o0;       \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_o1;   \
         .text;                  \
         .align 4;
 
diff --git a/arch/sparc/lib/copy_in_user.S b/arch/sparc/lib/copy_in_user.S
index 650af3f21f7..302c0e60dc2 100644
--- a/arch/sparc/lib/copy_in_user.S
+++ b/arch/sparc/lib/copy_in_user.S
@@ -3,19 +3,16 @@
  * Copyright (C) 1999, 2000, 2004 David S. Miller (davem@redhat.com)
  */
 
+#include <linux/linkage.h>
 #include <asm/asi.h>
 
 #define XCC xcc
 
 #define EX(x,y)                 \
 98:     x,y;                    \
-        .section .fixup;        \
-        .align 4;               \
-99:     retl;                   \
-         mov 1, %o0;            \
         .section __ex_table,"a";\
         .align 4;               \
-        .word 98b, 99b;         \
+        .word 98b, __retl_one;  \
         .text;                  \
         .align 4;
 
@@ -31,18 +28,7 @@
          * to copy register windows around during thread cloning.
          */
 
-        .globl          ___copy_in_user
-        .type           ___copy_in_user,#function
-___copy_in_user:        /* %o0=dst, %o1=src, %o2=len */
-        /* Writing to %asi is _expensive_ so we hardcode it.
-         * Reading %asi to check for KERNEL_DS is comparatively
-         * cheap.
-         */
-        rd              %asi, %g1
-        cmp             %g1, ASI_AIUS
-        bne,pn          %icc, memcpy_user_stub
-         nop
-
+ENTRY(___copy_in_user)  /* %o0=dst, %o1=src, %o2=len */
         cmp             %o2, 0
         be,pn           %XCC, 85f
          or             %o0, %o1, %o3
@@ -53,22 +39,24 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
         /* 16 < len <= 64 */
         andcc           %o3, 0x7, %g0
         bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         nop
 
         andn            %o2, 0x7, %o4
         and             %o2, 0x7, %o2
 1:      subcc           %o4, 0x8, %o4
         EX(ldxa [%o1] %asi, %o5)
-        EX(stxa %o5, [%o1 + %o3] ASI_AIUS)
+        EX(stxa %o5, [%o0] %asi)
+        add             %o1, 0x8, %o1
         bgu,pt          %XCC, 1b
-         add            %o1, 0x8, %o1
+         add            %o0, 0x8, %o0
         andcc           %o2, 0x4, %g0
         be,pt           %XCC, 1f
          nop
         sub             %o2, 0x4, %o2
         EX(lduwa [%o1] %asi, %o5)
-        EX(stwa %o5, [%o1 + %o3] ASI_AIUS)
+        EX(stwa %o5, [%o0] %asi)
         add             %o1, 0x4, %o1
+        add             %o0, 0x4, %o0
 1:      cmp             %o2, 0
         be,pt           %XCC, 85f
          nop
@@ -78,14 +66,15 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 80:     /* 0 < len <= 16 */
         andcc           %o3, 0x3, %g0
         bne,pn          %XCC, 90f
-         sub            %o0, %o1, %o3
+         nop
 
 82:
         subcc           %o2, 4, %o2
         EX(lduwa [%o1] %asi, %g1)
-        EX(stwa %g1, [%o1 + %o3] ASI_AIUS)
+        EX(stwa %g1, [%o0] %asi)
+        add             %o1, 4, %o1
         bgu,pt          %XCC, 82b
-         add            %o1, 4, %o1
+         add            %o0, 4, %o0
 
 85:     retl
          clr            %o0
@@ -94,26 +83,10 @@ ___copy_in_user:	/* %o0=dst, %o1=src, %o2=len */
 90:
         subcc           %o2, 1, %o2
         EX(lduba [%o1] %asi, %g1)
-        EX(stba %g1, [%o1 + %o3] ASI_AIUS)
+        EX(stba %g1, [%o0] %asi)
+        add             %o1, 1, %o1
         bgu,pt          %XCC, 90b
-         add            %o1, 1, %o1
+         add            %o0, 1, %o0
         retl
          clr            %o0
-
-        .size           ___copy_in_user, .-___copy_in_user
-
-        /* Act like copy_{to,in}_user(), ie. return zero instead
-         * of original destination pointer.  This is invoked when
-         * copy_{to,in}_user() finds that %asi is kernel space.
-         */
-        .globl          memcpy_user_stub
-        .type           memcpy_user_stub,#function
-memcpy_user_stub:
-        save            %sp, -192, %sp
-        mov             %i0, %o0
-        mov             %i1, %o1
-        call            memcpy
-         mov            %i2, %o2
-        ret
-         restore        %g0, %g0, %o0
-        .size           memcpy_user_stub, .-memcpy_user_stub
+ENDPROC(___copy_in_user)
diff --git a/arch/sparc/mm/fault_64.c b/arch/sparc/mm/fault_64.c
index a9e474bf638..4ab8993b086 100644
--- a/arch/sparc/mm/fault_64.c
+++ b/arch/sparc/mm/fault_64.c
@@ -19,6 +19,7 @@
 #include <linux/interrupt.h>
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
+#include <linux/percpu.h>
 
 #include <asm/page.h>
 #include <asm/pgtable.h>
@@ -224,6 +225,30 @@ cannot_handle:
         unhandled_fault (address, current, regs);
 }
 
+static void noinline bogus_32bit_fault_tpc(struct pt_regs *regs)
+{
+        static int times;
+
+        if (times++ < 10)
+                printk(KERN_ERR "FAULT[%s:%d]: 32-bit process reports "
+                       "64-bit TPC [%lx]\n",
+                       current->comm, current->pid,
+                       regs->tpc);
+        show_regs(regs);
+}
+
+static void noinline bogus_32bit_fault_address(struct pt_regs *regs,
+                                               unsigned long addr)
+{
+        static int times;
+
+        if (times++ < 10)
+                printk(KERN_ERR "FAULT[%s:%d]: 32-bit process "
+                       "reports 64-bit fault address [%lx]\n",
+                       current->comm, current->pid, addr);
+        show_regs(regs);
+}
+
 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
 {
         struct mm_struct *mm = current->mm;
@@ -244,6 +269,19 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
             (fault_code & FAULT_CODE_DTLB))
                 BUG();
 
+        if (test_thread_flag(TIF_32BIT)) {
+                if (!(regs->tstate & TSTATE_PRIV)) {
+                        if (unlikely((regs->tpc >> 32) != 0)) {
+                                bogus_32bit_fault_tpc(regs);
+                                goto intr_or_no_mm;
+                        }
+                }
+                if (unlikely((address >> 32) != 0)) {
+                        bogus_32bit_fault_address(regs, address);
+                        goto intr_or_no_mm;
+                }
+        }
+
         if (regs->tstate & TSTATE_PRIV) {
                 unsigned long tpc = regs->tpc;
 
@@ -264,12 +302,6 @@ asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
         if (in_atomic() || !mm)
                 goto intr_or_no_mm;
 
-        if (test_thread_flag(TIF_32BIT)) {
-                if (!(regs->tstate & TSTATE_PRIV))
-                        regs->tpc &= 0xffffffff;
-                address &= 0xffffffff;
-        }
-
         if (!down_read_trylock(&mm->mmap_sem)) {
                 if ((regs->tstate & TSTATE_PRIV) &&
                     !search_exception_tables(regs->tpc)) {
diff --git a/arch/sparc/oprofile/init.c b/arch/sparc/oprofile/init.c
index d6e170c074f..d172f86439b 100644
--- a/arch/sparc/oprofile/init.c
+++ b/arch/sparc/oprofile/init.c
@@ -13,217 +13,57 @@
 #include <linux/init.h>
  
 #ifdef CONFIG_SPARC64
-#include <asm/hypervisor.h>
-#include <asm/spitfire.h>
-#include <asm/cpudata.h>
-#include <asm/irq.h>
+#include <linux/notifier.h>
+#include <linux/rcupdate.h>
+#include <linux/kdebug.h>
+#include <asm/nmi.h>
 
-static int nmi_enabled;
-
-struct pcr_ops {
-        u64 (*read)(void);
-        void (*write)(u64);
-};
-static const struct pcr_ops *pcr_ops;
-
-static u64 direct_pcr_read(void)
-{
-        u64 val;
-
-        read_pcr(val);
-        return val;
-}
-
-static void direct_pcr_write(u64 val)
-{
-        write_pcr(val);
-}
-
-static const struct pcr_ops direct_pcr_ops = {
-        .read   = direct_pcr_read,
-        .write  = direct_pcr_write,
-};
-
-static void n2_pcr_write(u64 val)
+static int profile_timer_exceptions_notify(struct notifier_block *self,
+                                           unsigned long val, void *data)
 {
-        unsigned long ret;
-
-        ret = sun4v_niagara2_setperf(HV_N2_PERF_SPARC_CTL, val);
-        if (val != HV_EOK)
-                write_pcr(val);
-}
-
-static const struct pcr_ops n2_pcr_ops = {
-        .read   = direct_pcr_read,
-        .write  = n2_pcr_write,
-};
-
-/* In order to commonize as much of the implementation as
- * possible, we use PICH as our counter.  Mostly this is
- * to accomodate Niagara-1 which can only count insn cycles
- * in PICH.
- */
-static u64 picl_value(void)
-{
-        u32 delta = local_cpu_data().clock_tick / HZ;
-
-        return ((u64)((0 - delta) & 0xffffffff)) << 32;
-}
-
-#define PCR_PIC_PRIV            0x00000001 /* PIC access is privileged */
-#define PCR_STRACE              0x00000002 /* Trace supervisor events  */
-#define PCR_UTRACE              0x00000004 /* Trace user events        */
-#define PCR_N2_HTRACE           0x00000008 /* Trace hypervisor events  */
-#define PCR_N2_TOE_OV0          0x00000010 /* Trap if PIC 0 overflows  */
-#define PCR_N2_TOE_OV1          0x00000020 /* Trap if PIC 1 overflows  */
-#define PCR_N2_MASK0            0x00003fc0
-#define PCR_N2_MASK0_SHIFT      6
-#define PCR_N2_SL0              0x0003c000
-#define PCR_N2_SL0_SHIFT        14
-#define PCR_N2_OV0              0x00040000
-#define PCR_N2_MASK1            0x07f80000
-#define PCR_N2_MASK1_SHIFT      19
-#define PCR_N2_SL1              0x78000000
-#define PCR_N2_SL1_SHIFT        27
-#define PCR_N2_OV1              0x80000000
-
-#define PCR_SUN4U_ENABLE        (PCR_PIC_PRIV | PCR_STRACE | PCR_UTRACE)
-#define PCR_N2_ENABLE           (PCR_PIC_PRIV | PCR_STRACE | PCR_UTRACE | \
-                                 PCR_N2_TOE_OV1 | \
-                                 (2 << PCR_N2_SL1_SHIFT) | \
-                                 (0xff << PCR_N2_MASK1_SHIFT))
-
-static u64 pcr_enable = PCR_SUN4U_ENABLE;
-
-static void nmi_handler(struct pt_regs *regs)
-{
-        pcr_ops->write(PCR_PIC_PRIV);
-
-        if (nmi_enabled) {
-                oprofile_add_sample(regs, 0);
-
-                write_pic(picl_value());
-                pcr_ops->write(pcr_enable);
-        }
-}
-
-/* We count "clock cycle" events in the lower 32-bit PIC.
- * Then configure it such that it overflows every HZ, and thus
- * generates a level 15 interrupt at that frequency.
- */
-static void cpu_nmi_start(void *_unused)
-{
-        pcr_ops->write(PCR_PIC_PRIV);
-        write_pic(picl_value());
-
-        pcr_ops->write(pcr_enable);
-}
+        struct die_args *args = (struct die_args *)data;
+        int ret = NOTIFY_DONE;
 
-static void cpu_nmi_stop(void *_unused)
-{
-        pcr_ops->write(PCR_PIC_PRIV);
-}
-
-static int nmi_start(void)
-{
-        int err = register_perfctr_intr(nmi_handler);
-
-        if (!err) {
-                nmi_enabled = 1;
-                wmb();
-                err = on_each_cpu(cpu_nmi_start, NULL, 1);
-                if (err) {
-                        nmi_enabled = 0;
-                        wmb();
-                        on_each_cpu(cpu_nmi_stop, NULL, 1);
-                        release_perfctr_intr(nmi_handler);
-                }
+        switch (val) {
+        case DIE_NMI:
+                oprofile_add_sample(args->regs, 0);
+                ret = NOTIFY_STOP;
+                break;
+        default:
+                break;
         }
-
-        return err;
-}
-
-static void nmi_stop(void)
-{
-        nmi_enabled = 0;
-        wmb();
-
-        on_each_cpu(cpu_nmi_stop, NULL, 1);
-        release_perfctr_intr(nmi_handler);
-        synchronize_sched();
+        return ret;
 }
 
-static unsigned long perf_hsvc_group;
-static unsigned long perf_hsvc_major;
-static unsigned long perf_hsvc_minor;
+static struct notifier_block profile_timer_exceptions_nb = {
+        .notifier_call  = profile_timer_exceptions_notify,
+};
 
-static int __init register_perf_hsvc(void)
+static int timer_start(void)
 {
-        if (tlb_type == hypervisor) {
-                switch (sun4v_chip_type) {
-                case SUN4V_CHIP_NIAGARA1:
-                        perf_hsvc_group = HV_GRP_NIAG_PERF;
-                        break;
-
-                case SUN4V_CHIP_NIAGARA2:
-                        perf_hsvc_group = HV_GRP_N2_CPU;
-                        break;
-
-                default:
-                        return -ENODEV;
-                }
-
-
-                perf_hsvc_major = 1;
-                perf_hsvc_minor = 0;
-                if (sun4v_hvapi_register(perf_hsvc_group,
-                                         perf_hsvc_major,
-                                         &perf_hsvc_minor)) {
-                        printk("perfmon: Could not register N2 hvapi.\n");
-                        return -ENODEV;
-                }
-        }
+        if (register_die_notifier(&profile_timer_exceptions_nb))
+                return 1;
+        nmi_adjust_hz(HZ);
         return 0;
 }
 
-static void unregister_perf_hsvc(void)
+
+static void timer_stop(void)
 {
-        if (tlb_type != hypervisor)
-                return;
-        sun4v_hvapi_unregister(perf_hsvc_group);
+        nmi_adjust_hz(1);
+        unregister_die_notifier(&profile_timer_exceptions_nb);
+        synchronize_sched();  /* Allow already-started NMIs to complete. */
 }
 
-static int oprofile_nmi_init(struct oprofile_operations *ops)
+static int op_nmi_timer_init(struct oprofile_operations *ops)
 {
-        int err = register_perf_hsvc();
-
-        if (err)
-                return err;
-
-        switch (tlb_type) {
-        case hypervisor:
-                pcr_ops = &n2_pcr_ops;
-                pcr_enable = PCR_N2_ENABLE;
-                break;
-
-        case cheetah:
-        case cheetah_plus:
-                pcr_ops = &direct_pcr_ops;
-                break;
-
-        default:
+        if (!nmi_usable)
                 return -ENODEV;
-        }
 
-        ops->create_files = NULL;
-        ops->setup = NULL;
-        ops->shutdown = NULL;
-        ops->start = nmi_start;
-        ops->stop = nmi_stop;
+        ops->start = timer_start;
+        ops->stop = timer_stop;
         ops->cpu_type = "timer";
-
-        printk(KERN_INFO "oprofile: Using perfctr based NMI timer interrupt.\n");
-
+        printk(KERN_INFO "oprofile: Using perfctr NMI timer interrupt.\n");
         return 0;
 }
 #endif
@@ -233,7 +73,7 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         int ret = -ENODEV;
 
 #ifdef CONFIG_SPARC64
-        ret = oprofile_nmi_init(ops);
+        ret = op_nmi_timer_init(ops);
         if (!ret)
                 return ret;
 #endif
@@ -241,10 +81,6 @@ int __init oprofile_arch_init(struct oprofile_operations *ops)
         return ret;
 }
 
-
 void oprofile_arch_exit(void)
 {
-#ifdef CONFIG_SPARC64
-        unregister_perf_hsvc();
-#endif
 }
diff --git a/arch/x86/Kconfig b/arch/x86/Kconfig
index 73f7fe8fd4d..1042d69b267 100644
--- a/arch/x86/Kconfig
+++ b/arch/x86/Kconfig
@@ -5,7 +5,7 @@ mainmenu "Linux Kernel Configuration for x86"
 config 64BIT
         bool "64-bit kernel" if ARCH = "x86"
         default ARCH = "x86_64"
-        help
+        ---help---
           Say yes to build a 64-bit kernel - formerly known as x86_64
           Say no to build a 32-bit kernel - formerly known as i386
 
@@ -34,8 +34,8 @@ config X86
         select HAVE_FUNCTION_TRACER
         select HAVE_FUNCTION_GRAPH_TRACER
         select HAVE_FUNCTION_TRACE_MCOUNT_TEST
-        select HAVE_KVM if ((X86_32 && !X86_VOYAGER && !X86_VISWS && !X86_NUMAQ) || X86_64)
-        select HAVE_ARCH_KGDB if !X86_VOYAGER
+        select HAVE_KVM
+        select HAVE_ARCH_KGDB
         select HAVE_ARCH_TRACEHOOK
         select HAVE_GENERIC_DMA_COHERENT if X86_32
         select HAVE_EFFICIENT_UNALIGNED_ACCESS
@@ -133,18 +133,16 @@ config ARCH_HAS_CACHE_LINE_SIZE
         def_bool y
 
 config HAVE_SETUP_PER_CPU_AREA
-        def_bool X86_64_SMP || (X86_SMP && !X86_VOYAGER)
+        def_bool y
 
 config HAVE_CPUMASK_OF_CPU_MAP
         def_bool X86_64_SMP
 
 config ARCH_HIBERNATION_POSSIBLE
         def_bool y
-        depends on !SMP || !X86_VOYAGER
 
 config ARCH_SUSPEND_POSSIBLE
         def_bool y
-        depends on !X86_VOYAGER
 
 config ZONE_DMA32
         bool
@@ -174,11 +172,6 @@ config GENERIC_PENDING_IRQ
         depends on GENERIC_HARDIRQS && SMP
         default y
 
-config X86_SMP
-        bool
-        depends on SMP && ((X86_32 && !X86_VOYAGER) || X86_64)
-        default y
-
 config USE_GENERIC_SMP_HELPERS
         def_bool y
         depends on SMP
@@ -194,19 +187,17 @@ config X86_64_SMP
 config X86_HT
         bool
         depends on SMP
-        depends on (X86_32 && !X86_VOYAGER) || X86_64
-        default y
-
-config X86_BIOS_REBOOT
-        bool
-        depends on !X86_VOYAGER
         default y
 
 config X86_TRAMPOLINE
         bool
-        depends on X86_SMP || (X86_VOYAGER && SMP) || (64BIT && ACPI_SLEEP)
+        depends on SMP || (64BIT && ACPI_SLEEP)
         default y
 
+config X86_32_LAZY_GS
+        def_bool y
+        depends on X86_32 && !CC_STACKPROTECTOR
+
 config KTIME_SCALAR
         def_bool X86_32
 source "init/Kconfig"
@@ -244,14 +235,10 @@ config SMP
 
           If you don't know what to do here, say N.
 
-config X86_HAS_BOOT_CPU_ID
-        def_bool y
-        depends on X86_VOYAGER
-
 config SPARSE_IRQ
         bool "Support sparse irq numbering"
         depends on PCI_MSI || HT_IRQ
-        help
+        ---help---
           This enables support for sparse irqs. This is useful for distro
           kernels that want to define a high CONFIG_NR_CPUS value but still
           want to have low kernel memory footprint on smaller machines.
@@ -265,137 +252,154 @@ config NUMA_MIGRATE_IRQ_DESC
         bool "Move irq desc when changing irq smp_affinity"
         depends on SPARSE_IRQ && NUMA
         default n
-        help
+        ---help---
           This enables moving irq_desc to cpu/node that irq will use handled.
 
           If you don't know what to do here, say N.
 
-config X86_FIND_SMP_CONFIG
-        def_bool y
-        depends on X86_MPPARSE || X86_VOYAGER
-
 config X86_MPPARSE
         bool "Enable MPS table" if ACPI
         default y
         depends on X86_LOCAL_APIC
-        help
+        ---help---
           For old smp systems that do not have proper acpi support. Newer systems
           (esp with 64bit cpus) with acpi support, MADT and DSDT will override it
 
-choice
-        prompt "Subarchitecture Type"
-        default X86_PC
+config X86_BIGSMP
+        bool "Support for big SMP systems with more than 8 CPUs"
+        depends on X86_32 && SMP
+        ---help---
+          This option is needed for the systems that have more than 8 CPUs
 
-config X86_PC
-        bool "PC-compatible"
-        help
-          Choose this option if your computer is a standard PC or compatible.
+config X86_EXTENDED_PLATFORM
+        bool "Support for extended (non-PC) x86 platforms"
+        default y
+        ---help---
+          If you disable this option then the kernel will only support
+          standard PC platforms. (which covers the vast majority of
+          systems out there.)
+
+          If you enable this option then you'll be able to select a number
+          of non-PC x86 platforms.
+
+          If you have one of these systems, or if you want to build a
+          generic distribution kernel, say Y here - otherwise say N.
+
+# This is an alphabetically sorted list of 64 bit extended platforms
+# Please maintain the alphabetic order if and when there are additions
+
+config X86_VSMP
+        bool "ScaleMP vSMP"
+        select PARAVIRT
+        depends on X86_64 && PCI
+        depends on X86_EXTENDED_PLATFORM
+        ---help---
+          Support for ScaleMP vSMP systems.  Say 'Y' here if this kernel is
+          supposed to run on these EM64T-based machines.  Only choose this option
+          if you have one of these machines.
+
+config X86_UV
+        bool "SGI Ultraviolet"
+        depends on X86_64
+        depends on X86_EXTENDED_PLATFORM
+        ---help---
+          This option is needed in order to support SGI Ultraviolet systems.
+          If you don't have one of these, you should say N here.
+
+# Following is an alphabetically sorted list of 32 bit extended platforms
+# Please maintain the alphabetic order if and when there are additions
 
 config X86_ELAN
         bool "AMD Elan"
         depends on X86_32
-        help
+        depends on X86_EXTENDED_PLATFORM
+        ---help---
           Select this for an AMD Elan processor.
 
           Do not use this option for K6/Athlon/Opteron processors!
 
           If unsure, choose "PC-compatible" instead.
 
-config X86_VOYAGER
-        bool "Voyager (NCR)"
-        depends on X86_32 && (SMP || BROKEN) && !PCI
-        help
-          Voyager is an MCA-based 32-way capable SMP architecture proprietary
-          to NCR Corp.  Machine classes 345x/35xx/4100/51xx are Voyager-based.
-
-          *** WARNING ***
-
-          If you do not specifically know you have a Voyager based machine,
-          say N here, otherwise the kernel you build will not be bootable.
-
-config X86_GENERICARCH
-       bool "Generic architecture"
+config X86_RDC321X
+        bool "RDC R-321x SoC"
         depends on X86_32
-       help
-          This option compiles in the NUMAQ, Summit, bigsmp, ES7000, default
+        depends on X86_EXTENDED_PLATFORM
+        select M486
+        select X86_REBOOTFIXUPS
+        ---help---
+          This option is needed for RDC R-321x system-on-chip, also known
+          as R-8610-(G).
+          If you don't have one of these chips, you should say N here.
+
+config X86_32_NON_STANDARD
+        bool "Support non-standard 32-bit SMP architectures"
+        depends on X86_32 && SMP
+        depends on X86_EXTENDED_PLATFORM
+        ---help---
+          This option compiles in the NUMAQ, Summit, bigsmp, ES7000, default
           subarchitectures.  It is intended for a generic binary kernel.
           if you select them all, kernel will probe it one by one. and will
           fallback to default.
 
-if X86_GENERICARCH
+# Alphabetically sorted list of Non standard 32 bit platforms
 
 config X86_NUMAQ
         bool "NUMAQ (IBM/Sequent)"
-        depends on SMP && X86_32 && PCI && X86_MPPARSE
+        depends on X86_32_NON_STANDARD
         select NUMA
-        help
+        select X86_MPPARSE
+        ---help---
           This option is used for getting Linux to run on a NUMAQ (IBM/Sequent)
           NUMA multiquad box. This changes the way that processors are
           bootstrapped, and uses Clustered Logical APIC addressing mode instead
           of Flat Logical.  You will need a new lynxer.elf file to flash your
           firmware with - send email to <Martin.Bligh@us.ibm.com>.
 
+config X86_VISWS
+        bool "SGI 320/540 (Visual Workstation)"
+        depends on X86_32 && PCI && X86_MPPARSE && PCI_GODIRECT
+        depends on X86_32_NON_STANDARD
+        ---help---
+          The SGI Visual Workstation series is an IA32-based workstation
+          based on SGI systems chips with some legacy PC hardware attached.
+
+          Say Y here to create a kernel to run on the SGI 320 or 540.
+
+          A kernel compiled for the Visual Workstation will run on general
+          PCs as well. See <file:Documentation/sgi-visws.txt> for details.
+
 config X86_SUMMIT
         bool "Summit/EXA (IBM x440)"
-        depends on X86_32 && SMP
-        help
+        depends on X86_32_NON_STANDARD
+        ---help---
           This option is needed for IBM systems that use the Summit/EXA chipset.
           In particular, it is needed for the x440.
 
 config X86_ES7000
-        bool "Support for Unisys ES7000 IA32 series"
-        depends on X86_32 && SMP
-        help
+        bool "Unisys ES7000 IA32 series"
+        depends on X86_32_NON_STANDARD && X86_BIGSMP
+        ---help---
           Support for Unisys ES7000 systems.  Say 'Y' here if this kernel is
           supposed to run on an IA32-based Unisys ES7000 system.
 
-config X86_BIGSMP
-        bool "Support for big SMP systems with more than 8 CPUs"
-        depends on X86_32 && SMP
-        help
-          This option is needed for the systems that have more than 8 CPUs
-          and if the system is not of any sub-arch type above.
-
-endif
-
-config X86_VSMP
-        bool "Support for ScaleMP vSMP"
-        select PARAVIRT
-        depends on X86_64 && PCI
-        help
-          Support for ScaleMP vSMP systems.  Say 'Y' here if this kernel is
-          supposed to run on these EM64T-based machines.  Only choose this option
-          if you have one of these machines.
-
-endchoice
-
-config X86_VISWS
-        bool "SGI 320/540 (Visual Workstation)"
-        depends on X86_32 && PCI && !X86_VOYAGER && X86_MPPARSE && PCI_GODIRECT
-        help
-          The SGI Visual Workstation series is an IA32-based workstation
-          based on SGI systems chips with some legacy PC hardware attached.
-
-          Say Y here to create a kernel to run on the SGI 320 or 540.
+config X86_VOYAGER
+        bool "Voyager (NCR)"
+        depends on SMP && !PCI && BROKEN
+        depends on X86_32_NON_STANDARD
+        ---help---
+          Voyager is an MCA-based 32-way capable SMP architecture proprietary
+          to NCR Corp.  Machine classes 345x/35xx/4100/51xx are Voyager-based.
 
-          A kernel compiled for the Visual Workstation will run on general
-          PCs as well. See <file:Documentation/sgi-visws.txt> for details.
+          *** WARNING ***
 
-config X86_RDC321X
-        bool "RDC R-321x SoC"
-        depends on X86_32
-        select M486
-        select X86_REBOOTFIXUPS
-        help
-          This option is needed for RDC R-321x system-on-chip, also known
-          as R-8610-(G).
-          If you don't have one of these chips, you should say N here.
+          If you do not specifically know you have a Voyager based machine,
+          say N here, otherwise the kernel you build will not be bootable.
 
 config SCHED_OMIT_FRAME_POINTER
         def_bool y
         prompt "Single-depth WCHAN output"
         depends on X86
-        help
+        ---help---
           Calculate simpler /proc/<PID>/wchan values. If this option
           is disabled then wchan values will recurse back to the
           caller function. This provides more accurate wchan values,
@@ -405,7 +409,7 @@ config SCHED_OMIT_FRAME_POINTER
 
 menuconfig PARAVIRT_GUEST
         bool "Paravirtualized guest support"
-        help
+        ---help---
           Say Y here to get to see options related to running Linux under
           various hypervisors.  This option alone does not add any kernel code.
 
@@ -419,8 +423,7 @@ config VMI
         bool "VMI Guest support"
         select PARAVIRT
         depends on X86_32
-        depends on !X86_VOYAGER
-        help
+        ---help---
           VMI provides a paravirtualized interface to the VMware ESX server
           (it could be used by other hypervisors in theory too, but is not
           at the moment), by linking the kernel to a GPL-ed ROM module
@@ -430,8 +433,7 @@ config KVM_CLOCK
         bool "KVM paravirtualized clock"
         select PARAVIRT
         select PARAVIRT_CLOCK
-        depends on !X86_VOYAGER
-        help
+        ---help---
           Turning on this option will allow you to run a paravirtualized clock
           when running over the KVM hypervisor. Instead of relying on a PIT
           (or probably other) emulation by the underlying device model, the host
@@ -441,17 +443,15 @@ config KVM_CLOCK
 config KVM_GUEST
         bool "KVM Guest support"
         select PARAVIRT
-        depends on !X86_VOYAGER
-        help
-         This option enables various optimizations for running under the KVM
-         hypervisor.
+        ---help---
+          This option enables various optimizations for running under the KVM
+          hypervisor.
 
 source "arch/x86/lguest/Kconfig"
 
 config PARAVIRT
         bool "Enable paravirtualization code"
-        depends on !X86_VOYAGER
-        help
+        ---help---
           This changes the kernel so it can modify itself when it is run
           under a hypervisor, potentially improving performance significantly
           over full virtualization.  However, when run without a hypervisor
@@ -464,51 +464,51 @@ config PARAVIRT_CLOCK
 endif
 
 config PARAVIRT_DEBUG
-       bool "paravirt-ops debugging"
-       depends on PARAVIRT && DEBUG_KERNEL
-       help
-         Enable to debug paravirt_ops internals.  Specifically, BUG if
-         a paravirt_op is missing when it is called.
+        bool "paravirt-ops debugging"
+        depends on PARAVIRT && DEBUG_KERNEL
+        ---help---
+          Enable to debug paravirt_ops internals.  Specifically, BUG if
+          a paravirt_op is missing when it is called.
 
 config MEMTEST
         bool "Memtest"
-        help
+        ---help---
           This option adds a kernel parameter 'memtest', which allows memtest
           to be set.
-                memtest=0, mean disabled; -- default
-                memtest=1, mean do 1 test pattern;
-                ...
-                memtest=4, mean do 4 test patterns.
+                memtest=0, mean disabled; -- default
+                memtest=1, mean do 1 test pattern;
+                ...
+                memtest=4, mean do 4 test patterns.
           If you are unsure how to answer this question, answer N.
 
 config X86_SUMMIT_NUMA
         def_bool y
-        depends on X86_32 && NUMA && X86_GENERICARCH
+        depends on X86_32 && NUMA && X86_32_NON_STANDARD
 
 config X86_CYCLONE_TIMER
         def_bool y
-        depends on X86_GENERICARCH
+        depends on X86_32_NON_STANDARD
 
 source "arch/x86/Kconfig.cpu"
 
 config HPET_TIMER
         def_bool X86_64
         prompt "HPET Timer Support" if X86_32
-        help
-         Use the IA-PC HPET (High Precision Event Timer) to manage
-         time in preference to the PIT and RTC, if a HPET is
-         present.
-         HPET is the next generation timer replacing legacy 8254s.
-         The HPET provides a stable time base on SMP
-         systems, unlike the TSC, but it is more expensive to access,
-         as it is off-chip.  You can find the HPET spec at
-         <http://www.intel.com/hardwaredesign/hpetspec_1.pdf>.
+        ---help---
+          Use the IA-PC HPET (High Precision Event Timer) to manage
+          time in preference to the PIT and RTC, if a HPET is
+          present.
+          HPET is the next generation timer replacing legacy 8254s.
+          The HPET provides a stable time base on SMP
+          systems, unlike the TSC, but it is more expensive to access,
+          as it is off-chip.  You can find the HPET spec at
+          <http://www.intel.com/hardwaredesign/hpetspec_1.pdf>.
 
-         You can safely choose Y here.  However, HPET will only be
-         activated if the platform and the BIOS support this feature.
-         Otherwise the 8254 will be used for timing services.
+          You can safely choose Y here.  However, HPET will only be
+          activated if the platform and the BIOS support this feature.
+          Otherwise the 8254 will be used for timing services.
 
-         Choose N to continue using the legacy 8254 timer.
+          Choose N to continue using the legacy 8254 timer.
 
 config HPET_EMULATE_RTC
         def_bool y
@@ -519,7 +519,7 @@ config HPET_EMULATE_RTC
 config DMI
         default y
         bool "Enable DMI scanning" if EMBEDDED
-        help
+        ---help---
           Enabled scanning of DMI to identify machine quirks. Say Y
           here unless you have verified that your setup is not
           affected by entries in the DMI blacklist. Required by PNP
@@ -531,7 +531,7 @@ config GART_IOMMU
         select SWIOTLB
         select AGP
         depends on X86_64 && PCI
-        help
+        ---help---
           Support for full DMA access of devices with 32bit memory access only
           on systems with more than 3GB. This is usually needed for USB,
           sound, many IDE/SATA chipsets and some other devices.
@@ -546,7 +546,7 @@ config CALGARY_IOMMU
         bool "IBM Calgary IOMMU support"
         select SWIOTLB
         depends on X86_64 && PCI && EXPERIMENTAL
-        help
+        ---help---
           Support for hardware IOMMUs in IBM's xSeries x366 and x460
           systems. Needed to run systems with more than 3GB of memory
           properly with 32-bit PCI devices that do not support DAC
@@ -564,7 +564,7 @@ config CALGARY_IOMMU_ENABLED_BY_DEFAULT
         def_bool y
         prompt "Should Calgary be enabled by default?"
         depends on CALGARY_IOMMU
-        help
+        ---help---
           Should Calgary be enabled by default? if you choose 'y', Calgary
           will be used (if it exists). If you choose 'n', Calgary will not be
           used even if it exists. If you choose 'n' and would like to use
@@ -576,7 +576,7 @@ config AMD_IOMMU
         select SWIOTLB
         select PCI_MSI
         depends on X86_64 && PCI && ACPI
-        help
+        ---help---
           With this option you can enable support for AMD IOMMU hardware in
           your system. An IOMMU is a hardware component which provides
           remapping of DMA memory accesses from devices. With an AMD IOMMU you
@@ -591,7 +591,7 @@ config AMD_IOMMU_STATS
         bool "Export AMD IOMMU statistics to debugfs"
         depends on AMD_IOMMU
         select DEBUG_FS
-        help
+        ---help---
           This option enables code in the AMD IOMMU driver to collect various
           statistics about whats happening in the driver and exports that
           information to userspace via debugfs.
@@ -600,7 +600,7 @@ config AMD_IOMMU_STATS
 # need this always selected by IOMMU for the VIA workaround
 config SWIOTLB
         def_bool y if X86_64
-        help
+        ---help---
           Support for software bounce buffers used on x86-64 systems
           which don't have a hardware IOMMU (e.g. the current generation
           of Intel's x86-64 CPUs). Using this PCI devices which can only
@@ -618,7 +618,7 @@ config MAXSMP
         depends on X86_64 && SMP && DEBUG_KERNEL && EXPERIMENTAL
         select CPUMASK_OFFSTACK
         default n
-        help
+        ---help---
           Configure maximum number of CPUS and NUMA Nodes for this architecture.
           If unsure, say N.
 
@@ -629,7 +629,7 @@ config NR_CPUS
         default "4096" if MAXSMP
         default "32" if SMP && (X86_NUMAQ || X86_SUMMIT || X86_BIGSMP || X86_ES7000)
         default "8" if SMP
-        help
+        ---help---
           This allows you to specify the maximum number of CPUs which this
           kernel will support.  The maximum supported value is 512 and the
           minimum value which makes sense is 2.
@@ -640,7 +640,7 @@ config NR_CPUS
 config SCHED_SMT
         bool "SMT (Hyperthreading) scheduler support"
         depends on X86_HT
-        help
+        ---help---
           SMT scheduler support improves the CPU scheduler's decision making
           when dealing with Intel Pentium 4 chips with HyperThreading at a
           cost of slightly increased overhead in some places. If unsure say
@@ -650,7 +650,7 @@ config SCHED_MC
         def_bool y
         prompt "Multi-core scheduler support"
         depends on X86_HT
-        help
+        ---help---
           Multi-core scheduler support improves the CPU scheduler's decision
           making when dealing with multi-core CPU chips at a cost of slightly
           increased overhead in some places. If unsure say N here.
@@ -659,8 +659,8 @@ source "kernel/Kconfig.preempt"
 
 config X86_UP_APIC
         bool "Local APIC support on uniprocessors"
-        depends on X86_32 && !SMP && !(X86_VOYAGER || X86_GENERICARCH)
-        help
+        depends on X86_32 && !SMP && !X86_32_NON_STANDARD
+        ---help---
           A local APIC (Advanced Programmable Interrupt Controller) is an
           integrated interrupt controller in the CPU. If you have a single-CPU
           system which has a processor with a local APIC, you can say Y here to
@@ -673,7 +673,7 @@ config X86_UP_APIC
 config X86_UP_IOAPIC
         bool "IO-APIC support on uniprocessors"
         depends on X86_UP_APIC
-        help
+        ---help---
           An IO-APIC (I/O Advanced Programmable Interrupt Controller) is an
           SMP-capable replacement for PC-style interrupt controllers. Most
           SMP systems and many recent uniprocessor systems have one.
@@ -684,11 +684,11 @@ config X86_UP_IOAPIC
 
 config X86_LOCAL_APIC
         def_bool y
-        depends on X86_64 || (X86_32 && (X86_UP_APIC || (SMP && !X86_VOYAGER) || X86_GENERICARCH))
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
 
 config X86_IO_APIC
         def_bool y
-        depends on X86_64 || (X86_32 && (X86_UP_IOAPIC || (SMP && !X86_VOYAGER) || X86_GENERICARCH))
+        depends on X86_64 || SMP || X86_32_NON_STANDARD || X86_UP_APIC
 
 config X86_VISWS_APIC
         def_bool y
@@ -698,7 +698,7 @@ config X86_REROUTE_FOR_BROKEN_BOOT_IRQS
         bool "Reroute for broken boot IRQs"
         default n
         depends on X86_IO_APIC
-        help
+        ---help---
           This option enables a workaround that fixes a source of
           spurious interrupts. This is recommended when threaded
           interrupt handling is used on systems where the generation of
@@ -720,7 +720,6 @@ config X86_REROUTE_FOR_BROKEN_BOOT_IRQS
 
 config X86_MCE
         bool "Machine Check Exception"
-        depends on !X86_VOYAGER
         ---help---
           Machine Check Exception support allows the processor to notify the
           kernel if it detects a problem (e.g. overheating, component failure).
@@ -739,7 +738,7 @@ config X86_MCE_INTEL
         def_bool y
         prompt "Intel MCE features"
         depends on X86_64 && X86_MCE && X86_LOCAL_APIC
-        help
+        ---help---
            Additional support for intel specific MCE features such as
            the thermal monitor.
 
@@ -747,14 +746,14 @@ config X86_MCE_AMD
         def_bool y
         prompt "AMD MCE features"
         depends on X86_64 && X86_MCE && X86_LOCAL_APIC
-        help
+        ---help---
            Additional support for AMD specific MCE features such as
            the DRAM Error Threshold.
 
 config X86_MCE_NONFATAL
         tristate "Check for non-fatal errors on AMD Athlon/Duron / Intel Pentium 4"
         depends on X86_32 && X86_MCE
-        help
+        ---help---
           Enabling this feature starts a timer that triggers every 5 seconds which
           will look at the machine check registers to see if anything happened.
           Non-fatal problems automatically get corrected (but still logged).
@@ -767,7 +766,7 @@ config X86_MCE_NONFATAL
 config X86_MCE_P4THERMAL
         bool "check for P4 thermal throttling interrupt."
         depends on X86_32 && X86_MCE && (X86_UP_APIC || SMP)
-        help
+        ---help---
           Enabling this feature will cause a message to be printed when the P4
           enters thermal throttling.
 
@@ -775,11 +774,11 @@ config VM86
         bool "Enable VM86 support" if EMBEDDED
         default y
         depends on X86_32
-        help
-          This option is required by programs like DOSEMU to run 16-bit legacy
+        ---help---
+          This option is required by programs like DOSEMU to run 16-bit legacy
           code on X86 processors. It also may be needed by software like
-          XFree86 to initialize some video cards via BIOS. Disabling this
-          option saves about 6k.
+          XFree86 to initialize some video cards via BIOS. Disabling this
+          option saves about 6k.
 
 config TOSHIBA
         tristate "Toshiba Laptop support"
@@ -853,33 +852,33 @@ config MICROCODE
           module will be called microcode.
 
 config MICROCODE_INTEL
-       bool "Intel microcode patch loading support"
-       depends on MICROCODE
-       default MICROCODE
-       select FW_LOADER
-       --help---
-         This options enables microcode patch loading support for Intel
-         processors.
-
-         For latest news and information on obtaining all the required
-         Intel ingredients for this driver, check:
-         <http://www.urbanmyth.org/microcode/>.
+        bool "Intel microcode patch loading support"
+        depends on MICROCODE
+        default MICROCODE
+        select FW_LOADER
+        ---help---
+          This options enables microcode patch loading support for Intel
+          processors.
+
+          For latest news and information on obtaining all the required
+          Intel ingredients for this driver, check:
+          <http://www.urbanmyth.org/microcode/>.
 
 config MICROCODE_AMD
-       bool "AMD microcode patch loading support"
-       depends on MICROCODE
-       select FW_LOADER
-       --help---
-         If you select this option, microcode patch loading support for AMD
-         processors will be enabled.
+        bool "AMD microcode patch loading support"
+        depends on MICROCODE
+        select FW_LOADER
+        ---help---
+          If you select this option, microcode patch loading support for AMD
+          processors will be enabled.
 
-   config MICROCODE_OLD_INTERFACE
+config MICROCODE_OLD_INTERFACE
         def_bool y
         depends on MICROCODE
 
 config X86_MSR
         tristate "/dev/cpu/*/msr - Model-specific register support"
-        help
+        ---help---
           This device gives privileged processes access to the x86
           Model-Specific Registers (MSRs).  It is a character device with
           major 202 and minors 0 to 31 for /dev/cpu/0/msr to /dev/cpu/31/msr.
@@ -888,7 +887,7 @@ config X86_MSR
 
 config X86_CPUID
         tristate "/dev/cpu/*/cpuid - CPU information support"
-        help
+        ---help---
           This device gives processes access to the x86 CPUID instruction to
           be executed on a specific processor.  It is a character device
           with major 203 and minors 0 to 31 for /dev/cpu/0/cpuid to
@@ -940,7 +939,7 @@ config NOHIGHMEM
 config HIGHMEM4G
         bool "4GB"
         depends on !X86_NUMAQ
-        help
+        ---help---
           Select this if you have a 32-bit processor and between 1 and 4
           gigabytes of physical RAM.
 
@@ -948,7 +947,7 @@ config HIGHMEM64G
         bool "64GB"
         depends on !M386 && !M486
         select X86_PAE
-        help
+        ---help---
           Select this if you have a 32-bit processor and more than 4
           gigabytes of physical RAM.
 
@@ -959,7 +958,7 @@ choice
         prompt "Memory split" if EMBEDDED
         default VMSPLIT_3G
         depends on X86_32
-        help
+        ---help---
           Select the desired split between kernel and user memory.
 
           If the address range available to the kernel is less than the
@@ -1005,20 +1004,20 @@ config HIGHMEM
 config X86_PAE
         bool "PAE (Physical Address Extension) Support"
         depends on X86_32 && !HIGHMEM4G
-        help
+        ---help---
           PAE is required for NX support, and furthermore enables
           larger swapspace support for non-overcommit purposes. It
           has the cost of more pagetable lookup overhead, and also
           consumes more pagetable space per process.
 
 config ARCH_PHYS_ADDR_T_64BIT
-       def_bool X86_64 || X86_PAE
+        def_bool X86_64 || X86_PAE
 
 config DIRECT_GBPAGES
         bool "Enable 1GB pages for kernel pagetables" if EMBEDDED
         default y
         depends on X86_64
-        help
+        ---help---
           Allow the kernel linear mapping to use 1GB pages on CPUs that
           support it. This can improve the kernel's performance a tiny bit by
           reducing TLB pressure. If in doubt, say "Y".
@@ -1028,9 +1027,8 @@ config NUMA
         bool "Numa Memory Allocation and Scheduler Support"
         depends on SMP
         depends on X86_64 || (X86_32 && HIGHMEM64G && (X86_NUMAQ || X86_BIGSMP || X86_SUMMIT && ACPI) && EXPERIMENTAL)
-        default n if X86_PC
         default y if (X86_NUMAQ || X86_SUMMIT || X86_BIGSMP)
-        help
+        ---help---
           Enable NUMA (Non Uniform Memory Access) support.
 
           The kernel will try to allocate memory used by a CPU on the
@@ -1053,19 +1051,19 @@ config K8_NUMA
         def_bool y
         prompt "Old style AMD Opteron NUMA detection"
         depends on X86_64 && NUMA && PCI
-        help
-         Enable K8 NUMA node topology detection.  You should say Y here if
-         you have a multi processor AMD K8 system. This uses an old
-         method to read the NUMA configuration directly from the builtin
-         Northbridge of Opteron. It is recommended to use X86_64_ACPI_NUMA
-         instead, which also takes priority if both are compiled in.
+        ---help---
+          Enable K8 NUMA node topology detection.  You should say Y here if
+          you have a multi processor AMD K8 system. This uses an old
+          method to read the NUMA configuration directly from the builtin
+          Northbridge of Opteron. It is recommended to use X86_64_ACPI_NUMA
+          instead, which also takes priority if both are compiled in.
 
 config X86_64_ACPI_NUMA
         def_bool y
         prompt "ACPI NUMA detection"
         depends on X86_64 && NUMA && ACPI && PCI
         select ACPI_NUMA
-        help
+        ---help---
           Enable ACPI SRAT based node topology detection.
 
 # Some NUMA nodes have memory ranges that span
@@ -1080,7 +1078,7 @@ config NODES_SPAN_OTHER_NODES
 config NUMA_EMU
         bool "NUMA emulation"
         depends on X86_64 && NUMA
-        help
+        ---help---
           Enable NUMA emulation. A flat machine will be split
           into virtual nodes when booted with "numa=fake=N", where N is the
           number of nodes. This is only useful for debugging.
@@ -1093,7 +1091,7 @@ config NODES_SHIFT
         default "4" if X86_NUMAQ
         default "3"
         depends on NEED_MULTIPLE_NODES
-        help
+        ---help---
           Specify the maximum number of NUMA Nodes available on the target
           system.  Increases memory reserved to accomodate various tables.
 
@@ -1131,7 +1129,7 @@ config ARCH_SPARSEMEM_DEFAULT
 
 config ARCH_SPARSEMEM_ENABLE
         def_bool y
-        depends on X86_64 || NUMA || (EXPERIMENTAL && X86_PC) || X86_GENERICARCH
+        depends on X86_64 || NUMA || (EXPERIMENTAL && X86_32) || X86_32_NON_STANDARD
         select SPARSEMEM_STATIC if X86_32
         select SPARSEMEM_VMEMMAP_ENABLE if X86_64
 
@@ -1148,61 +1146,61 @@ source "mm/Kconfig"
 config HIGHPTE
         bool "Allocate 3rd-level pagetables from highmem"
         depends on X86_32 && (HIGHMEM4G || HIGHMEM64G)
-        help
+        ---help---
           The VM uses one page table entry for each page of physical memory.
           For systems with a lot of RAM, this can be wasteful of precious
           low memory.  Setting this option will put user-space page table
           entries in high memory.
 
 config X86_CHECK_BIOS_CORRUPTION
-        bool "Check for low memory corruption"
-        help
-         Periodically check for memory corruption in low memory, which
-         is suspected to be caused by BIOS.  Even when enabled in the
-         configuration, it is disabled at runtime.  Enable it by
-         setting "memory_corruption_check=1" on the kernel command
-         line.  By default it scans the low 64k of memory every 60
-         seconds; see the memory_corruption_check_size and
-         memory_corruption_check_period parameters in
-         Documentation/kernel-parameters.txt to adjust this.
-
-         When enabled with the default parameters, this option has
-         almost no overhead, as it reserves a relatively small amount
-         of memory and scans it infrequently.  It both detects corruption
-         and prevents it from affecting the running system.
-
-         It is, however, intended as a diagnostic tool; if repeatable
-         BIOS-originated corruption always affects the same memory,
-         you can use memmap= to prevent the kernel from using that
-         memory.
+        bool "Check for low memory corruption"
+        ---help---
+          Periodically check for memory corruption in low memory, which
+          is suspected to be caused by BIOS.  Even when enabled in the
+          configuration, it is disabled at runtime.  Enable it by
+          setting "memory_corruption_check=1" on the kernel command
+          line.  By default it scans the low 64k of memory every 60
+          seconds; see the memory_corruption_check_size and
+          memory_corruption_check_period parameters in
+          Documentation/kernel-parameters.txt to adjust this.
+
+          When enabled with the default parameters, this option has
+          almost no overhead, as it reserves a relatively small amount
+          of memory and scans it infrequently.  It both detects corruption
+          and prevents it from affecting the running system.
+
+          It is, however, intended as a diagnostic tool; if repeatable
+          BIOS-originated corruption always affects the same memory,
+          you can use memmap= to prevent the kernel from using that
+          memory.
 
 config X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK
-        bool "Set the default setting of memory_corruption_check"
+        bool "Set the default setting of memory_corruption_check"
         depends on X86_CHECK_BIOS_CORRUPTION
         default y
-        help
-         Set whether the default state of memory_corruption_check is
-         on or off.
+        ---help---
+          Set whether the default state of memory_corruption_check is
+          on or off.
 
 config X86_RESERVE_LOW_64K
-        bool "Reserve low 64K of RAM on AMI/Phoenix BIOSen"
+        bool "Reserve low 64K of RAM on AMI/Phoenix BIOSen"
         default y
-        help
-         Reserve the first 64K of physical RAM on BIOSes that are known
-         to potentially corrupt that memory range. A numbers of BIOSes are
-         known to utilize this area during suspend/resume, so it must not
-         be used by the kernel.
+        ---help---
+          Reserve the first 64K of physical RAM on BIOSes that are known
+          to potentially corrupt that memory range. A numbers of BIOSes are
+          known to utilize this area during suspend/resume, so it must not
+          be used by the kernel.
 
-         Set this to N if you are absolutely sure that you trust the BIOS
-         to get all its memory reservations and usages right.
+          Set this to N if you are absolutely sure that you trust the BIOS
+          to get all its memory reservations and usages right.
 
-         If you have doubts about the BIOS (e.g. suspend/resume does not
-         work or there's kernel crashes after certain hardware hotplug
-         events) and it's not AMI or Phoenix, then you might want to enable
-         X86_CHECK_BIOS_CORRUPTION=y to allow the kernel to check typical
-         corruption patterns.
+          If you have doubts about the BIOS (e.g. suspend/resume does not
+          work or there's kernel crashes after certain hardware hotplug
+          events) and it's not AMI or Phoenix, then you might want to enable
+          X86_CHECK_BIOS_CORRUPTION=y to allow the kernel to check typical
+          corruption patterns.
 
-         Say Y if unsure.
+          Say Y if unsure.
 
 config MATH_EMULATION
         bool
@@ -1268,7 +1266,7 @@ config MTRR_SANITIZER
         def_bool y
         prompt "MTRR cleanup support"
         depends on MTRR
-        help
+        ---help---
           Convert MTRR layout from continuous to discrete, so X drivers can
           add writeback entries.
 
@@ -1283,7 +1281,7 @@ config MTRR_SANITIZER_ENABLE_DEFAULT
         range 0 1
         default "0"
         depends on MTRR_SANITIZER
-        help
+        ---help---
           Enable mtrr cleanup default value
 
 config MTRR_SANITIZER_SPARE_REG_NR_DEFAULT
@@ -1291,7 +1289,7 @@ config MTRR_SANITIZER_SPARE_REG_NR_DEFAULT
         range 0 7
         default "1"
         depends on MTRR_SANITIZER
-        help
+        ---help---
           mtrr cleanup spare entries default, it can be changed via
           mtrr_spare_reg_nr=N on the kernel command line.
 
@@ -1299,7 +1297,7 @@ config X86_PAT
         bool
         prompt "x86 PAT support"
         depends on MTRR
-        help
+        ---help---
           Use PAT attributes to setup page level cache control.
 
           PATs are the modern equivalents of MTRRs and are much more
@@ -1314,20 +1312,20 @@ config EFI
         bool "EFI runtime service support"
         depends on ACPI
         ---help---
-        This enables the kernel to use EFI runtime services that are
-        available (such as the EFI variable services).
+          This enables the kernel to use EFI runtime services that are
+          available (such as the EFI variable services).
 
-        This option is only useful on systems that have EFI firmware.
-        In addition, you should use the latest ELILO loader available
-        at <http://elilo.sourceforge.net> in order to take advantage
-        of EFI runtime services. However, even with this option, the
-        resultant kernel should continue to boot on existing non-EFI
-        platforms.
+          This option is only useful on systems that have EFI firmware.
+          In addition, you should use the latest ELILO loader available
+          at <http://elilo.sourceforge.net> in order to take advantage
+          of EFI runtime services. However, even with this option, the
+          resultant kernel should continue to boot on existing non-EFI
+          platforms.
 
 config SECCOMP
         def_bool y
         prompt "Enable seccomp to safely compute untrusted bytecode"
-        help
+        ---help---
           This kernel feature is useful for number crunching applications
           that may need to compute untrusted bytecode during their
           execution. By using pipes or other transports made available to
@@ -1340,13 +1338,16 @@ config SECCOMP
 
           If unsure, say Y. Only embedded should say N here.
 
+config CC_STACKPROTECTOR_ALL
+        bool
+
 config CC_STACKPROTECTOR
         bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
-        depends on X86_64 && EXPERIMENTAL && BROKEN
-        help
-         This option turns on the -fstack-protector GCC feature. This
-          feature puts, at the beginning of critical functions, a canary
-          value on the stack just before the return address, and validates
+        select CC_STACKPROTECTOR_ALL
+        ---help---
+          This option turns on the -fstack-protector GCC feature. This
+          feature puts, at the beginning of functions, a canary value on
+          the stack just before the return address, and validates
           the value just before actually returning.  Stack based buffer
           overflows (that need to overwrite this return address) now also
           overwrite the canary, which gets detected and the attack is then
@@ -1354,22 +1355,14 @@ config CC_STACKPROTECTOR
 
           This feature requires gcc version 4.2 or above, or a distribution
           gcc with the feature backported. Older versions are automatically
-          detected and for those versions, this configuration option is ignored.
-
-config CC_STACKPROTECTOR_ALL
-        bool "Use stack-protector for all functions"
-        depends on CC_STACKPROTECTOR
-        help
-          Normally, GCC only inserts the canary value protection for
-          functions that use large-ish on-stack buffers. By enabling
-          this option, GCC will be asked to do this for ALL functions.
+          detected and for those versions, this configuration option is
+          ignored. (and a warning is printed during bootup)
 
 source kernel/Kconfig.hz
 
 config KEXEC
         bool "kexec system call"
-        depends on X86_BIOS_REBOOT
-        help
+        ---help---
           kexec is a system call that implements the ability to shutdown your
           current kernel, and to start another kernel.  It is like a reboot
           but it is independent of the system firmware.   And like a reboot
@@ -1386,7 +1379,7 @@ config KEXEC
 config CRASH_DUMP
         bool "kernel crash dumps"
         depends on X86_64 || (X86_32 && HIGHMEM)
-        help
+        ---help---
           Generate crash dump after being started by kexec.
           This should be normally only set in special crash dump kernels
           which are loaded in the main kernel with kexec-tools into
@@ -1401,7 +1394,7 @@ config KEXEC_JUMP
         bool "kexec jump (EXPERIMENTAL)"
         depends on EXPERIMENTAL
         depends on KEXEC && HIBERNATION && X86_32
-        help
+        ---help---
           Jump between original kernel and kexeced kernel and invoke
           code in physical address mode via KEXEC
 
@@ -1410,7 +1403,7 @@ config PHYSICAL_START
         default "0x1000000" if X86_NUMAQ
         default "0x200000" if X86_64
         default "0x100000"
-        help
+        ---help---
           This gives the physical address where the kernel is loaded.
 
           If kernel is a not relocatable (CONFIG_RELOCATABLE=n) then
@@ -1451,7 +1444,7 @@ config PHYSICAL_START
 config RELOCATABLE
         bool "Build a relocatable kernel (EXPERIMENTAL)"
         depends on EXPERIMENTAL
-        help
+        ---help---
           This builds a kernel image that retains relocation information
           so it can be loaded someplace besides the default 1MB.
           The relocations tend to make the kernel binary about 10% larger,
@@ -1471,7 +1464,7 @@ config PHYSICAL_ALIGN
         default "0x100000" if X86_32
         default "0x200000" if X86_64
         range 0x2000 0x400000
-        help
+        ---help---
           This value puts the alignment restrictions on physical address
           where kernel is loaded and run from. Kernel is compiled for an
           address which meets above alignment restriction.
@@ -1492,7 +1485,7 @@ config PHYSICAL_ALIGN
 
 config HOTPLUG_CPU
         bool "Support for hot-pluggable CPUs"
-        depends on SMP && HOTPLUG && !X86_VOYAGER
+        depends on SMP && HOTPLUG
         ---help---
           Say Y here to allow turning CPUs off and on. CPUs can be
           controlled through /sys/devices/system/cpu.
@@ -1504,7 +1497,7 @@ config COMPAT_VDSO
         def_bool y
         prompt "Compat VDSO support"
         depends on X86_32 || IA32_EMULATION
-        help
+        ---help---
           Map the 32-bit VDSO to the predictable old-style address too.
         ---help---
           Say N here if you are running a sufficiently recent glibc
@@ -1516,7 +1509,7 @@ config COMPAT_VDSO
 config CMDLINE_BOOL
         bool "Built-in kernel command line"
         default n
-        help
+        ---help---
           Allow for specifying boot arguments to the kernel at
           build time.  On some systems (e.g. embedded ones), it is
           necessary or convenient to provide some or all of the
@@ -1534,7 +1527,7 @@ config CMDLINE
         string "Built-in kernel command string"
         depends on CMDLINE_BOOL
         default ""
-        help
+        ---help---
           Enter arguments here that should be compiled into the kernel
           image and used at boot time.  If the boot loader provides a
           command line at boot time, it is appended to this string to
@@ -1551,7 +1544,7 @@ config CMDLINE_OVERRIDE
         bool "Built-in command line overrides boot loader arguments"
         default n
         depends on CMDLINE_BOOL
-        help
+        ---help---
           Set this option to 'Y' to have the kernel ignore the boot loader
           command line, and use ONLY the built-in command line.
 
@@ -1573,7 +1566,6 @@ config HAVE_ARCH_EARLY_PFN_TO_NID
         depends on NUMA
 
 menu "Power management and ACPI options"
-        depends on !X86_VOYAGER
 
 config ARCH_HIBERNATION_HEADER
         def_bool y
@@ -1651,7 +1643,7 @@ if APM
 
 config APM_IGNORE_USER_SUSPEND
         bool "Ignore USER SUSPEND"
-        help
+        ---help---
           This option will ignore USER SUSPEND requests. On machines with a
           compliant APM BIOS, you want to say N. However, on the NEC Versa M
           series notebooks, it is necessary to say Y because of a BIOS bug.
@@ -1675,7 +1667,7 @@ config APM_DO_ENABLE
 
 config APM_CPU_IDLE
         bool "Make CPU Idle calls when idle"
-        help
+        ---help---
           Enable calls to APM CPU Idle/CPU Busy inside the kernel's idle loop.
           On some machines, this can activate improved power savings, such as
           a slowed CPU clock rate, when the machine is idle. These idle calls
@@ -1686,7 +1678,7 @@ config APM_CPU_IDLE
 
 config APM_DISPLAY_BLANK
         bool "Enable console blanking using APM"
-        help
+        ---help---
           Enable console blanking using the APM. Some laptops can use this to
           turn off the LCD backlight when the screen blanker of the Linux
           virtual console blanks the screen. Note that this is only used by
@@ -1699,7 +1691,7 @@ config APM_DISPLAY_BLANK
 
 config APM_ALLOW_INTS
         bool "Allow interrupts during APM BIOS calls"
-        help
+        ---help---
           Normally we disable external interrupts while we are making calls to
           the APM BIOS as a measure to lessen the effects of a badly behaving
           BIOS implementation.  The BIOS should reenable interrupts if it
@@ -1724,7 +1716,7 @@ config PCI
         bool "PCI support"
         default y
         select ARCH_SUPPORTS_MSI if (X86_LOCAL_APIC && X86_IO_APIC)
-        help
+        ---help---
           Find out whether you have a PCI motherboard. PCI is the name of a
           bus system, i.e. the way the CPU talks to the other stuff inside
           your box. Other bus systems are ISA, EISA, MicroChannel (MCA) or
@@ -1795,40 +1787,51 @@ config PCI_MMCONFIG
 config DMAR
         bool "Support for DMA Remapping Devices (EXPERIMENTAL)"
         depends on X86_64 && PCI_MSI && ACPI && EXPERIMENTAL
-        help
+        ---help---
           DMA remapping (DMAR) devices support enables independent address
           translations for Direct Memory Access (DMA) from devices.
           These DMA remapping devices are reported via ACPI tables
           and include PCI device scope covered by these DMA
           remapping devices.
 
+config DMAR_DEFAULT_ON
+        def_bool n
+        prompt "Enable DMA Remapping Devices by default"
+        depends on DMAR
+        help
+          Selecting this option will enable a DMAR device at boot time if
+          one is found. If this option is not selected, DMAR support can
+          be enabled by passing intel_iommu=on to the kernel. It is
+          recommended you say N here while the DMAR code remains
+          experimental.
+
 config DMAR_GFX_WA
         def_bool y
         prompt "Support for Graphics workaround"
         depends on DMAR
-        help
-         Current Graphics drivers tend to use physical address
-         for DMA and avoid using DMA APIs. Setting this config
-         option permits the IOMMU driver to set a unity map for
-         all the OS-visible memory. Hence the driver can continue
-         to use physical addresses for DMA.
+        ---help---
+          Current Graphics drivers tend to use physical address
+          for DMA and avoid using DMA APIs. Setting this config
+          option permits the IOMMU driver to set a unity map for
+          all the OS-visible memory. Hence the driver can continue
+          to use physical addresses for DMA.
 
 config DMAR_FLOPPY_WA
         def_bool y
         depends on DMAR
-        help
-         Floppy disk drivers are know to bypass DMA API calls
-         thereby failing to work when IOMMU is enabled. This
-         workaround will setup a 1:1 mapping for the first
-         16M to make floppy (an ISA device) work.
+        ---help---
+          Floppy disk drivers are know to bypass DMA API calls
+          thereby failing to work when IOMMU is enabled. This
+          workaround will setup a 1:1 mapping for the first
+          16M to make floppy (an ISA device) work.
 
 config INTR_REMAP
         bool "Support for Interrupt Remapping (EXPERIMENTAL)"
         depends on X86_64 && X86_IO_APIC && PCI_MSI && ACPI && EXPERIMENTAL
-        help
-         Supports Interrupt remapping for IO-APIC and MSI devices.
-         To use x2apic mode in the CPU's which support x2APIC enhancements or
-         to support platforms with CPU's having > 8 bit APIC ID, say Y.
+        ---help---
+          Supports Interrupt remapping for IO-APIC and MSI devices.
+          To use x2apic mode in the CPU's which support x2APIC enhancements or
+          to support platforms with CPU's having > 8 bit APIC ID, say Y.
 
 source "drivers/pci/pcie/Kconfig"
 
@@ -1842,8 +1845,7 @@ if X86_32
 
 config ISA
         bool "ISA support"
-        depends on !X86_VOYAGER
-        help
+        ---help---
           Find out whether you have ISA slots on your motherboard.  ISA is the
           name of a bus system, i.e. the way the CPU talks to the other stuff
           inside your box.  Other bus systems are PCI, EISA, MicroChannel
@@ -1869,9 +1871,8 @@ config EISA
 source "drivers/eisa/Kconfig"
 
 config MCA
-        bool "MCA support" if !X86_VOYAGER
-        default y if X86_VOYAGER
-        help
+        bool "MCA support"
+        ---help---
           MicroChannel Architecture is found in some IBM PS/2 machines and
           laptops.  It is a bus system similar to PCI or ISA. See
           <file:Documentation/mca.txt> (and especially the web page given
@@ -1881,8 +1882,7 @@ source "drivers/mca/Kconfig"
 
 config SCx200
         tristate "NatSemi SCx200 support"
-        depends on !X86_VOYAGER
-        help
+        ---help---
           This provides basic support for National Semiconductor's
           (now AMD's) Geode processors.  The driver probes for the
           PCI-IDs of several on-chip devices, so its a good dependency
@@ -1894,7 +1894,7 @@ config SCx200HR_TIMER
         tristate "NatSemi SCx200 27MHz High-Resolution Timer Support"
         depends on SCx200 && GENERIC_TIME
         default y
-        help
+        ---help---
           This driver provides a clocksource built upon the on-chip
           27MHz high-resolution timer.  Its also a workaround for
           NSC Geode SC-1100's buggy TSC, which loses time when the
@@ -1905,7 +1905,7 @@ config GEODE_MFGPT_TIMER
         def_bool y
         prompt "Geode Multi-Function General Purpose Timer (MFGPT) events"
         depends on MGEODE_LX && GENERIC_TIME && GENERIC_CLOCKEVENTS
-        help
+        ---help---
           This driver provides a clock event source based on the MFGPT
           timer(s) in the CS5535 and CS5536 companion chip for the geode.
           MFGPTs have a better resolution and max interval than the
@@ -1914,7 +1914,7 @@ config GEODE_MFGPT_TIMER
 config OLPC
         bool "One Laptop Per Child support"
         default n
-        help
+        ---help---
           Add support for detecting the unique features of the OLPC
           XO hardware.
 
@@ -1939,16 +1939,16 @@ config IA32_EMULATION
         bool "IA32 Emulation"
         depends on X86_64
         select COMPAT_BINFMT_ELF
-        help
+        ---help---
           Include code to run 32-bit programs under a 64-bit kernel. You should
           likely turn this on, unless you're 100% sure that you don't have any
           32-bit programs left.
 
 config IA32_AOUT
-       tristate "IA32 a.out support"
-       depends on IA32_EMULATION
-       help
-         Support old a.out binaries in the 32bit emulation.
+        tristate "IA32 a.out support"
+        depends on IA32_EMULATION
+        ---help---
+          Support old a.out binaries in the 32bit emulation.
 
 config COMPAT
         def_bool y
diff --git a/arch/x86/Kconfig.cpu b/arch/x86/Kconfig.cpu
index 8078955845a..a95eaf0e582 100644
--- a/arch/x86/Kconfig.cpu
+++ b/arch/x86/Kconfig.cpu
@@ -50,7 +50,7 @@ config M386
 config M486
         bool "486"
         depends on X86_32
-        help
+        ---help---
           Select this for a 486 series processor, either Intel or one of the
           compatible processors from AMD, Cyrix, IBM, or Intel.  Includes DX,
           DX2, and DX4 variants; also SL/SLC/SLC2/SLC3/SX/SX2 and UMC U5D or
@@ -59,7 +59,7 @@ config M486
 config M586
         bool "586/K5/5x86/6x86/6x86MX"
         depends on X86_32
-        help
+        ---help---
           Select this for an 586 or 686 series processor such as the AMD K5,
           the Cyrix 5x86, 6x86 and 6x86MX.  This choice does not
           assume the RDTSC (Read Time Stamp Counter) instruction.
@@ -67,21 +67,21 @@ config M586
 config M586TSC
         bool "Pentium-Classic"
         depends on X86_32
-        help
+        ---help---
           Select this for a Pentium Classic processor with the RDTSC (Read
           Time Stamp Counter) instruction for benchmarking.
 
 config M586MMX
         bool "Pentium-MMX"
         depends on X86_32
-        help
+        ---help---
           Select this for a Pentium with the MMX graphics/multimedia
           extended instructions.
 
 config M686
         bool "Pentium-Pro"
         depends on X86_32
-        help
+        ---help---
           Select this for Intel Pentium Pro chips.  This enables the use of
           Pentium Pro extended instructions, and disables the init-time guard
           against the f00f bug found in earlier Pentiums.
@@ -89,7 +89,7 @@ config M686
 config MPENTIUMII
         bool "Pentium-II/Celeron(pre-Coppermine)"
         depends on X86_32
-        help
+        ---help---
           Select this for Intel chips based on the Pentium-II and
           pre-Coppermine Celeron core.  This option enables an unaligned
           copy optimization, compiles the kernel with optimization flags
@@ -99,7 +99,7 @@ config MPENTIUMII
 config MPENTIUMIII
         bool "Pentium-III/Celeron(Coppermine)/Pentium-III Xeon"
         depends on X86_32
-        help
+        ---help---
           Select this for Intel chips based on the Pentium-III and
           Celeron-Coppermine core.  This option enables use of some
           extended prefetch instructions in addition to the Pentium II
@@ -108,14 +108,14 @@ config MPENTIUMIII
 config MPENTIUMM
         bool "Pentium M"
         depends on X86_32
-        help
+        ---help---
           Select this for Intel Pentium M (not Pentium-4 M)
           notebook chips.
 
 config MPENTIUM4
         bool "Pentium-4/Celeron(P4-based)/Pentium-4 M/older Xeon"
         depends on X86_32
-        help
+        ---help---
           Select this for Intel Pentium 4 chips.  This includes the
           Pentium 4, Pentium D, P4-based Celeron and Xeon, and
           Pentium-4 M (not Pentium M) chips.  This option enables compile
@@ -151,7 +151,7 @@ config MPENTIUM4
 config MK6
         bool "K6/K6-II/K6-III"
         depends on X86_32
-        help
+        ---help---
           Select this for an AMD K6-family processor.  Enables use of
           some extended instructions, and passes appropriate optimization
           flags to GCC.
@@ -159,22 +159,22 @@ config MK6
 config MK7
         bool "Athlon/Duron/K7"
         depends on X86_32
-        help
+        ---help---
           Select this for an AMD Athlon K7-family processor.  Enables use of
           some extended instructions, and passes appropriate optimization
           flags to GCC.
 
 config MK8
         bool "Opteron/Athlon64/Hammer/K8"
-        help
-          Select this for an AMD Opteron or Athlon64 Hammer-family processor.  Enables
-          use of some extended instructions, and passes appropriate optimization
-          flags to GCC.
+        ---help---
+          Select this for an AMD Opteron or Athlon64 Hammer-family processor.
+          Enables use of some extended instructions, and passes appropriate
+          optimization flags to GCC.
 
 config MCRUSOE
         bool "Crusoe"
         depends on X86_32
-        help
+        ---help---
           Select this for a Transmeta Crusoe processor.  Treats the processor
           like a 586 with TSC, and sets some GCC optimization flags (like a
           Pentium Pro with no alignment requirements).
@@ -182,13 +182,13 @@ config MCRUSOE
 config MEFFICEON
         bool "Efficeon"
         depends on X86_32
-        help
+        ---help---
           Select this for a Transmeta Efficeon processor.
 
 config MWINCHIPC6
         bool "Winchip-C6"
         depends on X86_32
-        help
+        ---help---
           Select this for an IDT Winchip C6 chip.  Linux and GCC
           treat this chip as a 586TSC with some extended instructions
           and alignment requirements.
@@ -196,7 +196,7 @@ config MWINCHIPC6
 config MWINCHIP3D
         bool "Winchip-2/Winchip-2A/Winchip-3"
         depends on X86_32
-        help
+        ---help---
           Select this for an IDT Winchip-2, 2A or 3.  Linux and GCC
           treat this chip as a 586TSC with some extended instructions
           and alignment requirements.  Also enable out of order memory
@@ -206,19 +206,19 @@ config MWINCHIP3D
 config MGEODEGX1
         bool "GeodeGX1"
         depends on X86_32
-        help
+        ---help---
           Select this for a Geode GX1 (Cyrix MediaGX) chip.
 
 config MGEODE_LX
         bool "Geode GX/LX"
         depends on X86_32
-        help
+        ---help---
           Select this for AMD Geode GX and LX processors.
 
 config MCYRIXIII
         bool "CyrixIII/VIA-C3"
         depends on X86_32
-        help
+        ---help---
           Select this for a Cyrix III or C3 chip.  Presently Linux and GCC
           treat this chip as a generic 586. Whilst the CPU is 686 class,
           it lacks the cmov extension which gcc assumes is present when
@@ -230,7 +230,7 @@ config MCYRIXIII
 config MVIAC3_2
         bool "VIA C3-2 (Nehemiah)"
         depends on X86_32
-        help
+        ---help---
           Select this for a VIA C3 "Nehemiah". Selecting this enables usage
           of SSE and tells gcc to treat the CPU as a 686.
           Note, this kernel will not boot on older (pre model 9) C3s.
@@ -238,14 +238,14 @@ config MVIAC3_2
 config MVIAC7
         bool "VIA C7"
         depends on X86_32
-        help
+        ---help---
           Select this for a VIA C7.  Selecting this uses the correct cache
           shift and tells gcc to treat the CPU as a 686.
 
 config MPSC
         bool "Intel P4 / older Netburst based Xeon"
         depends on X86_64
-        help
+        ---help---
           Optimize for Intel Pentium 4, Pentium D and older Nocona/Dempsey
           Xeon CPUs with Intel 64bit which is compatible with x86-64.
           Note that the latest Xeons (Xeon 51xx and 53xx) are not based on the
@@ -255,15 +255,17 @@ config MPSC
 
 config MCORE2
         bool "Core 2/newer Xeon"
-        help
-          Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and 53xx)
-          CPUs. You can distinguish newer from older Xeons by the CPU family
-          in /proc/cpuinfo. Newer ones have 6 and older ones 15 (not a typo)
+        ---help---
+
+          Select this for Intel Core 2 and newer Core 2 Xeons (Xeon 51xx and
+          53xx) CPUs. You can distinguish newer from older Xeons by the CPU
+          family in /proc/cpuinfo. Newer ones have 6 and older ones 15
+          (not a typo)
 
 config GENERIC_CPU
         bool "Generic-x86-64"
         depends on X86_64
-        help
+        ---help---
           Generic x86-64 CPU.
           Run equally well on all x86-64 CPUs.
 
@@ -272,7 +274,7 @@ endchoice
 config X86_GENERIC
         bool "Generic x86 support"
         depends on X86_32
-        help
+        ---help---
           Instead of just including optimizations for the selected
           x86 variant (e.g. PII, Crusoe or Athlon), include some more
           generic optimizations as well. This will make the kernel
@@ -292,25 +294,23 @@ config X86_CPU
 # Define implied options from the CPU selection here
 config X86_L1_CACHE_BYTES
         int
-        default "128" if GENERIC_CPU || MPSC
-        default "64" if MK8 || MCORE2
-        depends on X86_64
+        default "128" if MPSC
+        default "64" if GENERIC_CPU || MK8 || MCORE2 || X86_32
 
 config X86_INTERNODE_CACHE_BYTES
         int
         default "4096" if X86_VSMP
         default X86_L1_CACHE_BYTES if !X86_VSMP
-        depends on X86_64
 
 config X86_CMPXCHG
         def_bool X86_64 || (X86_32 && !M386)
 
 config X86_L1_CACHE_SHIFT
         int
-        default "7" if MPENTIUM4 || X86_GENERIC || GENERIC_CPU || MPSC
+        default "7" if MPENTIUM4 || MPSC
         default "4" if X86_ELAN || M486 || M386 || MGEODEGX1
         default "5" if MWINCHIP3D || MWINCHIPC6 || MCRUSOE || MEFFICEON || MCYRIXIII || MK6 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || MVIAC3_2 || MGEODE_LX
-        default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MVIAC7
+        default "6" if MK7 || MK8 || MPENTIUMM || MCORE2 || MVIAC7 || X86_GENERIC || GENERIC_CPU
 
 config X86_XADD
         def_bool y
@@ -319,15 +319,15 @@ config X86_XADD
 config X86_PPRO_FENCE
         bool "PentiumPro memory ordering errata workaround"
         depends on M686 || M586MMX || M586TSC || M586 || M486 || M386 || MGEODEGX1
-        help
-          Old PentiumPro multiprocessor systems had errata that could cause memory
-          operations to violate the x86 ordering standard in rare cases. Enabling this
-          option will attempt to work around some (but not all) occurances of
-          this problem, at the cost of much heavier spinlock and memory barrier
-          operations.
+        ---help---
+          Old PentiumPro multiprocessor systems had errata that could cause
+          memory operations to violate the x86 ordering standard in rare cases.
+          Enabling this option will attempt to work around some (but not all)
+          occurances of this problem, at the cost of much heavier spinlock and
+          memory barrier operations.
 
-          If unsure, say n here. Even distro kernels should think twice before enabling
-          this: there are few systems, and an unlikely bug.
+          If unsure, say n here. Even distro kernels should think twice before
+          enabling this: there are few systems, and an unlikely bug.
 
 config X86_F00F_BUG
         def_bool y
@@ -412,14 +412,14 @@ config X86_DEBUGCTLMSR
 
 menuconfig PROCESSOR_SELECT
         bool "Supported processor vendors" if EMBEDDED
-        help
+        ---help---
           This lets you choose what x86 vendor support code your kernel
           will include.
 
 config CPU_SUP_INTEL
         default y
         bool "Support Intel processors" if PROCESSOR_SELECT
-        help
+        ---help---
           This enables detection, tunings and quirks for Intel processors
 
           You need this enabled if you want your kernel to run on an
@@ -433,7 +433,7 @@ config CPU_SUP_CYRIX_32
         default y
         bool "Support Cyrix processors" if PROCESSOR_SELECT
         depends on !64BIT
-        help
+        ---help---
           This enables detection, tunings and quirks for Cyrix processors
 
           You need this enabled if you want your kernel to run on a
@@ -446,7 +446,7 @@ config CPU_SUP_CYRIX_32
 config CPU_SUP_AMD
         default y
         bool "Support AMD processors" if PROCESSOR_SELECT
-        help
+        ---help---
           This enables detection, tunings and quirks for AMD processors
 
           You need this enabled if you want your kernel to run on an
@@ -460,7 +460,7 @@ config CPU_SUP_CENTAUR_32
         default y
         bool "Support Centaur processors" if PROCESSOR_SELECT
         depends on !64BIT
-        help
+        ---help---
           This enables detection, tunings and quirks for Centaur processors
 
           You need this enabled if you want your kernel to run on a
@@ -474,7 +474,7 @@ config CPU_SUP_CENTAUR_64
         default y
         bool "Support Centaur processors" if PROCESSOR_SELECT
         depends on 64BIT
-        help
+        ---help---
           This enables detection, tunings and quirks for Centaur processors
 
           You need this enabled if you want your kernel to run on a
@@ -488,7 +488,7 @@ config CPU_SUP_TRANSMETA_32
         default y
         bool "Support Transmeta processors" if PROCESSOR_SELECT
         depends on !64BIT
-        help
+        ---help---
           This enables detection, tunings and quirks for Transmeta processors
 
           You need this enabled if you want your kernel to run on a
@@ -502,7 +502,7 @@ config CPU_SUP_UMC_32
         default y
         bool "Support UMC processors" if PROCESSOR_SELECT
         depends on !64BIT
-        help
+        ---help---
           This enables detection, tunings and quirks for UMC processors
 
           You need this enabled if you want your kernel to run on a
@@ -521,7 +521,7 @@ config X86_PTRACE_BTS
         bool "Branch Trace Store"
         default y
         depends on X86_DEBUGCTLMSR
-        help
+        ---help---
           This adds a ptrace interface to the hardware's branch trace store.
 
           Debuggers may use it to collect an execution trace of the debugged
diff --git a/arch/x86/Kconfig.debug b/arch/x86/Kconfig.debug
index 10d6cc3fd05..ba4781b9389 100644
--- a/arch/x86/Kconfig.debug
+++ b/arch/x86/Kconfig.debug
@@ -7,7 +7,7 @@ source "lib/Kconfig.debug"
 
 config STRICT_DEVMEM
         bool "Filter access to /dev/mem"
-        help
+        ---help---
           If this option is disabled, you allow userspace (root) access to all
           of memory, including kernel and userspace memory. Accidental
           access to this is obviously disastrous, but specific access can
@@ -25,7 +25,7 @@ config STRICT_DEVMEM
 config X86_VERBOSE_BOOTUP
         bool "Enable verbose x86 bootup info messages"
         default y
-        help
+        ---help---
           Enables the informational output from the decompression stage
           (e.g. bzImage) of the boot. If you disable this you will still
           see errors. Disable this if you want silent bootup.
@@ -33,7 +33,7 @@ config X86_VERBOSE_BOOTUP
 config EARLY_PRINTK
         bool "Early printk" if EMBEDDED
         default y
-        help
+        ---help---
           Write kernel log output directly into the VGA buffer or to a serial
           port.
 
@@ -47,7 +47,7 @@ config EARLY_PRINTK_DBGP
         bool "Early printk via EHCI debug port"
         default n
         depends on EARLY_PRINTK && PCI
-        help
+        ---help---
           Write kernel log output directly into the EHCI debug port.
 
           This is useful for kernel debugging when your machine crashes very
@@ -59,14 +59,14 @@ config EARLY_PRINTK_DBGP
 config DEBUG_STACKOVERFLOW
         bool "Check for stack overflows"
         depends on DEBUG_KERNEL
-        help
+        ---help---
           This option will cause messages to be printed if free stack space
           drops below a certain limit.
 
 config DEBUG_STACK_USAGE
         bool "Stack utilization instrumentation"
         depends on DEBUG_KERNEL
-        help
+        ---help---
           Enables the display of the minimum amount of free stack which each
           task has ever had available in the sysrq-T and sysrq-P debug output.
 
@@ -75,7 +75,7 @@ config DEBUG_STACK_USAGE
 config DEBUG_PAGEALLOC
         bool "Debug page memory allocations"
         depends on DEBUG_KERNEL
-        help
+        ---help---
           Unmap pages from the kernel linear mapping after free_pages().
           This results in a large slowdown, but helps to find certain types
           of memory corruptions.
@@ -83,9 +83,9 @@ config DEBUG_PAGEALLOC
 config DEBUG_PER_CPU_MAPS
         bool "Debug access to per_cpu maps"
         depends on DEBUG_KERNEL
-        depends on X86_SMP
+        depends on SMP
         default n
-        help
+        ---help---
           Say Y to verify that the per_cpu map being accessed has
           been setup.  Adds a fair amount of code to kernel memory
           and decreases performance.
@@ -96,7 +96,7 @@ config X86_PTDUMP
         bool "Export kernel pagetable layout to userspace via debugfs"
         depends on DEBUG_KERNEL
         select DEBUG_FS
-        help
+        ---help---
           Say Y here if you want to show the kernel pagetable layout in a
           debugfs file. This information is only useful for kernel developers
           who are working in architecture specific areas of the kernel.
@@ -108,7 +108,7 @@ config DEBUG_RODATA
         bool "Write protect kernel read-only data structures"
         default y
         depends on DEBUG_KERNEL
-        help
+        ---help---
           Mark the kernel read-only data as write-protected in the pagetables,
           in order to catch accidental (and incorrect) writes to such const
           data. This is recommended so that we can catch kernel bugs sooner.
@@ -117,7 +117,8 @@ config DEBUG_RODATA
 config DEBUG_RODATA_TEST
         bool "Testcase for the DEBUG_RODATA feature"
         depends on DEBUG_RODATA
-        help
+        default y
+        ---help---
           This option enables a testcase for the DEBUG_RODATA
           feature as well as for the change_page_attr() infrastructure.
           If in doubt, say "N"
@@ -125,7 +126,7 @@ config DEBUG_RODATA_TEST
 config DEBUG_NX_TEST
         tristate "Testcase for the NX non-executable stack feature"
         depends on DEBUG_KERNEL && m
-        help
+        ---help---
           This option enables a testcase for the CPU NX capability
           and the software setup of this feature.
           If in doubt, say "N"
@@ -133,7 +134,7 @@ config DEBUG_NX_TEST
 config 4KSTACKS
         bool "Use 4Kb for kernel stacks instead of 8Kb"
         depends on X86_32
-        help
+        ---help---
           If you say Y here the kernel will use a 4Kb stacksize for the
           kernel stack attached to each process/thread. This facilitates
           running more threads on a system and also reduces the pressure
@@ -144,7 +145,7 @@ config DOUBLEFAULT
         default y
         bool "Enable doublefault exception handler" if EMBEDDED
         depends on X86_32
-        help
+        ---help---
           This option allows trapping of rare doublefault exceptions that
           would otherwise cause a system to silently reboot. Disabling this
           option saves about 4k and might cause you much additional grey
@@ -154,7 +155,7 @@ config IOMMU_DEBUG
         bool "Enable IOMMU debugging"
         depends on GART_IOMMU && DEBUG_KERNEL
         depends on X86_64
-        help
+        ---help---
           Force the IOMMU to on even when you have less than 4GB of
           memory and add debugging code. On overflow always panic. And
           allow to enable IOMMU leak tracing. Can be disabled at boot
@@ -170,7 +171,7 @@ config IOMMU_LEAK
         bool "IOMMU leak tracing"
         depends on DEBUG_KERNEL
         depends on IOMMU_DEBUG
-        help
+        ---help---
           Add a simple leak tracer to the IOMMU code. This is useful when you
           are debugging a buggy device driver that leaks IOMMU mappings.
 
@@ -223,25 +224,25 @@ choice
 
 config IO_DELAY_0X80
         bool "port 0x80 based port-IO delay [recommended]"
-        help
+        ---help---
           This is the traditional Linux IO delay used for in/out_p.
           It is the most tested hence safest selection here.
 
 config IO_DELAY_0XED
         bool "port 0xed based port-IO delay"
-        help
+        ---help---
           Use port 0xed as the IO delay. This frees up port 0x80 which is
           often used as a hardware-debug port.
 
 config IO_DELAY_UDELAY
         bool "udelay based port-IO delay"
-        help
+        ---help---
           Use udelay(2) as the IO delay method. This provides the delay
           while not having any side-effect on the IO port space.
 
 config IO_DELAY_NONE
         bool "no port-IO delay"
-        help
+        ---help---
           No port-IO delay. Will break on old boxes that require port-IO
           delay for certain operations. Should work on most new machines.
 
@@ -275,18 +276,18 @@ config DEBUG_BOOT_PARAMS
         bool "Debug boot parameters"
         depends on DEBUG_KERNEL
         depends on DEBUG_FS
-        help
+        ---help---
           This option will cause struct boot_params to be exported via debugfs.
 
 config CPA_DEBUG
         bool "CPA self-test code"
         depends on DEBUG_KERNEL
-        help
+        ---help---
           Do change_page_attr() self-tests every 30 seconds.
 
 config OPTIMIZE_INLINING
         bool "Allow gcc to uninline functions marked 'inline'"
-        help
+        ---help---
           This option determines if the kernel forces gcc to inline the functions
           developers have marked 'inline'. Doing so takes away freedom from gcc to
           do what it thinks is best, which is desirable for the gcc 3.x series of
@@ -299,4 +300,3 @@ config OPTIMIZE_INLINING
           If unsure, say N.
 
 endmenu
-
diff --git a/arch/x86/Makefile b/arch/x86/Makefile
index d1a47adb5ae..1836191839e 100644
--- a/arch/x86/Makefile
+++ b/arch/x86/Makefile
@@ -70,14 +70,17 @@ else
         # this works around some issues with generating unwind tables in older gccs
         # newer gccs do it by default
         KBUILD_CFLAGS += -maccumulate-outgoing-args
+endif
 
-        stackp := $(CONFIG_SHELL) $(srctree)/scripts/gcc-x86_64-has-stack-protector.sh
-        stackp-$(CONFIG_CC_STACKPROTECTOR) := $(shell $(stackp) \
-                "$(CC)" -fstack-protector )
-        stackp-$(CONFIG_CC_STACKPROTECTOR_ALL) += $(shell $(stackp) \
-                "$(CC)" -fstack-protector-all )
-
-        KBUILD_CFLAGS += $(stackp-y)
+ifdef CONFIG_CC_STACKPROTECTOR
+        cc_has_sp := $(srctree)/scripts/gcc-x86_$(BITS)-has-stack-protector.sh
+        ifeq ($(shell $(CONFIG_SHELL) $(cc_has_sp) $(CC)),y)
+                stackp-y := -fstack-protector
+                stackp-$(CONFIG_CC_STACKPROTECTOR_ALL) += -fstack-protector-all
+                KBUILD_CFLAGS += $(stackp-y)
+        else
+                $(warning stack protector enabled but no compiler support)
+        endif
 endif
 
 # Stackpointer is addressed different for 32 bit and 64 bit x86
@@ -102,29 +105,6 @@ KBUILD_CFLAGS += -fno-asynchronous-unwind-tables
 # prevent gcc from generating any FP code by mistake
 KBUILD_CFLAGS += $(call cc-option,-mno-sse -mno-mmx -mno-sse2 -mno-3dnow,)
 
-###
-# Sub architecture support
-# fcore-y is linked before mcore-y files.
-
-# Default subarch .c files
-mcore-y  := arch/x86/mach-default/
-
-# Voyager subarch support
-mflags-$(CONFIG_X86_VOYAGER)    := -Iarch/x86/include/asm/mach-voyager
-mcore-$(CONFIG_X86_VOYAGER)     := arch/x86/mach-voyager/
-
-# generic subarchitecture
-mflags-$(CONFIG_X86_GENERICARCH):= -Iarch/x86/include/asm/mach-generic
-fcore-$(CONFIG_X86_GENERICARCH) += arch/x86/mach-generic/
-mcore-$(CONFIG_X86_GENERICARCH) := arch/x86/mach-default/
-
-# default subarch .h files
-mflags-y += -Iarch/x86/include/asm/mach-default
-
-# 64 bit does not support subarch support - clear sub arch variables
-fcore-$(CONFIG_X86_64)  :=
-mcore-$(CONFIG_X86_64)  :=
-
 KBUILD_CFLAGS += $(mflags-y)
 KBUILD_AFLAGS += $(mflags-y)
 
@@ -150,9 +130,6 @@ core-$(CONFIG_LGUEST_GUEST) += arch/x86/lguest/
 core-y += arch/x86/kernel/
 core-y += arch/x86/mm/
 
-# Remaining sub architecture files
-core-y += $(mcore-y)
-
 core-y += arch/x86/crypto/
 core-y += arch/x86/vdso/
 core-$(CONFIG_IA32_EMULATION) += arch/x86/ia32/
diff --git a/arch/x86/boot/a20.c b/arch/x86/boot/a20.c
index 4063d630def..fba8e9c6a50 100644
--- a/arch/x86/boot/a20.c
+++ b/arch/x86/boot/a20.c
@@ -2,6 +2,7 @@
  *
  *   Copyright (C) 1991, 1992 Linus Torvalds
  *   Copyright 2007-2008 rPath, Inc. - All Rights Reserved
+ *   Copyright 2009 Intel Corporation
  *
  *   This file is part of the Linux kernel, and is made available under
  *   the terms of the GNU General Public License version 2.
@@ -15,16 +16,23 @@
 #include "boot.h"
 
 #define MAX_8042_LOOPS  100000
+#define MAX_8042_FF     32
 
 static int empty_8042(void)
 {
         u8 status;
         int loops = MAX_8042_LOOPS;
+        int ffs   = MAX_8042_FF;
 
         while (loops--) {
                 io_delay();
 
                 status = inb(0x64);
+                if (status == 0xff) {
+                        /* FF is a plausible, but very unlikely status */
+                        if (!--ffs)
+                                return -1; /* Assume no KBC present */
+                }
                 if (status & 1) {
                         /* Read and discard input data */
                         io_delay();
@@ -118,44 +126,43 @@ static void enable_a20_fast(void)
 
 int enable_a20(void)
 {
-#if defined(CONFIG_X86_ELAN)
-        /* Elan croaks if we try to touch the KBC */
-        enable_a20_fast();
-        while (!a20_test_long())
-                ;
-        return 0;
-#elif defined(CONFIG_X86_VOYAGER)
+#ifdef CONFIG_X86_VOYAGER
         /* On Voyager, a20_test() is unsafe? */
         enable_a20_kbc();
         return 0;
 #else
        int loops = A20_ENABLE_LOOPS;
-        while (loops--) {
-                /* First, check to see if A20 is already enabled
-                   (legacy free, etc.) */
-                if (a20_test_short())
-                        return 0;
-
-                /* Next, try the BIOS (INT 0x15, AX=0x2401) */
-                enable_a20_bios();
-                if (a20_test_short())
-                        return 0;
-
-                /* Try enabling A20 through the keyboard controller */
-                empty_8042();
-                if (a20_test_short())
-                        return 0; /* BIOS worked, but with delayed reaction */
-
-                enable_a20_kbc();
-                if (a20_test_long())
-                        return 0;
-
-                /* Finally, try enabling the "fast A20 gate" */
-                enable_a20_fast();
-                if (a20_test_long())
-                        return 0;
-        }
-
-        return -1;
+       int kbc_err;
+
+       while (loops--) {
+               /* First, check to see if A20 is already enabled
+                  (legacy free, etc.) */
+               if (a20_test_short())
+                       return 0;
+               
+               /* Next, try the BIOS (INT 0x15, AX=0x2401) */
+               enable_a20_bios();
+               if (a20_test_short())
+                       return 0;
+               
+               /* Try enabling A20 through the keyboard controller */
+               kbc_err = empty_8042();
+
+               if (a20_test_short())
+                       return 0; /* BIOS worked, but with delayed reaction */
+        
+               if (!kbc_err) {
+                       enable_a20_kbc();
+                       if (a20_test_long())
+                               return 0;
+               }
+               
+               /* Finally, try enabling the "fast A20 gate" */
+               enable_a20_fast();
+               if (a20_test_long())
+                       return 0;
+       }
+       
+       return -1;
 #endif
 }
diff --git a/arch/x86/boot/video-vesa.c b/arch/x86/boot/video-vesa.c
index 75115849af3..4a58c8ce3f6 100644
--- a/arch/x86/boot/video-vesa.c
+++ b/arch/x86/boot/video-vesa.c
@@ -269,9 +269,8 @@ void vesa_store_edid(void)
            we genuinely have to assume all registers are destroyed here. */
 
         asm("pushw %%es; movw %2,%%es; "INT10"; popw %%es"
-            : "+a" (ax), "+b" (bx)
-            :  "c" (cx), "D" (di)
-            : "esi");
+            : "+a" (ax), "+b" (bx), "+c" (cx), "+D" (di)
+            : : "esi", "edx");
 
         if (ax != 0x004f)
                 return;         /* No EDID */
@@ -285,9 +284,9 @@ void vesa_store_edid(void)
         dx = 0;                 /* EDID block number */
         di =(size_t) &boot_params.edid_info; /* (ES:)Pointer to block */
         asm(INT10
-            : "+a" (ax), "+b" (bx), "+d" (dx), "=m" (boot_params.edid_info)
-            : "c" (cx), "D" (di)
-            : "esi");
+            : "+a" (ax), "+b" (bx), "+d" (dx), "=m" (boot_params.edid_info),
+              "+c" (cx), "+D" (di)
+            : : "esi");
 #endif /* CONFIG_FIRMWARE_EDID */
 }
 
diff --git a/arch/x86/configs/i386_defconfig b/arch/x86/configs/i386_defconfig
index edba00d98ac..096dd5359cd 100644
--- a/arch/x86/configs/i386_defconfig
+++ b/arch/x86/configs/i386_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.27-rc5
-# Wed Sep  3 17:23:09 2008
+# Linux kernel version: 2.6.29-rc4
+# Thu Feb 12 12:57:57 2009
 #
 # CONFIG_64BIT is not set
 CONFIG_X86_32=y
 # CONFIG_X86_64 is not set
 CONFIG_X86=y
 CONFIG_ARCH_DEFCONFIG="arch/x86/configs/i386_defconfig"
-# CONFIG_GENERIC_LOCKBREAK is not set
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CMOS_UPDATE=y
 CONFIG_CLOCKSOURCE_WATCHDOG=y
@@ -24,16 +23,14 @@ CONFIG_GENERIC_ISA_DMA=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_BUG=y
 CONFIG_GENERIC_HWEIGHT=y
-# CONFIG_GENERIC_GPIO is not set
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 # CONFIG_RWSEM_GENERIC_SPINLOCK is not set
 CONFIG_RWSEM_XCHGADD_ALGORITHM=y
-# CONFIG_ARCH_HAS_ILOG2_U32 is not set
-# CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_HAS_CPU_IDLE_WAIT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 # CONFIG_GENERIC_TIME_VSYSCALL is not set
 CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
 CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
 CONFIG_HAVE_SETUP_PER_CPU_AREA=y
 # CONFIG_HAVE_CPUMASK_OF_CPU_MAP is not set
@@ -42,12 +39,12 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 # CONFIG_ZONE_DMA32 is not set
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 # CONFIG_AUDIT_ARCH is not set
-CONFIG_ARCH_SUPPORTS_AOUT=y
 CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
 CONFIG_X86_SMP=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
 CONFIG_X86_32_SMP=y
 CONFIG_X86_HT=y
 CONFIG_X86_BIOS_REBOOT=y
@@ -76,30 +73,44 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
 CONFIG_AUDIT_TREE=y
+
+#
+# RCU Subsystem
+#
+# CONFIG_CLASSIC_RCU is not set
+CONFIG_TREE_RCU=y
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_RCU_FANOUT=32
+# CONFIG_RCU_FANOUT_EXACT is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=18
-CONFIG_CGROUPS=y
-# CONFIG_CGROUP_DEBUG is not set
-CONFIG_CGROUP_NS=y
-# CONFIG_CGROUP_DEVICE is not set
-CONFIG_CPUSETS=y
 CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 # CONFIG_USER_SCHED is not set
 CONFIG_CGROUP_SCHED=y
+CONFIG_CGROUPS=y
+# CONFIG_CGROUP_DEBUG is not set
+CONFIG_CGROUP_NS=y
+CONFIG_CGROUP_FREEZER=y
+# CONFIG_CGROUP_DEVICE is not set
+CONFIG_CPUSETS=y
+CONFIG_PROC_PID_CPUSET=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_RESOURCE_COUNTERS=y
 # CONFIG_CGROUP_MEM_RES_CTLR is not set
 # CONFIG_SYSFS_DEPRECATED_V2 is not set
-CONFIG_PROC_PID_CPUSET=y
 CONFIG_RELAY=y
 CONFIG_NAMESPACES=y
 CONFIG_UTS_NS=y
 CONFIG_IPC_NS=y
 CONFIG_USER_NS=y
 CONFIG_PID_NS=y
+CONFIG_NET_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -124,12 +135,15 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
+CONFIG_AIO=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
 CONFIG_SLUB_DEBUG=y
 # CONFIG_SLAB is not set
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 CONFIG_PROFILING=y
+CONFIG_TRACEPOINTS=y
 CONFIG_MARKERS=y
 # CONFIG_OPROFILE is not set
 CONFIG_HAVE_OPROFILE=y
@@ -139,15 +153,10 @@ CONFIG_KRETPROBES=y
 CONFIG_HAVE_IOREMAP_PROT=y
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
-# CONFIG_HAVE_ARCH_TRACEHOOK is not set
-# CONFIG_HAVE_DMA_ATTRS is not set
-CONFIG_USE_GENERIC_SMP_HELPERS=y
-# CONFIG_HAVE_CLK is not set
-CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
 CONFIG_HAVE_GENERIC_DMA_COHERENT=y
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -155,12 +164,10 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
 # CONFIG_LBD is not set
 CONFIG_BLK_DEV_IO_TRACE=y
-# CONFIG_LSF is not set
 CONFIG_BLK_DEV_BSG=y
 # CONFIG_BLK_DEV_INTEGRITY is not set
 
@@ -176,7 +183,7 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
-CONFIG_CLASSIC_RCU=y
+CONFIG_FREEZER=y
 
 #
 # Processor type and features
@@ -186,15 +193,15 @@ CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_SMP=y
+CONFIG_SPARSE_IRQ=y
 CONFIG_X86_FIND_SMP_CONFIG=y
 CONFIG_X86_MPPARSE=y
-CONFIG_X86_PC=y
 # CONFIG_X86_ELAN is not set
 # CONFIG_X86_VOYAGER is not set
 # CONFIG_X86_GENERICARCH is not set
 # CONFIG_X86_VSMP is not set
 # CONFIG_X86_RDC321X is not set
-CONFIG_SCHED_NO_NO_OMIT_FRAME_POINTER=y
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_PARAVIRT_GUEST is not set
 # CONFIG_MEMTEST is not set
 # CONFIG_M386 is not set
@@ -238,10 +245,19 @@ CONFIG_X86_TSC=y
 CONFIG_X86_CMOV=y
 CONFIG_X86_MINIMUM_CPU_FAMILY=4
 CONFIG_X86_DEBUGCTLMSR=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_CYRIX_32=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR_32=y
+CONFIG_CPU_SUP_TRANSMETA_32=y
+CONFIG_CPU_SUP_UMC_32=y
+CONFIG_X86_DS=y
+CONFIG_X86_PTRACE_BTS=y
 CONFIG_HPET_TIMER=y
 CONFIG_HPET_EMULATE_RTC=y
 CONFIG_DMI=y
 # CONFIG_IOMMU_HELPER is not set
+# CONFIG_IOMMU_API is not set
 CONFIG_NR_CPUS=64
 CONFIG_SCHED_SMT=y
 CONFIG_SCHED_MC=y
@@ -250,12 +266,15 @@ CONFIG_PREEMPT_VOLUNTARY=y
 # CONFIG_PREEMPT is not set
 CONFIG_X86_LOCAL_APIC=y
 CONFIG_X86_IO_APIC=y
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
 # CONFIG_X86_MCE is not set
 CONFIG_VM86=y
 # CONFIG_TOSHIBA is not set
 # CONFIG_I8K is not set
 CONFIG_X86_REBOOTFIXUPS=y
 CONFIG_MICROCODE=y
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_AMD=y
 CONFIG_MICROCODE_OLD_INTERFACE=y
 CONFIG_X86_MSR=y
 CONFIG_X86_CPUID=y
@@ -264,6 +283,7 @@ CONFIG_HIGHMEM4G=y
 # CONFIG_HIGHMEM64G is not set
 CONFIG_PAGE_OFFSET=0xC0000000
 CONFIG_HIGHMEM=y
+# CONFIG_ARCH_PHYS_ADDR_T_64BIT is not set
 CONFIG_ARCH_FLATMEM_ENABLE=y
 CONFIG_ARCH_SPARSEMEM_ENABLE=y
 CONFIG_ARCH_SELECT_MEMORY_MODEL=y
@@ -274,14 +294,17 @@ CONFIG_FLATMEM_MANUAL=y
 CONFIG_FLATMEM=y
 CONFIG_FLAT_NODE_MEM_MAP=y
 CONFIG_SPARSEMEM_STATIC=y
-# CONFIG_SPARSEMEM_VMEMMAP_ENABLE is not set
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
-CONFIG_RESOURCES_64BIT=y
+# CONFIG_PHYS_ADDR_T_64BIT is not set
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
+CONFIG_UNEVICTABLE_LRU=y
 CONFIG_HIGHPTE=y
+CONFIG_X86_CHECK_BIOS_CORRUPTION=y
+CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
+CONFIG_X86_RESERVE_LOW_64K=y
 # CONFIG_MATH_EMULATION is not set
 CONFIG_MTRR=y
 # CONFIG_MTRR_SANITIZER is not set
@@ -302,10 +325,11 @@ CONFIG_PHYSICAL_START=0x1000000
 CONFIG_PHYSICAL_ALIGN=0x200000
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_COMPAT_VDSO is not set
+# CONFIG_CMDLINE_BOOL is not set
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 
 #
-# Power management options
+# Power management and ACPI options
 #
 CONFIG_PM=y
 CONFIG_PM_DEBUG=y
@@ -331,19 +355,13 @@ CONFIG_ACPI_BATTERY=y
 CONFIG_ACPI_BUTTON=y
 CONFIG_ACPI_FAN=y
 CONFIG_ACPI_DOCK=y
-# CONFIG_ACPI_BAY is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
-# CONFIG_ACPI_WMI is not set
-# CONFIG_ACPI_ASUS is not set
-# CONFIG_ACPI_TOSHIBA is not set
 # CONFIG_ACPI_CUSTOM_DSDT is not set
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
-CONFIG_ACPI_EC=y
 # CONFIG_ACPI_PCI_SLOT is not set
-CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 CONFIG_X86_PM_TIMER=y
 CONFIG_ACPI_CONTAINER=y
@@ -388,7 +406,6 @@ CONFIG_X86_ACPI_CPUFREQ=y
 #
 # shared options
 #
-# CONFIG_X86_ACPI_CPUFREQ_PROC_INTF is not set
 # CONFIG_X86_SPEEDSTEP_LIB is not set
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
@@ -415,6 +432,7 @@ CONFIG_ARCH_SUPPORTS_MSI=y
 CONFIG_PCI_MSI=y
 # CONFIG_PCI_LEGACY is not set
 # CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_STUB is not set
 CONFIG_HT_IRQ=y
 CONFIG_ISA_DMA_API=y
 # CONFIG_ISA is not set
@@ -452,13 +470,17 @@ CONFIG_HOTPLUG_PCI=y
 # Executable file formats / Emulations
 #
 CONFIG_BINFMT_ELF=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+CONFIG_HAVE_AOUT=y
 # CONFIG_BINFMT_AOUT is not set
 CONFIG_BINFMT_MISC=y
+CONFIG_HAVE_ATOMIC_IOMAP=y
 CONFIG_NET=y
 
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -519,7 +541,6 @@ CONFIG_DEFAULT_CUBIC=y
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
 CONFIG_TCP_MD5SIG=y
-# CONFIG_IP_VS is not set
 CONFIG_IPV6=y
 # CONFIG_IPV6_PRIVACY is not set
 # CONFIG_IPV6_ROUTER_PREF is not set
@@ -557,19 +578,21 @@ CONFIG_NF_CONNTRACK_IRC=y
 CONFIG_NF_CONNTRACK_SIP=y
 CONFIG_NF_CT_NETLINK=y
 CONFIG_NETFILTER_XTABLES=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
 CONFIG_NETFILTER_XT_TARGET_MARK=y
 CONFIG_NETFILTER_XT_TARGET_NFLOG=y
 CONFIG_NETFILTER_XT_TARGET_SECMARK=y
-CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 CONFIG_NETFILTER_XT_MATCH_MARK=y
 CONFIG_NETFILTER_XT_MATCH_POLICY=y
 CONFIG_NETFILTER_XT_MATCH_STATE=y
+# CONFIG_IP_VS is not set
 
 #
 # IP: Netfilter Configuration
 #
+CONFIG_NF_DEFRAG_IPV4=y
 CONFIG_NF_CONNTRACK_IPV4=y
 CONFIG_NF_CONNTRACK_PROC_COMPAT=y
 CONFIG_IP_NF_IPTABLES=y
@@ -595,8 +618,8 @@ CONFIG_IP_NF_MANGLE=y
 CONFIG_NF_CONNTRACK_IPV6=y
 CONFIG_IP6_NF_IPTABLES=y
 CONFIG_IP6_NF_MATCH_IPV6HEADER=y
-CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_LOG=y
+CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_REJECT=y
 CONFIG_IP6_NF_MANGLE=y
 # CONFIG_IP_DCCP is not set
@@ -604,6 +627,7 @@ CONFIG_IP6_NF_MANGLE=y
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
+# CONFIG_NET_DSA is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
 CONFIG_LLC=y
@@ -623,6 +647,7 @@ CONFIG_NET_SCHED=y
 # CONFIG_NET_SCH_HTB is not set
 # CONFIG_NET_SCH_HFSC is not set
 # CONFIG_NET_SCH_PRIO is not set
+# CONFIG_NET_SCH_MULTIQ is not set
 # CONFIG_NET_SCH_RED is not set
 # CONFIG_NET_SCH_SFQ is not set
 # CONFIG_NET_SCH_TEQL is not set
@@ -630,6 +655,7 @@ CONFIG_NET_SCHED=y
 # CONFIG_NET_SCH_GRED is not set
 # CONFIG_NET_SCH_DSMARK is not set
 # CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_DRR is not set
 # CONFIG_NET_SCH_INGRESS is not set
 
 #
@@ -644,6 +670,7 @@ CONFIG_NET_CLS=y
 # CONFIG_NET_CLS_RSVP is not set
 # CONFIG_NET_CLS_RSVP6 is not set
 # CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_CLS_CGROUP is not set
 CONFIG_NET_EMATCH=y
 CONFIG_NET_EMATCH_STACK=32
 # CONFIG_NET_EMATCH_CMP is not set
@@ -659,7 +686,9 @@ CONFIG_NET_CLS_ACT=y
 # CONFIG_NET_ACT_NAT is not set
 # CONFIG_NET_ACT_PEDIT is not set
 # CONFIG_NET_ACT_SIMP is not set
+# CONFIG_NET_ACT_SKBEDIT is not set
 CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -676,29 +705,33 @@ CONFIG_HAMRADIO=y
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
+# CONFIG_PHONET is not set
 CONFIG_FIB_RULES=y
-
-#
-# Wireless
-#
+CONFIG_WIRELESS=y
 CONFIG_CFG80211=y
+# CONFIG_CFG80211_REG_DEBUG is not set
 CONFIG_NL80211=y
+CONFIG_WIRELESS_OLD_REGULATORY=y
 CONFIG_WIRELESS_EXT=y
 CONFIG_WIRELESS_EXT_SYSFS=y
+# CONFIG_LIB80211 is not set
 CONFIG_MAC80211=y
 
 #
 # Rate control algorithm selection
 #
-CONFIG_MAC80211_RC_PID=y
-CONFIG_MAC80211_RC_DEFAULT_PID=y
-CONFIG_MAC80211_RC_DEFAULT="pid"
+CONFIG_MAC80211_RC_MINSTREL=y
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel"
 # CONFIG_MAC80211_MESH is not set
 CONFIG_MAC80211_LEDS=y
 # CONFIG_MAC80211_DEBUGFS is not set
 # CONFIG_MAC80211_DEBUG_MENU is not set
-# CONFIG_IEEE80211 is not set
-# CONFIG_RFKILL is not set
+# CONFIG_WIMAX is not set
+CONFIG_RFKILL=y
+# CONFIG_RFKILL_INPUT is not set
+CONFIG_RFKILL_LEDS=y
 # CONFIG_NET_9P is not set
 
 #
@@ -722,7 +755,7 @@ CONFIG_PROC_EVENTS=y
 # CONFIG_MTD is not set
 # CONFIG_PARPORT is not set
 CONFIG_PNP=y
-# CONFIG_PNP_DEBUG is not set
+CONFIG_PNP_DEBUG_MESSAGES=y
 
 #
 # Protocols
@@ -750,20 +783,19 @@ CONFIG_BLK_DEV_RAM_SIZE=16384
 CONFIG_MISC_DEVICES=y
 # CONFIG_IBM_ASM is not set
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
-# CONFIG_ACER_WMI is not set
-# CONFIG_ASUS_LAPTOP is not set
-# CONFIG_FUJITSU_LAPTOP is not set
-# CONFIG_TC1100_WMI is not set
-# CONFIG_MSI_LAPTOP is not set
-# CONFIG_COMPAL_LAPTOP is not set
-# CONFIG_SONY_LAPTOP is not set
-# CONFIG_THINKPAD_ACPI is not set
-# CONFIG_INTEL_MENLOW is not set
+# CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_HP_ILO is not set
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -802,7 +834,7 @@ CONFIG_SCSI_WAIT_SCAN=m
 #
 CONFIG_SCSI_SPI_ATTRS=y
 # CONFIG_SCSI_FC_ATTRS is not set
-CONFIG_SCSI_ISCSI_ATTRS=y
+# CONFIG_SCSI_ISCSI_ATTRS is not set
 # CONFIG_SCSI_SAS_ATTRS is not set
 # CONFIG_SCSI_SAS_LIBSAS is not set
 # CONFIG_SCSI_SRP_ATTRS is not set
@@ -875,6 +907,7 @@ CONFIG_PATA_OLDPIIX=y
 CONFIG_PATA_SCH=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=y
+CONFIG_MD_AUTODETECT=y
 # CONFIG_MD_LINEAR is not set
 # CONFIG_MD_RAID0 is not set
 # CONFIG_MD_RAID1 is not set
@@ -930,6 +963,9 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -953,6 +989,9 @@ CONFIG_NET_TULIP=y
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 CONFIG_NET_PCI=y
 # CONFIG_PCNET32 is not set
 # CONFIG_AMD8111_ETH is not set
@@ -960,7 +999,6 @@ CONFIG_NET_PCI=y
 # CONFIG_B44 is not set
 CONFIG_FORCEDETH=y
 # CONFIG_FORCEDETH_NAPI is not set
-# CONFIG_EEPRO100 is not set
 CONFIG_E100=y
 # CONFIG_FEALNX is not set
 # CONFIG_NATSEMI is not set
@@ -974,15 +1012,16 @@ CONFIG_8139TOO=y
 # CONFIG_R6040 is not set
 # CONFIG_SIS900 is not set
 # CONFIG_EPIC100 is not set
+# CONFIG_SMSC9420 is not set
 # CONFIG_SUNDANCE is not set
 # CONFIG_TLAN is not set
 # CONFIG_VIA_RHINE is not set
 # CONFIG_SC92031 is not set
+# CONFIG_ATL2 is not set
 CONFIG_NETDEV_1000=y
 # CONFIG_ACENIC is not set
 # CONFIG_DL2K is not set
 CONFIG_E1000=y
-# CONFIG_E1000_DISABLE_PACKET_SPLIT is not set
 CONFIG_E1000E=y
 # CONFIG_IP1000 is not set
 # CONFIG_IGB is not set
@@ -1000,18 +1039,23 @@ CONFIG_BNX2=y
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
+# CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
+CONFIG_CHELSIO_T3_DEPENDS=y
 # CONFIG_CHELSIO_T3 is not set
+# CONFIG_ENIC is not set
 # CONFIG_IXGBE is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
 # CONFIG_MYRI10GE is not set
 # CONFIG_NETXEN_NIC is not set
 # CONFIG_NIU is not set
+# CONFIG_MLX4_EN is not set
 # CONFIG_MLX4_CORE is not set
 # CONFIG_TEHUTI is not set
 # CONFIG_BNX2X is not set
+# CONFIG_QLGE is not set
 # CONFIG_SFC is not set
 CONFIG_TR=y
 # CONFIG_IBMOL is not set
@@ -1025,9 +1069,8 @@ CONFIG_TR=y
 # CONFIG_WLAN_PRE80211 is not set
 CONFIG_WLAN_80211=y
 # CONFIG_PCMCIA_RAYCS is not set
-# CONFIG_IPW2100 is not set
-# CONFIG_IPW2200 is not set
 # CONFIG_LIBERTAS is not set
+# CONFIG_LIBERTAS_THINFIRM is not set
 # CONFIG_AIRO is not set
 # CONFIG_HERMES is not set
 # CONFIG_ATMEL is not set
@@ -1044,6 +1087,8 @@ CONFIG_WLAN_80211=y
 CONFIG_ATH5K=y
 # CONFIG_ATH5K_DEBUG is not set
 # CONFIG_ATH9K is not set
+# CONFIG_IPW2100 is not set
+# CONFIG_IPW2200 is not set
 # CONFIG_IWLCORE is not set
 # CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_IWLAGN is not set
@@ -1055,6 +1100,10 @@ CONFIG_ATH5K=y
 # CONFIG_RT2X00 is not set
 
 #
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+
+#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -1062,6 +1111,7 @@ CONFIG_ATH5K=y
 # CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
 # CONFIG_USB_USBNET is not set
+# CONFIG_USB_HSO is not set
 CONFIG_NET_PCMCIA=y
 # CONFIG_PCMCIA_3C589 is not set
 # CONFIG_PCMCIA_3C574 is not set
@@ -1123,6 +1173,7 @@ CONFIG_MOUSE_PS2_LOGIPS2PP=y
 CONFIG_MOUSE_PS2_SYNAPTICS=y
 CONFIG_MOUSE_PS2_LIFEBOOK=y
 CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
 # CONFIG_MOUSE_PS2_TOUCHKIT is not set
 # CONFIG_MOUSE_SERIAL is not set
 # CONFIG_MOUSE_APPLETOUCH is not set
@@ -1160,15 +1211,16 @@ CONFIG_INPUT_TOUCHSCREEN=y
 # CONFIG_TOUCHSCREEN_FUJITSU is not set
 # CONFIG_TOUCHSCREEN_GUNZE is not set
 # CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
 # CONFIG_TOUCHSCREEN_MTOUCH is not set
 # CONFIG_TOUCHSCREEN_INEXIO is not set
 # CONFIG_TOUCHSCREEN_MK712 is not set
 # CONFIG_TOUCHSCREEN_PENMOUNT is not set
 # CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
 # CONFIG_TOUCHSCREEN_TOUCHWIN is not set
-# CONFIG_TOUCHSCREEN_UCB1400 is not set
 # CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
 # CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TSC2007 is not set
 CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_PCSPKR is not set
 # CONFIG_INPUT_APANEL is not set
@@ -1179,6 +1231,7 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_KEYSPAN_REMOTE is not set
 # CONFIG_INPUT_POWERMATE is not set
 # CONFIG_INPUT_YEALINK is not set
+# CONFIG_INPUT_CM109 is not set
 # CONFIG_INPUT_UINPUT is not set
 
 #
@@ -1245,6 +1298,7 @@ CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
 CONFIG_HW_RANDOM=y
@@ -1279,6 +1333,7 @@ CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 # CONFIG_I2C_CHARDEV is not set
 CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_ALGOBIT=y
 
 #
 # I2C Hardware Bus support
@@ -1331,8 +1386,6 @@ CONFIG_I2C_I801=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -1351,8 +1404,78 @@ CONFIG_POWER_SUPPLY=y
 # CONFIG_POWER_SUPPLY_DEBUG is not set
 # CONFIG_PDA_POWER is not set
 # CONFIG_BATTERY_DS2760 is not set
-# CONFIG_HWMON is not set
+# CONFIG_BATTERY_BQ27x00 is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_ABITUGURU3 is not set
+# CONFIG_SENSORS_AD7414 is not set
+# CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
+# CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADT7462 is not set
+# CONFIG_SENSORS_ADT7470 is not set
+# CONFIG_SENSORS_ADT7473 is not set
+# CONFIG_SENSORS_ADT7475 is not set
+# CONFIG_SENSORS_K8TEMP is not set
+# CONFIG_SENSORS_ASB100 is not set
+# CONFIG_SENSORS_ATXP1 is not set
+# CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_F75375S is not set
+# CONFIG_SENSORS_FSCHER is not set
+# CONFIG_SENSORS_FSCPOS is not set
+# CONFIG_SENSORS_FSCHMD is not set
+# CONFIG_SENSORS_GL518SM is not set
+# CONFIG_SENSORS_GL520SM is not set
+# CONFIG_SENSORS_CORETEMP is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
+# CONFIG_SENSORS_LM78 is not set
+# CONFIG_SENSORS_LM80 is not set
+# CONFIG_SENSORS_LM83 is not set
+# CONFIG_SENSORS_LM85 is not set
+# CONFIG_SENSORS_LM87 is not set
+# CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
+# CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LTC4245 is not set
+# CONFIG_SENSORS_MAX1619 is not set
+# CONFIG_SENSORS_MAX6650 is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_DME1737 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_ADS7828 is not set
+# CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
+# CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
+# CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_SENSORS_HDAPS is not set
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_SENSORS_APPLESMC is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 CONFIG_THERMAL=y
+# CONFIG_THERMAL_HWMON is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
 
@@ -1372,6 +1495,7 @@ CONFIG_WATCHDOG=y
 # CONFIG_I6300ESB_WDT is not set
 # CONFIG_ITCO_WDT is not set
 # CONFIG_IT8712F_WDT is not set
+# CONFIG_IT87_WDT is not set
 # CONFIG_HP_WATCHDOG is not set
 # CONFIG_SC1200_WDT is not set
 # CONFIG_PC87413_WDT is not set
@@ -1379,9 +1503,11 @@ CONFIG_WATCHDOG=y
 # CONFIG_SBC8360_WDT is not set
 # CONFIG_SBC7240_WDT is not set
 # CONFIG_CPU5_WDT is not set
+# CONFIG_SMSC_SCH311X_WDT is not set
 # CONFIG_SMSC37B787_WDT is not set
 # CONFIG_W83627HF_WDT is not set
 # CONFIG_W83697HF_WDT is not set
+# CONFIG_W83697UG_WDT is not set
 # CONFIG_W83877F_WDT is not set
 # CONFIG_W83977F_WDT is not set
 # CONFIG_MACHZ_WDT is not set
@@ -1397,11 +1523,11 @@ CONFIG_WATCHDOG=y
 # USB-based Watchdog Cards
 #
 # CONFIG_USBPCWATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
 
 #
 # Sonics Silicon Backplane
 #
-CONFIG_SSB_POSSIBLE=y
 # CONFIG_SSB is not set
 
 #
@@ -1410,7 +1536,13 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_REGULATOR is not set
 
 #
 # Multimedia devices
@@ -1450,6 +1582,7 @@ CONFIG_DRM=y
 # CONFIG_DRM_I810 is not set
 # CONFIG_DRM_I830 is not set
 CONFIG_DRM_I915=y
+# CONFIG_DRM_I915_KMS is not set
 # CONFIG_DRM_MGA is not set
 # CONFIG_DRM_SIS is not set
 # CONFIG_DRM_VIA is not set
@@ -1459,6 +1592,7 @@ CONFIG_DRM_I915=y
 CONFIG_FB=y
 # CONFIG_FIRMWARE_EDID is not set
 # CONFIG_FB_DDC is not set
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
@@ -1487,7 +1621,6 @@ CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_UVESA is not set
 # CONFIG_FB_VESA is not set
 CONFIG_FB_EFI=y
-# CONFIG_FB_IMAC is not set
 # CONFIG_FB_N411 is not set
 # CONFIG_FB_HGA is not set
 # CONFIG_FB_S1D13XXX is not set
@@ -1503,6 +1636,7 @@ CONFIG_FB_EFI=y
 # CONFIG_FB_S3 is not set
 # CONFIG_FB_SAVAGE is not set
 # CONFIG_FB_SIS is not set
+# CONFIG_FB_VIA is not set
 # CONFIG_FB_NEOMAGIC is not set
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
@@ -1515,12 +1649,15 @@ CONFIG_FB_EFI=y
 # CONFIG_FB_CARMINE is not set
 # CONFIG_FB_GEODE is not set
 # CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MB862XX is not set
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 # CONFIG_LCD_CLASS_DEVICE is not set
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
-# CONFIG_BACKLIGHT_CORGI is not set
+CONFIG_BACKLIGHT_GENERIC=y
 # CONFIG_BACKLIGHT_PROGEAR is not set
 # CONFIG_BACKLIGHT_MBP_NVIDIA is not set
+# CONFIG_BACKLIGHT_SAHARA is not set
 
 #
 # Display device support
@@ -1540,10 +1677,12 @@ CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_VGA16 is not set
 CONFIG_LOGO_LINUX_CLUT224=y
 CONFIG_SOUND=y
+CONFIG_SOUND_OSS_CORE=y
 CONFIG_SND=y
 CONFIG_SND_TIMER=y
 CONFIG_SND_PCM=y
 CONFIG_SND_HWDEP=y
+CONFIG_SND_JACK=y
 CONFIG_SND_SEQUENCER=y
 CONFIG_SND_SEQ_DUMMY=y
 CONFIG_SND_OSSEMUL=y
@@ -1551,6 +1690,8 @@ CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_PCM_OSS_PLUGINS=y
 CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_HRTIMER=y
+CONFIG_SND_SEQ_HRTIMER_DEFAULT=y
 CONFIG_SND_DYNAMIC_MINORS=y
 CONFIG_SND_SUPPORT_OLD_API=y
 CONFIG_SND_VERBOSE_PROCFS=y
@@ -1605,11 +1746,16 @@ CONFIG_SND_PCI=y
 # CONFIG_SND_FM801 is not set
 CONFIG_SND_HDA_INTEL=y
 CONFIG_SND_HDA_HWDEP=y
+# CONFIG_SND_HDA_RECONFIG is not set
+# CONFIG_SND_HDA_INPUT_BEEP is not set
 CONFIG_SND_HDA_CODEC_REALTEK=y
 CONFIG_SND_HDA_CODEC_ANALOG=y
 CONFIG_SND_HDA_CODEC_SIGMATEL=y
 CONFIG_SND_HDA_CODEC_VIA=y
 CONFIG_SND_HDA_CODEC_ATIHDMI=y
+CONFIG_SND_HDA_CODEC_NVHDMI=y
+CONFIG_SND_HDA_CODEC_INTELHDMI=y
+CONFIG_SND_HDA_ELD=y
 CONFIG_SND_HDA_CODEC_CONEXANT=y
 CONFIG_SND_HDA_CODEC_CMEDIA=y
 CONFIG_SND_HDA_CODEC_SI3054=y
@@ -1643,6 +1789,7 @@ CONFIG_SND_USB=y
 # CONFIG_SND_USB_AUDIO is not set
 # CONFIG_SND_USB_USX2Y is not set
 # CONFIG_SND_USB_CAIAQ is not set
+# CONFIG_SND_USB_US122L is not set
 CONFIG_SND_PCMCIA=y
 # CONFIG_SND_VXPOCKET is not set
 # CONFIG_SND_PDAUDIOCF is not set
@@ -1657,15 +1804,37 @@ CONFIG_HIDRAW=y
 # USB Input Devices
 #
 CONFIG_USB_HID=y
-CONFIG_USB_HIDINPUT_POWERBOOK=y
-CONFIG_HID_FF=y
 CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+
+#
+# Special HID drivers
+#
+CONFIG_HID_COMPAT=y
+CONFIG_HID_A4TECH=y
+CONFIG_HID_APPLE=y
+CONFIG_HID_BELKIN=y
+CONFIG_HID_CHERRY=y
+CONFIG_HID_CHICONY=y
+CONFIG_HID_CYPRESS=y
+CONFIG_HID_EZKEY=y
+CONFIG_HID_GYRATION=y
+CONFIG_HID_LOGITECH=y
 CONFIG_LOGITECH_FF=y
 # CONFIG_LOGIRUMBLEPAD2_FF is not set
+CONFIG_HID_MICROSOFT=y
+CONFIG_HID_MONTEREY=y
+CONFIG_HID_NTRIG=y
+CONFIG_HID_PANTHERLORD=y
 CONFIG_PANTHERLORD_FF=y
+CONFIG_HID_PETALYNX=y
+CONFIG_HID_SAMSUNG=y
+CONFIG_HID_SONY=y
+CONFIG_HID_SUNPLUS=y
+# CONFIG_GREENASIA_FF is not set
+CONFIG_HID_TOPSEED=y
 CONFIG_THRUSTMASTER_FF=y
 CONFIG_ZEROPLUS_FF=y
-CONFIG_USB_HIDDEV=y
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
@@ -1683,6 +1852,8 @@ CONFIG_USB_DEVICEFS=y
 CONFIG_USB_SUSPEND=y
 # CONFIG_USB_OTG is not set
 CONFIG_USB_MON=y
+# CONFIG_USB_WUSB is not set
+# CONFIG_USB_WUSB_CBAF is not set
 
 #
 # USB Host Controller Drivers
@@ -1691,6 +1862,7 @@ CONFIG_USB_MON=y
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
 # CONFIG_USB_EHCI_TT_NEWSCHED is not set
+# CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=y
@@ -1700,6 +1872,8 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 CONFIG_USB_UHCI_HCD=y
 # CONFIG_USB_SL811_HCD is not set
 # CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_WHCI_HCD is not set
+# CONFIG_USB_HWA_HCD is not set
 
 #
 # USB Device Class drivers
@@ -1707,20 +1881,20 @@ CONFIG_USB_UHCI_HCD=y
 # CONFIG_USB_ACM is not set
 CONFIG_USB_PRINTER=y
 # CONFIG_USB_WDM is not set
+# CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
-# CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
@@ -1728,7 +1902,6 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
 # CONFIG_USB_STORAGE_KARMA is not set
-# CONFIG_USB_STORAGE_SIERRA is not set
 # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
 CONFIG_USB_LIBUSUAL=y
 
@@ -1749,6 +1922,7 @@ CONFIG_USB_LIBUSUAL=y
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
 # CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_SEVSEG is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
@@ -1766,7 +1940,13 @@ CONFIG_USB_LIBUSUAL=y
 # CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 # CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 CONFIG_NEW_LEDS=y
@@ -1775,6 +1955,7 @@ CONFIG_LEDS_CLASS=y
 #
 # LED drivers
 #
+# CONFIG_LEDS_ALIX2 is not set
 # CONFIG_LEDS_PCA9532 is not set
 # CONFIG_LEDS_CLEVO_MAIL is not set
 # CONFIG_LEDS_PCA955X is not set
@@ -1785,6 +1966,7 @@ CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_TRIGGERS=y
 # CONFIG_LEDS_TRIGGER_TIMER is not set
 # CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
 # CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_INFINIBAND is not set
@@ -1824,6 +2006,7 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_M41T80 is not set
 # CONFIG_RTC_DRV_S35390A is not set
 # CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
 
 #
 # SPI RTC drivers
@@ -1833,12 +2016,15 @@ CONFIG_RTC_INTF_DEV=y
 # Platform RTC drivers
 #
 CONFIG_RTC_DRV_CMOS=y
+# CONFIG_RTC_DRV_DS1286 is not set
 # CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
 # CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
 # CONFIG_RTC_DRV_V3020 is not set
 
 #
@@ -1851,6 +2037,22 @@ CONFIG_DMADEVICES=y
 #
 # CONFIG_INTEL_IOATDMA is not set
 # CONFIG_UIO is not set
+# CONFIG_STAGING is not set
+CONFIG_X86_PLATFORM_DEVICES=y
+# CONFIG_ACER_WMI is not set
+# CONFIG_ASUS_LAPTOP is not set
+# CONFIG_FUJITSU_LAPTOP is not set
+# CONFIG_TC1100_WMI is not set
+# CONFIG_MSI_LAPTOP is not set
+# CONFIG_PANASONIC_LAPTOP is not set
+# CONFIG_COMPAL_LAPTOP is not set
+# CONFIG_SONY_LAPTOP is not set
+# CONFIG_THINKPAD_ACPI is not set
+# CONFIG_INTEL_MENLOW is not set
+CONFIG_EEEPC_LAPTOP=y
+# CONFIG_ACPI_WMI is not set
+# CONFIG_ACPI_ASUS is not set
+# CONFIG_ACPI_TOSHIBA is not set
 
 #
 # Firmware Drivers
@@ -1861,8 +2063,7 @@ CONFIG_EFI_VARS=y
 # CONFIG_DELL_RBU is not set
 # CONFIG_DCDBAS is not set
 CONFIG_DMIID=y
-CONFIG_ISCSI_IBFT_FIND=y
-CONFIG_ISCSI_IBFT=y
+# CONFIG_ISCSI_IBFT_FIND is not set
 
 #
 # File systems
@@ -1872,21 +2073,24 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 CONFIG_EXT3_FS_SECURITY=y
-# CONFIG_EXT4DEV_FS is not set
+# CONFIG_EXT4_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
+CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
+CONFIG_QUOTA_TREE=y
 # CONFIG_QFMT_V1 is not set
 CONFIG_QFMT_V2=y
 CONFIG_QUOTACTL=y
@@ -1920,16 +2124,14 @@ CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_PROC_VMCORE=y
 CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_ECRYPT_FS is not set
@@ -1939,6 +2141,7 @@ CONFIG_HUGETLB_PAGE=y
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1960,6 +2163,7 @@ CONFIG_NFS_ACL_SUPPORT=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
+# CONFIG_SUNRPC_REGISTER_V4 is not set
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
@@ -2036,7 +2240,7 @@ CONFIG_NLS_UTF8=y
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 CONFIG_PRINTK_TIME=y
-CONFIG_ENABLE_WARN_DEPRECATED=y
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_FRAME_WARN=2048
 CONFIG_MAGIC_SYSRQ=y
@@ -2066,33 +2270,54 @@ CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VIRTUAL is not set
 # CONFIG_DEBUG_WRITECOUNT is not set
 CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
 CONFIG_FRAME_POINTER=y
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 # CONFIG_KPROBES_SANITY_TEST is not set
 # CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_HAVE_FTRACE=y
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
-# CONFIG_FTRACE is not set
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_HW_BRANCH_TRACER=y
+
+#
+# Tracers
+#
+# CONFIG_FUNCTION_TRACER is not set
 # CONFIG_IRQSOFF_TRACER is not set
 # CONFIG_SYSPROF_TRACER is not set
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
+# CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
+# CONFIG_POWER_TRACER is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_HW_BRANCH_TRACER is not set
 CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
+# CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
 # CONFIG_STRICT_DEVMEM is not set
 CONFIG_X86_VERBOSE_BOOTUP=y
 CONFIG_EARLY_PRINTK=y
+CONFIG_EARLY_PRINTK_DBGP=y
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 # CONFIG_DEBUG_PAGEALLOC is not set
@@ -2123,8 +2348,10 @@ CONFIG_OPTIMIZE_INLINING=y
 CONFIG_KEYS=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
 CONFIG_SECURITY=y
+# CONFIG_SECURITYFS is not set
 CONFIG_SECURITY_NETWORK=y
 # CONFIG_SECURITY_NETWORK_XFRM is not set
+# CONFIG_SECURITY_PATH is not set
 CONFIG_SECURITY_FILE_CAPABILITIES=y
 # CONFIG_SECURITY_ROOTPLUG is not set
 CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR=65536
@@ -2135,7 +2362,6 @@ CONFIG_SECURITY_SELINUX_DISABLE=y
 CONFIG_SECURITY_SELINUX_DEVELOP=y
 CONFIG_SECURITY_SELINUX_AVC_STATS=y
 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
-# CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT is not set
 # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
 # CONFIG_SECURITY_SMACK is not set
 CONFIG_CRYPTO=y
@@ -2143,11 +2369,18 @@ CONFIG_CRYPTO=y
 #
 # Crypto core or helper
 #
+# CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
 CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
@@ -2182,6 +2415,7 @@ CONFIG_CRYPTO_HMAC=y
 # Digest
 #
 # CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CRC32C_INTEL is not set
 # CONFIG_CRYPTO_MD4 is not set
 CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
@@ -2222,6 +2456,11 @@ CONFIG_CRYPTO_DES=y
 #
 # CONFIG_CRYPTO_DEFLATE is not set
 # CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_DEV_PADLOCK is not set
 # CONFIG_CRYPTO_DEV_GEODE is not set
@@ -2239,6 +2478,7 @@ CONFIG_VIRTUALIZATION=y
 CONFIG_BITREVERSE=y
 CONFIG_GENERIC_FIND_FIRST_BIT=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 CONFIG_CRC_T10DIF=y
diff --git a/arch/x86/configs/x86_64_defconfig b/arch/x86/configs/x86_64_defconfig
index 322dd2748fc..2efb5d5063f 100644
--- a/arch/x86/configs/x86_64_defconfig
+++ b/arch/x86/configs/x86_64_defconfig
@@ -1,14 +1,13 @@
 #
 # Automatically generated make config: don't edit
-# Linux kernel version: 2.6.27-rc5
-# Wed Sep  3 17:13:39 2008
+# Linux kernel version: 2.6.29-rc4
+# Thu Feb 12 12:57:29 2009
 #
 CONFIG_64BIT=y
 # CONFIG_X86_32 is not set
 CONFIG_X86_64=y
 CONFIG_X86=y
 CONFIG_ARCH_DEFCONFIG="arch/x86/configs/x86_64_defconfig"
-# CONFIG_GENERIC_LOCKBREAK is not set
 CONFIG_GENERIC_TIME=y
 CONFIG_GENERIC_CMOS_UPDATE=y
 CONFIG_CLOCKSOURCE_WATCHDOG=y
@@ -23,17 +22,16 @@ CONFIG_ZONE_DMA=y
 CONFIG_GENERIC_ISA_DMA=y
 CONFIG_GENERIC_IOMAP=y
 CONFIG_GENERIC_BUG=y
+CONFIG_GENERIC_BUG_RELATIVE_POINTERS=y
 CONFIG_GENERIC_HWEIGHT=y
-# CONFIG_GENERIC_GPIO is not set
 CONFIG_ARCH_MAY_HAVE_PC_FDC=y
 CONFIG_RWSEM_GENERIC_SPINLOCK=y
 # CONFIG_RWSEM_XCHGADD_ALGORITHM is not set
-# CONFIG_ARCH_HAS_ILOG2_U32 is not set
-# CONFIG_ARCH_HAS_ILOG2_U64 is not set
 CONFIG_ARCH_HAS_CPU_IDLE_WAIT=y
 CONFIG_GENERIC_CALIBRATE_DELAY=y
 CONFIG_GENERIC_TIME_VSYSCALL=y
 CONFIG_ARCH_HAS_CPU_RELAX=y
+CONFIG_ARCH_HAS_DEFAULT_IDLE=y
 CONFIG_ARCH_HAS_CACHE_LINE_SIZE=y
 CONFIG_HAVE_SETUP_PER_CPU_AREA=y
 CONFIG_HAVE_CPUMASK_OF_CPU_MAP=y
@@ -42,12 +40,12 @@ CONFIG_ARCH_SUSPEND_POSSIBLE=y
 CONFIG_ZONE_DMA32=y
 CONFIG_ARCH_POPULATES_NODE_MAP=y
 CONFIG_AUDIT_ARCH=y
-CONFIG_ARCH_SUPPORTS_AOUT=y
 CONFIG_ARCH_SUPPORTS_OPTIMIZED_INLINING=y
 CONFIG_GENERIC_HARDIRQS=y
 CONFIG_GENERIC_IRQ_PROBE=y
 CONFIG_GENERIC_PENDING_IRQ=y
 CONFIG_X86_SMP=y
+CONFIG_USE_GENERIC_SMP_HELPERS=y
 CONFIG_X86_64_SMP=y
 CONFIG_X86_HT=y
 CONFIG_X86_BIOS_REBOOT=y
@@ -76,30 +74,44 @@ CONFIG_TASK_IO_ACCOUNTING=y
 CONFIG_AUDIT=y
 CONFIG_AUDITSYSCALL=y
 CONFIG_AUDIT_TREE=y
+
+#
+# RCU Subsystem
+#
+# CONFIG_CLASSIC_RCU is not set
+CONFIG_TREE_RCU=y
+# CONFIG_PREEMPT_RCU is not set
+# CONFIG_RCU_TRACE is not set
+CONFIG_RCU_FANOUT=64
+# CONFIG_RCU_FANOUT_EXACT is not set
+# CONFIG_TREE_RCU_TRACE is not set
+# CONFIG_PREEMPT_RCU_TRACE is not set
 # CONFIG_IKCONFIG is not set
 CONFIG_LOG_BUF_SHIFT=18
-CONFIG_CGROUPS=y
-# CONFIG_CGROUP_DEBUG is not set
-CONFIG_CGROUP_NS=y
-# CONFIG_CGROUP_DEVICE is not set
-CONFIG_CPUSETS=y
 CONFIG_HAVE_UNSTABLE_SCHED_CLOCK=y
 CONFIG_GROUP_SCHED=y
 CONFIG_FAIR_GROUP_SCHED=y
 # CONFIG_RT_GROUP_SCHED is not set
 # CONFIG_USER_SCHED is not set
 CONFIG_CGROUP_SCHED=y
+CONFIG_CGROUPS=y
+# CONFIG_CGROUP_DEBUG is not set
+CONFIG_CGROUP_NS=y
+CONFIG_CGROUP_FREEZER=y
+# CONFIG_CGROUP_DEVICE is not set
+CONFIG_CPUSETS=y
+CONFIG_PROC_PID_CPUSET=y
 CONFIG_CGROUP_CPUACCT=y
 CONFIG_RESOURCE_COUNTERS=y
 # CONFIG_CGROUP_MEM_RES_CTLR is not set
 # CONFIG_SYSFS_DEPRECATED_V2 is not set
-CONFIG_PROC_PID_CPUSET=y
 CONFIG_RELAY=y
 CONFIG_NAMESPACES=y
 CONFIG_UTS_NS=y
 CONFIG_IPC_NS=y
 CONFIG_USER_NS=y
 CONFIG_PID_NS=y
+CONFIG_NET_NS=y
 CONFIG_BLK_DEV_INITRD=y
 CONFIG_INITRAMFS_SOURCE=""
 CONFIG_CC_OPTIMIZE_FOR_SIZE=y
@@ -124,12 +136,15 @@ CONFIG_SIGNALFD=y
 CONFIG_TIMERFD=y
 CONFIG_EVENTFD=y
 CONFIG_SHMEM=y
+CONFIG_AIO=y
 CONFIG_VM_EVENT_COUNTERS=y
+CONFIG_PCI_QUIRKS=y
 CONFIG_SLUB_DEBUG=y
 # CONFIG_SLAB is not set
 CONFIG_SLUB=y
 # CONFIG_SLOB is not set
 CONFIG_PROFILING=y
+CONFIG_TRACEPOINTS=y
 CONFIG_MARKERS=y
 # CONFIG_OPROFILE is not set
 CONFIG_HAVE_OPROFILE=y
@@ -139,15 +154,10 @@ CONFIG_KRETPROBES=y
 CONFIG_HAVE_IOREMAP_PROT=y
 CONFIG_HAVE_KPROBES=y
 CONFIG_HAVE_KRETPROBES=y
-# CONFIG_HAVE_ARCH_TRACEHOOK is not set
-# CONFIG_HAVE_DMA_ATTRS is not set
-CONFIG_USE_GENERIC_SMP_HELPERS=y
-# CONFIG_HAVE_CLK is not set
-CONFIG_PROC_PAGE_MONITOR=y
+CONFIG_HAVE_ARCH_TRACEHOOK=y
 # CONFIG_HAVE_GENERIC_DMA_COHERENT is not set
 CONFIG_SLABINFO=y
 CONFIG_RT_MUTEXES=y
-# CONFIG_TINY_SHMEM is not set
 CONFIG_BASE_SMALL=0
 CONFIG_MODULES=y
 # CONFIG_MODULE_FORCE_LOAD is not set
@@ -155,7 +165,6 @@ CONFIG_MODULE_UNLOAD=y
 CONFIG_MODULE_FORCE_UNLOAD=y
 # CONFIG_MODVERSIONS is not set
 # CONFIG_MODULE_SRCVERSION_ALL is not set
-CONFIG_KMOD=y
 CONFIG_STOP_MACHINE=y
 CONFIG_BLOCK=y
 CONFIG_BLK_DEV_IO_TRACE=y
@@ -175,7 +184,7 @@ CONFIG_IOSCHED_CFQ=y
 CONFIG_DEFAULT_CFQ=y
 # CONFIG_DEFAULT_NOOP is not set
 CONFIG_DEFAULT_IOSCHED="cfq"
-CONFIG_CLASSIC_RCU=y
+CONFIG_FREEZER=y
 
 #
 # Processor type and features
@@ -185,13 +194,15 @@ CONFIG_NO_HZ=y
 CONFIG_HIGH_RES_TIMERS=y
 CONFIG_GENERIC_CLOCKEVENTS_BUILD=y
 CONFIG_SMP=y
+CONFIG_SPARSE_IRQ=y
+# CONFIG_NUMA_MIGRATE_IRQ_DESC is not set
 CONFIG_X86_FIND_SMP_CONFIG=y
 CONFIG_X86_MPPARSE=y
-CONFIG_X86_PC=y
 # CONFIG_X86_ELAN is not set
 # CONFIG_X86_VOYAGER is not set
 # CONFIG_X86_GENERICARCH is not set
 # CONFIG_X86_VSMP is not set
+CONFIG_SCHED_OMIT_FRAME_POINTER=y
 # CONFIG_PARAVIRT_GUEST is not set
 # CONFIG_MEMTEST is not set
 # CONFIG_M386 is not set
@@ -230,6 +241,11 @@ CONFIG_X86_CMPXCHG64=y
 CONFIG_X86_CMOV=y
 CONFIG_X86_MINIMUM_CPU_FAMILY=64
 CONFIG_X86_DEBUGCTLMSR=y
+CONFIG_CPU_SUP_INTEL=y
+CONFIG_CPU_SUP_AMD=y
+CONFIG_CPU_SUP_CENTAUR_64=y
+CONFIG_X86_DS=y
+CONFIG_X86_PTRACE_BTS=y
 CONFIG_HPET_TIMER=y
 CONFIG_HPET_EMULATE_RTC=y
 CONFIG_DMI=y
@@ -237,8 +253,11 @@ CONFIG_GART_IOMMU=y
 CONFIG_CALGARY_IOMMU=y
 CONFIG_CALGARY_IOMMU_ENABLED_BY_DEFAULT=y
 CONFIG_AMD_IOMMU=y
+CONFIG_AMD_IOMMU_STATS=y
 CONFIG_SWIOTLB=y
 CONFIG_IOMMU_HELPER=y
+CONFIG_IOMMU_API=y
+# CONFIG_MAXSMP is not set
 CONFIG_NR_CPUS=64
 CONFIG_SCHED_SMT=y
 CONFIG_SCHED_MC=y
@@ -247,12 +266,17 @@ CONFIG_PREEMPT_VOLUNTARY=y
 # CONFIG_PREEMPT is not set
 CONFIG_X86_LOCAL_APIC=y
 CONFIG_X86_IO_APIC=y
+CONFIG_X86_REROUTE_FOR_BROKEN_BOOT_IRQS=y
 # CONFIG_X86_MCE is not set
 # CONFIG_I8K is not set
 CONFIG_MICROCODE=y
+CONFIG_MICROCODE_INTEL=y
+CONFIG_MICROCODE_AMD=y
 CONFIG_MICROCODE_OLD_INTERFACE=y
 CONFIG_X86_MSR=y
 CONFIG_X86_CPUID=y
+CONFIG_ARCH_PHYS_ADDR_T_64BIT=y
+CONFIG_DIRECT_GBPAGES=y
 CONFIG_NUMA=y
 CONFIG_K8_NUMA=y
 CONFIG_X86_64_ACPI_NUMA=y
@@ -269,7 +293,6 @@ CONFIG_SPARSEMEM_MANUAL=y
 CONFIG_SPARSEMEM=y
 CONFIG_NEED_MULTIPLE_NODES=y
 CONFIG_HAVE_MEMORY_PRESENT=y
-# CONFIG_SPARSEMEM_STATIC is not set
 CONFIG_SPARSEMEM_EXTREME=y
 CONFIG_SPARSEMEM_VMEMMAP_ENABLE=y
 CONFIG_SPARSEMEM_VMEMMAP=y
@@ -280,10 +303,14 @@ CONFIG_SPARSEMEM_VMEMMAP=y
 CONFIG_PAGEFLAGS_EXTENDED=y
 CONFIG_SPLIT_PTLOCK_CPUS=4
 CONFIG_MIGRATION=y
-CONFIG_RESOURCES_64BIT=y
+CONFIG_PHYS_ADDR_T_64BIT=y
 CONFIG_ZONE_DMA_FLAG=1
 CONFIG_BOUNCE=y
 CONFIG_VIRT_TO_BUS=y
+CONFIG_UNEVICTABLE_LRU=y
+CONFIG_X86_CHECK_BIOS_CORRUPTION=y
+CONFIG_X86_BOOTPARAM_MEMORY_CORRUPTION_CHECK=y
+CONFIG_X86_RESERVE_LOW_64K=y
 CONFIG_MTRR=y
 # CONFIG_MTRR_SANITIZER is not set
 CONFIG_X86_PAT=y
@@ -302,11 +329,12 @@ CONFIG_PHYSICAL_START=0x1000000
 CONFIG_PHYSICAL_ALIGN=0x200000
 CONFIG_HOTPLUG_CPU=y
 # CONFIG_COMPAT_VDSO is not set
+# CONFIG_CMDLINE_BOOL is not set
 CONFIG_ARCH_ENABLE_MEMORY_HOTPLUG=y
 CONFIG_HAVE_ARCH_EARLY_PFN_TO_NID=y
 
 #
-# Power management options
+# Power management and ACPI options
 #
 CONFIG_ARCH_HIBERNATION_HEADER=y
 CONFIG_PM=y
@@ -333,20 +361,14 @@ CONFIG_ACPI_BATTERY=y
 CONFIG_ACPI_BUTTON=y
 CONFIG_ACPI_FAN=y
 CONFIG_ACPI_DOCK=y
-# CONFIG_ACPI_BAY is not set
 CONFIG_ACPI_PROCESSOR=y
 CONFIG_ACPI_HOTPLUG_CPU=y
 CONFIG_ACPI_THERMAL=y
 CONFIG_ACPI_NUMA=y
-# CONFIG_ACPI_WMI is not set
-# CONFIG_ACPI_ASUS is not set
-# CONFIG_ACPI_TOSHIBA is not set
 # CONFIG_ACPI_CUSTOM_DSDT is not set
 CONFIG_ACPI_BLACKLIST_YEAR=0
 # CONFIG_ACPI_DEBUG is not set
-CONFIG_ACPI_EC=y
 # CONFIG_ACPI_PCI_SLOT is not set
-CONFIG_ACPI_POWER=y
 CONFIG_ACPI_SYSTEM=y
 CONFIG_X86_PM_TIMER=y
 CONFIG_ACPI_CONTAINER=y
@@ -381,13 +403,17 @@ CONFIG_X86_ACPI_CPUFREQ=y
 #
 # shared options
 #
-# CONFIG_X86_ACPI_CPUFREQ_PROC_INTF is not set
 # CONFIG_X86_SPEEDSTEP_LIB is not set
 CONFIG_CPU_IDLE=y
 CONFIG_CPU_IDLE_GOV_LADDER=y
 CONFIG_CPU_IDLE_GOV_MENU=y
 
 #
+# Memory power savings
+#
+# CONFIG_I7300_IDLE is not set
+
+#
 # Bus options (PCI etc.)
 #
 CONFIG_PCI=y
@@ -395,8 +421,10 @@ CONFIG_PCI_DIRECT=y
 CONFIG_PCI_MMCONFIG=y
 CONFIG_PCI_DOMAINS=y
 CONFIG_DMAR=y
+# CONFIG_DMAR_DEFAULT_ON is not set
 CONFIG_DMAR_GFX_WA=y
 CONFIG_DMAR_FLOPPY_WA=y
+# CONFIG_INTR_REMAP is not set
 CONFIG_PCIEPORTBUS=y
 # CONFIG_HOTPLUG_PCI_PCIE is not set
 CONFIG_PCIEAER=y
@@ -405,6 +433,7 @@ CONFIG_ARCH_SUPPORTS_MSI=y
 CONFIG_PCI_MSI=y
 # CONFIG_PCI_LEGACY is not set
 # CONFIG_PCI_DEBUG is not set
+# CONFIG_PCI_STUB is not set
 CONFIG_HT_IRQ=y
 CONFIG_ISA_DMA_API=y
 CONFIG_K8_NB=y
@@ -438,6 +467,8 @@ CONFIG_HOTPLUG_PCI=y
 #
 CONFIG_BINFMT_ELF=y
 CONFIG_COMPAT_BINFMT_ELF=y
+CONFIG_CORE_DUMP_DEFAULT_ELF_HEADERS=y
+# CONFIG_HAVE_AOUT is not set
 CONFIG_BINFMT_MISC=y
 CONFIG_IA32_EMULATION=y
 # CONFIG_IA32_AOUT is not set
@@ -449,6 +480,7 @@ CONFIG_NET=y
 #
 # Networking options
 #
+CONFIG_COMPAT_NET_DEV_OPS=y
 CONFIG_PACKET=y
 CONFIG_PACKET_MMAP=y
 CONFIG_UNIX=y
@@ -509,7 +541,6 @@ CONFIG_DEFAULT_CUBIC=y
 # CONFIG_DEFAULT_RENO is not set
 CONFIG_DEFAULT_TCP_CONG="cubic"
 CONFIG_TCP_MD5SIG=y
-# CONFIG_IP_VS is not set
 CONFIG_IPV6=y
 # CONFIG_IPV6_PRIVACY is not set
 # CONFIG_IPV6_ROUTER_PREF is not set
@@ -547,19 +578,21 @@ CONFIG_NF_CONNTRACK_IRC=y
 CONFIG_NF_CONNTRACK_SIP=y
 CONFIG_NF_CT_NETLINK=y
 CONFIG_NETFILTER_XTABLES=y
+CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
 CONFIG_NETFILTER_XT_TARGET_MARK=y
 CONFIG_NETFILTER_XT_TARGET_NFLOG=y
 CONFIG_NETFILTER_XT_TARGET_SECMARK=y
-CONFIG_NETFILTER_XT_TARGET_CONNSECMARK=y
 CONFIG_NETFILTER_XT_TARGET_TCPMSS=y
 CONFIG_NETFILTER_XT_MATCH_CONNTRACK=y
 CONFIG_NETFILTER_XT_MATCH_MARK=y
 CONFIG_NETFILTER_XT_MATCH_POLICY=y
 CONFIG_NETFILTER_XT_MATCH_STATE=y
+# CONFIG_IP_VS is not set
 
 #
 # IP: Netfilter Configuration
 #
+CONFIG_NF_DEFRAG_IPV4=y
 CONFIG_NF_CONNTRACK_IPV4=y
 CONFIG_NF_CONNTRACK_PROC_COMPAT=y
 CONFIG_IP_NF_IPTABLES=y
@@ -585,8 +618,8 @@ CONFIG_IP_NF_MANGLE=y
 CONFIG_NF_CONNTRACK_IPV6=y
 CONFIG_IP6_NF_IPTABLES=y
 CONFIG_IP6_NF_MATCH_IPV6HEADER=y
-CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_LOG=y
+CONFIG_IP6_NF_FILTER=y
 CONFIG_IP6_NF_TARGET_REJECT=y
 CONFIG_IP6_NF_MANGLE=y
 # CONFIG_IP_DCCP is not set
@@ -594,6 +627,7 @@ CONFIG_IP6_NF_MANGLE=y
 # CONFIG_TIPC is not set
 # CONFIG_ATM is not set
 # CONFIG_BRIDGE is not set
+# CONFIG_NET_DSA is not set
 # CONFIG_VLAN_8021Q is not set
 # CONFIG_DECNET is not set
 CONFIG_LLC=y
@@ -613,6 +647,7 @@ CONFIG_NET_SCHED=y
 # CONFIG_NET_SCH_HTB is not set
 # CONFIG_NET_SCH_HFSC is not set
 # CONFIG_NET_SCH_PRIO is not set
+# CONFIG_NET_SCH_MULTIQ is not set
 # CONFIG_NET_SCH_RED is not set
 # CONFIG_NET_SCH_SFQ is not set
 # CONFIG_NET_SCH_TEQL is not set
@@ -620,6 +655,7 @@ CONFIG_NET_SCHED=y
 # CONFIG_NET_SCH_GRED is not set
 # CONFIG_NET_SCH_DSMARK is not set
 # CONFIG_NET_SCH_NETEM is not set
+# CONFIG_NET_SCH_DRR is not set
 # CONFIG_NET_SCH_INGRESS is not set
 
 #
@@ -634,6 +670,7 @@ CONFIG_NET_CLS=y
 # CONFIG_NET_CLS_RSVP is not set
 # CONFIG_NET_CLS_RSVP6 is not set
 # CONFIG_NET_CLS_FLOW is not set
+# CONFIG_NET_CLS_CGROUP is not set
 CONFIG_NET_EMATCH=y
 CONFIG_NET_EMATCH_STACK=32
 # CONFIG_NET_EMATCH_CMP is not set
@@ -649,7 +686,9 @@ CONFIG_NET_CLS_ACT=y
 # CONFIG_NET_ACT_NAT is not set
 # CONFIG_NET_ACT_PEDIT is not set
 # CONFIG_NET_ACT_SIMP is not set
+# CONFIG_NET_ACT_SKBEDIT is not set
 CONFIG_NET_SCH_FIFO=y
+# CONFIG_DCB is not set
 
 #
 # Network testing
@@ -666,29 +705,33 @@ CONFIG_HAMRADIO=y
 # CONFIG_IRDA is not set
 # CONFIG_BT is not set
 # CONFIG_AF_RXRPC is not set
+# CONFIG_PHONET is not set
 CONFIG_FIB_RULES=y
-
-#
-# Wireless
-#
+CONFIG_WIRELESS=y
 CONFIG_CFG80211=y
+# CONFIG_CFG80211_REG_DEBUG is not set
 CONFIG_NL80211=y
+CONFIG_WIRELESS_OLD_REGULATORY=y
 CONFIG_WIRELESS_EXT=y
 CONFIG_WIRELESS_EXT_SYSFS=y
+# CONFIG_LIB80211 is not set
 CONFIG_MAC80211=y
 
 #
 # Rate control algorithm selection
 #
-CONFIG_MAC80211_RC_PID=y
-CONFIG_MAC80211_RC_DEFAULT_PID=y
-CONFIG_MAC80211_RC_DEFAULT="pid"
+CONFIG_MAC80211_RC_MINSTREL=y
+# CONFIG_MAC80211_RC_DEFAULT_PID is not set
+CONFIG_MAC80211_RC_DEFAULT_MINSTREL=y
+CONFIG_MAC80211_RC_DEFAULT="minstrel"
 # CONFIG_MAC80211_MESH is not set
 CONFIG_MAC80211_LEDS=y
 # CONFIG_MAC80211_DEBUGFS is not set
 # CONFIG_MAC80211_DEBUG_MENU is not set
-# CONFIG_IEEE80211 is not set
-# CONFIG_RFKILL is not set
+# CONFIG_WIMAX is not set
+CONFIG_RFKILL=y
+# CONFIG_RFKILL_INPUT is not set
+CONFIG_RFKILL_LEDS=y
 # CONFIG_NET_9P is not set
 
 #
@@ -712,7 +755,7 @@ CONFIG_PROC_EVENTS=y
 # CONFIG_MTD is not set
 # CONFIG_PARPORT is not set
 CONFIG_PNP=y
-# CONFIG_PNP_DEBUG is not set
+CONFIG_PNP_DEBUG_MESSAGES=y
 
 #
 # Protocols
@@ -740,21 +783,21 @@ CONFIG_BLK_DEV_RAM_SIZE=16384
 CONFIG_MISC_DEVICES=y
 # CONFIG_IBM_ASM is not set
 # CONFIG_PHANTOM is not set
-# CONFIG_EEPROM_93CX6 is not set
 # CONFIG_SGI_IOC4 is not set
 # CONFIG_TIFM_CORE is not set
-# CONFIG_ACER_WMI is not set
-# CONFIG_ASUS_LAPTOP is not set
-# CONFIG_FUJITSU_LAPTOP is not set
-# CONFIG_MSI_LAPTOP is not set
-# CONFIG_COMPAL_LAPTOP is not set
-# CONFIG_SONY_LAPTOP is not set
-# CONFIG_THINKPAD_ACPI is not set
-# CONFIG_INTEL_MENLOW is not set
+# CONFIG_ICS932S401 is not set
 # CONFIG_ENCLOSURE_SERVICES is not set
 # CONFIG_SGI_XP is not set
 # CONFIG_HP_ILO is not set
 # CONFIG_SGI_GRU is not set
+# CONFIG_C2PORT is not set
+
+#
+# EEPROM support
+#
+# CONFIG_EEPROM_AT24 is not set
+# CONFIG_EEPROM_LEGACY is not set
+# CONFIG_EEPROM_93CX6 is not set
 CONFIG_HAVE_IDE=y
 # CONFIG_IDE is not set
 
@@ -793,7 +836,7 @@ CONFIG_SCSI_WAIT_SCAN=m
 #
 CONFIG_SCSI_SPI_ATTRS=y
 # CONFIG_SCSI_FC_ATTRS is not set
-CONFIG_SCSI_ISCSI_ATTRS=y
+# CONFIG_SCSI_ISCSI_ATTRS is not set
 # CONFIG_SCSI_SAS_ATTRS is not set
 # CONFIG_SCSI_SAS_LIBSAS is not set
 # CONFIG_SCSI_SRP_ATTRS is not set
@@ -864,6 +907,7 @@ CONFIG_PATA_OLDPIIX=y
 CONFIG_PATA_SCH=y
 CONFIG_MD=y
 CONFIG_BLK_DEV_MD=y
+CONFIG_MD_AUTODETECT=y
 # CONFIG_MD_LINEAR is not set
 # CONFIG_MD_RAID0 is not set
 # CONFIG_MD_RAID1 is not set
@@ -919,6 +963,9 @@ CONFIG_PHYLIB=y
 # CONFIG_BROADCOM_PHY is not set
 # CONFIG_ICPLUS_PHY is not set
 # CONFIG_REALTEK_PHY is not set
+# CONFIG_NATIONAL_PHY is not set
+# CONFIG_STE10XP is not set
+# CONFIG_LSI_ET1011C_PHY is not set
 # CONFIG_FIXED_PHY is not set
 # CONFIG_MDIO_BITBANG is not set
 CONFIG_NET_ETHERNET=y
@@ -942,6 +989,9 @@ CONFIG_NET_TULIP=y
 # CONFIG_IBM_NEW_EMAC_RGMII is not set
 # CONFIG_IBM_NEW_EMAC_TAH is not set
 # CONFIG_IBM_NEW_EMAC_EMAC4 is not set
+# CONFIG_IBM_NEW_EMAC_NO_FLOW_CTRL is not set
+# CONFIG_IBM_NEW_EMAC_MAL_CLR_ICINTSTAT is not set
+# CONFIG_IBM_NEW_EMAC_MAL_COMMON_ERR is not set
 CONFIG_NET_PCI=y
 # CONFIG_PCNET32 is not set
 # CONFIG_AMD8111_ETH is not set
@@ -949,7 +999,6 @@ CONFIG_NET_PCI=y
 # CONFIG_B44 is not set
 CONFIG_FORCEDETH=y
 # CONFIG_FORCEDETH_NAPI is not set
-# CONFIG_EEPRO100 is not set
 CONFIG_E100=y
 # CONFIG_FEALNX is not set
 # CONFIG_NATSEMI is not set
@@ -963,15 +1012,16 @@ CONFIG_8139TOO_PIO=y
 # CONFIG_R6040 is not set
 # CONFIG_SIS900 is not set
 # CONFIG_EPIC100 is not set
+# CONFIG_SMSC9420 is not set
 # CONFIG_SUNDANCE is not set
 # CONFIG_TLAN is not set
 # CONFIG_VIA_RHINE is not set
 # CONFIG_SC92031 is not set
+# CONFIG_ATL2 is not set
 CONFIG_NETDEV_1000=y
 # CONFIG_ACENIC is not set
 # CONFIG_DL2K is not set
 CONFIG_E1000=y
-# CONFIG_E1000_DISABLE_PACKET_SPLIT is not set
 # CONFIG_E1000E is not set
 # CONFIG_IP1000 is not set
 # CONFIG_IGB is not set
@@ -989,18 +1039,23 @@ CONFIG_TIGON3=y
 # CONFIG_QLA3XXX is not set
 # CONFIG_ATL1 is not set
 # CONFIG_ATL1E is not set
+# CONFIG_JME is not set
 CONFIG_NETDEV_10000=y
 # CONFIG_CHELSIO_T1 is not set
+CONFIG_CHELSIO_T3_DEPENDS=y
 # CONFIG_CHELSIO_T3 is not set
+# CONFIG_ENIC is not set
 # CONFIG_IXGBE is not set
 # CONFIG_IXGB is not set
 # CONFIG_S2IO is not set
 # CONFIG_MYRI10GE is not set
 # CONFIG_NETXEN_NIC is not set
 # CONFIG_NIU is not set
+# CONFIG_MLX4_EN is not set
 # CONFIG_MLX4_CORE is not set
 # CONFIG_TEHUTI is not set
 # CONFIG_BNX2X is not set
+# CONFIG_QLGE is not set
 # CONFIG_SFC is not set
 CONFIG_TR=y
 # CONFIG_IBMOL is not set
@@ -1013,9 +1068,8 @@ CONFIG_TR=y
 # CONFIG_WLAN_PRE80211 is not set
 CONFIG_WLAN_80211=y
 # CONFIG_PCMCIA_RAYCS is not set
-# CONFIG_IPW2100 is not set
-# CONFIG_IPW2200 is not set
 # CONFIG_LIBERTAS is not set
+# CONFIG_LIBERTAS_THINFIRM is not set
 # CONFIG_AIRO is not set
 # CONFIG_HERMES is not set
 # CONFIG_ATMEL is not set
@@ -1032,6 +1086,8 @@ CONFIG_WLAN_80211=y
 CONFIG_ATH5K=y
 # CONFIG_ATH5K_DEBUG is not set
 # CONFIG_ATH9K is not set
+# CONFIG_IPW2100 is not set
+# CONFIG_IPW2200 is not set
 # CONFIG_IWLCORE is not set
 # CONFIG_IWLWIFI_LEDS is not set
 # CONFIG_IWLAGN is not set
@@ -1043,6 +1099,10 @@ CONFIG_ATH5K=y
 # CONFIG_RT2X00 is not set
 
 #
+# Enable WiMAX (Networking options) to see the WiMAX drivers
+#
+
+#
 # USB Network Adapters
 #
 # CONFIG_USB_CATC is not set
@@ -1050,6 +1110,7 @@ CONFIG_ATH5K=y
 # CONFIG_USB_PEGASUS is not set
 # CONFIG_USB_RTL8150 is not set
 # CONFIG_USB_USBNET is not set
+# CONFIG_USB_HSO is not set
 CONFIG_NET_PCMCIA=y
 # CONFIG_PCMCIA_3C589 is not set
 # CONFIG_PCMCIA_3C574 is not set
@@ -1059,6 +1120,7 @@ CONFIG_NET_PCMCIA=y
 # CONFIG_PCMCIA_SMC91C92 is not set
 # CONFIG_PCMCIA_XIRC2PS is not set
 # CONFIG_PCMCIA_AXNET is not set
+# CONFIG_PCMCIA_IBMTR is not set
 # CONFIG_WAN is not set
 CONFIG_FDDI=y
 # CONFIG_DEFXX is not set
@@ -1110,6 +1172,7 @@ CONFIG_MOUSE_PS2_LOGIPS2PP=y
 CONFIG_MOUSE_PS2_SYNAPTICS=y
 CONFIG_MOUSE_PS2_LIFEBOOK=y
 CONFIG_MOUSE_PS2_TRACKPOINT=y
+# CONFIG_MOUSE_PS2_ELANTECH is not set
 # CONFIG_MOUSE_PS2_TOUCHKIT is not set
 # CONFIG_MOUSE_SERIAL is not set
 # CONFIG_MOUSE_APPLETOUCH is not set
@@ -1147,15 +1210,16 @@ CONFIG_INPUT_TOUCHSCREEN=y
 # CONFIG_TOUCHSCREEN_FUJITSU is not set
 # CONFIG_TOUCHSCREEN_GUNZE is not set
 # CONFIG_TOUCHSCREEN_ELO is not set
+# CONFIG_TOUCHSCREEN_WACOM_W8001 is not set
 # CONFIG_TOUCHSCREEN_MTOUCH is not set
 # CONFIG_TOUCHSCREEN_INEXIO is not set
 # CONFIG_TOUCHSCREEN_MK712 is not set
 # CONFIG_TOUCHSCREEN_PENMOUNT is not set
 # CONFIG_TOUCHSCREEN_TOUCHRIGHT is not set
 # CONFIG_TOUCHSCREEN_TOUCHWIN is not set
-# CONFIG_TOUCHSCREEN_UCB1400 is not set
 # CONFIG_TOUCHSCREEN_USB_COMPOSITE is not set
 # CONFIG_TOUCHSCREEN_TOUCHIT213 is not set
+# CONFIG_TOUCHSCREEN_TSC2007 is not set
 CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_PCSPKR is not set
 # CONFIG_INPUT_APANEL is not set
@@ -1165,6 +1229,7 @@ CONFIG_INPUT_MISC=y
 # CONFIG_INPUT_KEYSPAN_REMOTE is not set
 # CONFIG_INPUT_POWERMATE is not set
 # CONFIG_INPUT_YEALINK is not set
+# CONFIG_INPUT_CM109 is not set
 # CONFIG_INPUT_UINPUT is not set
 
 #
@@ -1231,6 +1296,7 @@ CONFIG_SERIAL_CORE=y
 CONFIG_SERIAL_CORE_CONSOLE=y
 # CONFIG_SERIAL_JSM is not set
 CONFIG_UNIX98_PTYS=y
+# CONFIG_DEVPTS_MULTIPLE_INSTANCES is not set
 # CONFIG_LEGACY_PTYS is not set
 # CONFIG_IPMI_HANDLER is not set
 CONFIG_HW_RANDOM=y
@@ -1260,6 +1326,7 @@ CONFIG_I2C=y
 CONFIG_I2C_BOARDINFO=y
 # CONFIG_I2C_CHARDEV is not set
 CONFIG_I2C_HELPER_AUTO=y
+CONFIG_I2C_ALGOBIT=y
 
 #
 # I2C Hardware Bus support
@@ -1311,8 +1378,6 @@ CONFIG_I2C_I801=y
 # Miscellaneous I2C Chip support
 #
 # CONFIG_DS1682 is not set
-# CONFIG_EEPROM_AT24 is not set
-# CONFIG_EEPROM_LEGACY is not set
 # CONFIG_SENSORS_PCF8574 is not set
 # CONFIG_PCF8575 is not set
 # CONFIG_SENSORS_PCA9539 is not set
@@ -1331,8 +1396,78 @@ CONFIG_POWER_SUPPLY=y
 # CONFIG_POWER_SUPPLY_DEBUG is not set
 # CONFIG_PDA_POWER is not set
 # CONFIG_BATTERY_DS2760 is not set
-# CONFIG_HWMON is not set
+# CONFIG_BATTERY_BQ27x00 is not set
+CONFIG_HWMON=y
+# CONFIG_HWMON_VID is not set
+# CONFIG_SENSORS_ABITUGURU is not set
+# CONFIG_SENSORS_ABITUGURU3 is not set
+# CONFIG_SENSORS_AD7414 is not set
+# CONFIG_SENSORS_AD7418 is not set
+# CONFIG_SENSORS_ADM1021 is not set
+# CONFIG_SENSORS_ADM1025 is not set
+# CONFIG_SENSORS_ADM1026 is not set
+# CONFIG_SENSORS_ADM1029 is not set
+# CONFIG_SENSORS_ADM1031 is not set
+# CONFIG_SENSORS_ADM9240 is not set
+# CONFIG_SENSORS_ADT7462 is not set
+# CONFIG_SENSORS_ADT7470 is not set
+# CONFIG_SENSORS_ADT7473 is not set
+# CONFIG_SENSORS_ADT7475 is not set
+# CONFIG_SENSORS_K8TEMP is not set
+# CONFIG_SENSORS_ASB100 is not set
+# CONFIG_SENSORS_ATXP1 is not set
+# CONFIG_SENSORS_DS1621 is not set
+# CONFIG_SENSORS_I5K_AMB is not set
+# CONFIG_SENSORS_F71805F is not set
+# CONFIG_SENSORS_F71882FG is not set
+# CONFIG_SENSORS_F75375S is not set
+# CONFIG_SENSORS_FSCHER is not set
+# CONFIG_SENSORS_FSCPOS is not set
+# CONFIG_SENSORS_FSCHMD is not set
+# CONFIG_SENSORS_GL518SM is not set
+# CONFIG_SENSORS_GL520SM is not set
+# CONFIG_SENSORS_CORETEMP is not set
+# CONFIG_SENSORS_IT87 is not set
+# CONFIG_SENSORS_LM63 is not set
+# CONFIG_SENSORS_LM75 is not set
+# CONFIG_SENSORS_LM77 is not set
+# CONFIG_SENSORS_LM78 is not set
+# CONFIG_SENSORS_LM80 is not set
+# CONFIG_SENSORS_LM83 is not set
+# CONFIG_SENSORS_LM85 is not set
+# CONFIG_SENSORS_LM87 is not set
+# CONFIG_SENSORS_LM90 is not set
+# CONFIG_SENSORS_LM92 is not set
+# CONFIG_SENSORS_LM93 is not set
+# CONFIG_SENSORS_LTC4245 is not set
+# CONFIG_SENSORS_MAX1619 is not set
+# CONFIG_SENSORS_MAX6650 is not set
+# CONFIG_SENSORS_PC87360 is not set
+# CONFIG_SENSORS_PC87427 is not set
+# CONFIG_SENSORS_SIS5595 is not set
+# CONFIG_SENSORS_DME1737 is not set
+# CONFIG_SENSORS_SMSC47M1 is not set
+# CONFIG_SENSORS_SMSC47M192 is not set
+# CONFIG_SENSORS_SMSC47B397 is not set
+# CONFIG_SENSORS_ADS7828 is not set
+# CONFIG_SENSORS_THMC50 is not set
+# CONFIG_SENSORS_VIA686A is not set
+# CONFIG_SENSORS_VT1211 is not set
+# CONFIG_SENSORS_VT8231 is not set
+# CONFIG_SENSORS_W83781D is not set
+# CONFIG_SENSORS_W83791D is not set
+# CONFIG_SENSORS_W83792D is not set
+# CONFIG_SENSORS_W83793 is not set
+# CONFIG_SENSORS_W83L785TS is not set
+# CONFIG_SENSORS_W83L786NG is not set
+# CONFIG_SENSORS_W83627HF is not set
+# CONFIG_SENSORS_W83627EHF is not set
+# CONFIG_SENSORS_HDAPS is not set
+# CONFIG_SENSORS_LIS3LV02D is not set
+# CONFIG_SENSORS_APPLESMC is not set
+# CONFIG_HWMON_DEBUG_CHIP is not set
 CONFIG_THERMAL=y
+# CONFIG_THERMAL_HWMON is not set
 CONFIG_WATCHDOG=y
 # CONFIG_WATCHDOG_NOWAYOUT is not set
 
@@ -1352,15 +1487,18 @@ CONFIG_WATCHDOG=y
 # CONFIG_I6300ESB_WDT is not set
 # CONFIG_ITCO_WDT is not set
 # CONFIG_IT8712F_WDT is not set
+# CONFIG_IT87_WDT is not set
 # CONFIG_HP_WATCHDOG is not set
 # CONFIG_SC1200_WDT is not set
 # CONFIG_PC87413_WDT is not set
 # CONFIG_60XX_WDT is not set
 # CONFIG_SBC8360_WDT is not set
 # CONFIG_CPU5_WDT is not set
+# CONFIG_SMSC_SCH311X_WDT is not set
 # CONFIG_SMSC37B787_WDT is not set
 # CONFIG_W83627HF_WDT is not set
 # CONFIG_W83697HF_WDT is not set
+# CONFIG_W83697UG_WDT is not set
 # CONFIG_W83877F_WDT is not set
 # CONFIG_W83977F_WDT is not set
 # CONFIG_MACHZ_WDT is not set
@@ -1376,11 +1514,11 @@ CONFIG_WATCHDOG=y
 # USB-based Watchdog Cards
 #
 # CONFIG_USBPCWATCHDOG is not set
+CONFIG_SSB_POSSIBLE=y
 
 #
 # Sonics Silicon Backplane
 #
-CONFIG_SSB_POSSIBLE=y
 # CONFIG_SSB is not set
 
 #
@@ -1389,7 +1527,13 @@ CONFIG_SSB_POSSIBLE=y
 # CONFIG_MFD_CORE is not set
 # CONFIG_MFD_SM501 is not set
 # CONFIG_HTC_PASIC3 is not set
+# CONFIG_TWL4030_CORE is not set
 # CONFIG_MFD_TMIO is not set
+# CONFIG_PMIC_DA903X is not set
+# CONFIG_MFD_WM8400 is not set
+# CONFIG_MFD_WM8350_I2C is not set
+# CONFIG_MFD_PCF50633 is not set
+# CONFIG_REGULATOR is not set
 
 #
 # Multimedia devices
@@ -1423,6 +1567,7 @@ CONFIG_DRM=y
 # CONFIG_DRM_I810 is not set
 # CONFIG_DRM_I830 is not set
 CONFIG_DRM_I915=y
+CONFIG_DRM_I915_KMS=y
 # CONFIG_DRM_MGA is not set
 # CONFIG_DRM_SIS is not set
 # CONFIG_DRM_VIA is not set
@@ -1432,6 +1577,7 @@ CONFIG_DRM_I915=y
 CONFIG_FB=y
 # CONFIG_FIRMWARE_EDID is not set
 # CONFIG_FB_DDC is not set
+# CONFIG_FB_BOOT_VESA_SUPPORT is not set
 CONFIG_FB_CFB_FILLRECT=y
 CONFIG_FB_CFB_COPYAREA=y
 CONFIG_FB_CFB_IMAGEBLIT=y
@@ -1460,7 +1606,6 @@ CONFIG_FB_TILEBLITTING=y
 # CONFIG_FB_UVESA is not set
 # CONFIG_FB_VESA is not set
 CONFIG_FB_EFI=y
-# CONFIG_FB_IMAC is not set
 # CONFIG_FB_N411 is not set
 # CONFIG_FB_HGA is not set
 # CONFIG_FB_S1D13XXX is not set
@@ -1475,6 +1620,7 @@ CONFIG_FB_EFI=y
 # CONFIG_FB_S3 is not set
 # CONFIG_FB_SAVAGE is not set
 # CONFIG_FB_SIS is not set
+# CONFIG_FB_VIA is not set
 # CONFIG_FB_NEOMAGIC is not set
 # CONFIG_FB_KYRO is not set
 # CONFIG_FB_3DFX is not set
@@ -1486,12 +1632,15 @@ CONFIG_FB_EFI=y
 # CONFIG_FB_CARMINE is not set
 # CONFIG_FB_GEODE is not set
 # CONFIG_FB_VIRTUAL is not set
+# CONFIG_FB_METRONOME is not set
+# CONFIG_FB_MB862XX is not set
 CONFIG_BACKLIGHT_LCD_SUPPORT=y
 # CONFIG_LCD_CLASS_DEVICE is not set
 CONFIG_BACKLIGHT_CLASS_DEVICE=y
-# CONFIG_BACKLIGHT_CORGI is not set
+CONFIG_BACKLIGHT_GENERIC=y
 # CONFIG_BACKLIGHT_PROGEAR is not set
 # CONFIG_BACKLIGHT_MBP_NVIDIA is not set
+# CONFIG_BACKLIGHT_SAHARA is not set
 
 #
 # Display device support
@@ -1511,10 +1660,12 @@ CONFIG_LOGO=y
 # CONFIG_LOGO_LINUX_VGA16 is not set
 CONFIG_LOGO_LINUX_CLUT224=y
 CONFIG_SOUND=y
+CONFIG_SOUND_OSS_CORE=y
 CONFIG_SND=y
 CONFIG_SND_TIMER=y
 CONFIG_SND_PCM=y
 CONFIG_SND_HWDEP=y
+CONFIG_SND_JACK=y
 CONFIG_SND_SEQUENCER=y
 CONFIG_SND_SEQ_DUMMY=y
 CONFIG_SND_OSSEMUL=y
@@ -1522,6 +1673,8 @@ CONFIG_SND_MIXER_OSS=y
 CONFIG_SND_PCM_OSS=y
 CONFIG_SND_PCM_OSS_PLUGINS=y
 CONFIG_SND_SEQUENCER_OSS=y
+CONFIG_SND_HRTIMER=y
+CONFIG_SND_SEQ_HRTIMER_DEFAULT=y
 CONFIG_SND_DYNAMIC_MINORS=y
 CONFIG_SND_SUPPORT_OLD_API=y
 CONFIG_SND_VERBOSE_PROCFS=y
@@ -1575,11 +1728,16 @@ CONFIG_SND_PCI=y
 # CONFIG_SND_FM801 is not set
 CONFIG_SND_HDA_INTEL=y
 CONFIG_SND_HDA_HWDEP=y
+# CONFIG_SND_HDA_RECONFIG is not set
+# CONFIG_SND_HDA_INPUT_BEEP is not set
 CONFIG_SND_HDA_CODEC_REALTEK=y
 CONFIG_SND_HDA_CODEC_ANALOG=y
 CONFIG_SND_HDA_CODEC_SIGMATEL=y
 CONFIG_SND_HDA_CODEC_VIA=y
 CONFIG_SND_HDA_CODEC_ATIHDMI=y
+CONFIG_SND_HDA_CODEC_NVHDMI=y
+CONFIG_SND_HDA_CODEC_INTELHDMI=y
+CONFIG_SND_HDA_ELD=y
 CONFIG_SND_HDA_CODEC_CONEXANT=y
 CONFIG_SND_HDA_CODEC_CMEDIA=y
 CONFIG_SND_HDA_CODEC_SI3054=y
@@ -1612,6 +1770,7 @@ CONFIG_SND_USB=y
 # CONFIG_SND_USB_AUDIO is not set
 # CONFIG_SND_USB_USX2Y is not set
 # CONFIG_SND_USB_CAIAQ is not set
+# CONFIG_SND_USB_US122L is not set
 CONFIG_SND_PCMCIA=y
 # CONFIG_SND_VXPOCKET is not set
 # CONFIG_SND_PDAUDIOCF is not set
@@ -1626,15 +1785,37 @@ CONFIG_HIDRAW=y
 # USB Input Devices
 #
 CONFIG_USB_HID=y
-CONFIG_USB_HIDINPUT_POWERBOOK=y
-CONFIG_HID_FF=y
 CONFIG_HID_PID=y
+CONFIG_USB_HIDDEV=y
+
+#
+# Special HID drivers
+#
+CONFIG_HID_COMPAT=y
+CONFIG_HID_A4TECH=y
+CONFIG_HID_APPLE=y
+CONFIG_HID_BELKIN=y
+CONFIG_HID_CHERRY=y
+CONFIG_HID_CHICONY=y
+CONFIG_HID_CYPRESS=y
+CONFIG_HID_EZKEY=y
+CONFIG_HID_GYRATION=y
+CONFIG_HID_LOGITECH=y
 CONFIG_LOGITECH_FF=y
 # CONFIG_LOGIRUMBLEPAD2_FF is not set
+CONFIG_HID_MICROSOFT=y
+CONFIG_HID_MONTEREY=y
+CONFIG_HID_NTRIG=y
+CONFIG_HID_PANTHERLORD=y
 CONFIG_PANTHERLORD_FF=y
+CONFIG_HID_PETALYNX=y
+CONFIG_HID_SAMSUNG=y
+CONFIG_HID_SONY=y
+CONFIG_HID_SUNPLUS=y
+# CONFIG_GREENASIA_FF is not set
+CONFIG_HID_TOPSEED=y
 CONFIG_THRUSTMASTER_FF=y
 CONFIG_ZEROPLUS_FF=y
-CONFIG_USB_HIDDEV=y
 CONFIG_USB_SUPPORT=y
 CONFIG_USB_ARCH_HAS_HCD=y
 CONFIG_USB_ARCH_HAS_OHCI=y
@@ -1652,6 +1833,8 @@ CONFIG_USB_DEVICEFS=y
 CONFIG_USB_SUSPEND=y
 # CONFIG_USB_OTG is not set
 CONFIG_USB_MON=y
+# CONFIG_USB_WUSB is not set
+# CONFIG_USB_WUSB_CBAF is not set
 
 #
 # USB Host Controller Drivers
@@ -1660,6 +1843,7 @@ CONFIG_USB_MON=y
 CONFIG_USB_EHCI_HCD=y
 # CONFIG_USB_EHCI_ROOT_HUB_TT is not set
 # CONFIG_USB_EHCI_TT_NEWSCHED is not set
+# CONFIG_USB_OXU210HP_HCD is not set
 # CONFIG_USB_ISP116X_HCD is not set
 # CONFIG_USB_ISP1760_HCD is not set
 CONFIG_USB_OHCI_HCD=y
@@ -1669,6 +1853,8 @@ CONFIG_USB_OHCI_LITTLE_ENDIAN=y
 CONFIG_USB_UHCI_HCD=y
 # CONFIG_USB_SL811_HCD is not set
 # CONFIG_USB_R8A66597_HCD is not set
+# CONFIG_USB_WHCI_HCD is not set
+# CONFIG_USB_HWA_HCD is not set
 
 #
 # USB Device Class drivers
@@ -1676,20 +1862,20 @@ CONFIG_USB_UHCI_HCD=y
 # CONFIG_USB_ACM is not set
 CONFIG_USB_PRINTER=y
 # CONFIG_USB_WDM is not set
+# CONFIG_USB_TMC is not set
 
 #
-# NOTE: USB_STORAGE enables SCSI, and 'SCSI disk support'
+# NOTE: USB_STORAGE depends on SCSI but BLK_DEV_SD may also be needed;
 #
 
 #
-# may also be needed; see USB_STORAGE Help for more information
+# see USB_STORAGE Help for more information
 #
 CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_DEBUG is not set
 # CONFIG_USB_STORAGE_DATAFAB is not set
 # CONFIG_USB_STORAGE_FREECOM is not set
 # CONFIG_USB_STORAGE_ISD200 is not set
-# CONFIG_USB_STORAGE_DPCM is not set
 # CONFIG_USB_STORAGE_USBAT is not set
 # CONFIG_USB_STORAGE_SDDR09 is not set
 # CONFIG_USB_STORAGE_SDDR55 is not set
@@ -1697,7 +1883,6 @@ CONFIG_USB_STORAGE=y
 # CONFIG_USB_STORAGE_ALAUDA is not set
 # CONFIG_USB_STORAGE_ONETOUCH is not set
 # CONFIG_USB_STORAGE_KARMA is not set
-# CONFIG_USB_STORAGE_SIERRA is not set
 # CONFIG_USB_STORAGE_CYPRESS_ATACB is not set
 CONFIG_USB_LIBUSUAL=y
 
@@ -1718,6 +1903,7 @@ CONFIG_USB_LIBUSUAL=y
 # CONFIG_USB_EMI62 is not set
 # CONFIG_USB_EMI26 is not set
 # CONFIG_USB_ADUTUX is not set
+# CONFIG_USB_SEVSEG is not set
 # CONFIG_USB_RIO500 is not set
 # CONFIG_USB_LEGOTOWER is not set
 # CONFIG_USB_LCD is not set
@@ -1735,7 +1921,13 @@ CONFIG_USB_LIBUSUAL=y
 # CONFIG_USB_IOWARRIOR is not set
 # CONFIG_USB_TEST is not set
 # CONFIG_USB_ISIGHTFW is not set
+# CONFIG_USB_VST is not set
 # CONFIG_USB_GADGET is not set
+
+#
+# OTG and related infrastructure
+#
+# CONFIG_UWB is not set
 # CONFIG_MMC is not set
 # CONFIG_MEMSTICK is not set
 CONFIG_NEW_LEDS=y
@@ -1744,6 +1936,7 @@ CONFIG_LEDS_CLASS=y
 #
 # LED drivers
 #
+# CONFIG_LEDS_ALIX2 is not set
 # CONFIG_LEDS_PCA9532 is not set
 # CONFIG_LEDS_CLEVO_MAIL is not set
 # CONFIG_LEDS_PCA955X is not set
@@ -1754,6 +1947,7 @@ CONFIG_LEDS_CLASS=y
 CONFIG_LEDS_TRIGGERS=y
 # CONFIG_LEDS_TRIGGER_TIMER is not set
 # CONFIG_LEDS_TRIGGER_HEARTBEAT is not set
+# CONFIG_LEDS_TRIGGER_BACKLIGHT is not set
 # CONFIG_LEDS_TRIGGER_DEFAULT_ON is not set
 # CONFIG_ACCESSIBILITY is not set
 # CONFIG_INFINIBAND is not set
@@ -1793,6 +1987,7 @@ CONFIG_RTC_INTF_DEV=y
 # CONFIG_RTC_DRV_M41T80 is not set
 # CONFIG_RTC_DRV_S35390A is not set
 # CONFIG_RTC_DRV_FM3130 is not set
+# CONFIG_RTC_DRV_RX8581 is not set
 
 #
 # SPI RTC drivers
@@ -1802,12 +1997,15 @@ CONFIG_RTC_INTF_DEV=y
 # Platform RTC drivers
 #
 CONFIG_RTC_DRV_CMOS=y
+# CONFIG_RTC_DRV_DS1286 is not set
 # CONFIG_RTC_DRV_DS1511 is not set
 # CONFIG_RTC_DRV_DS1553 is not set
 # CONFIG_RTC_DRV_DS1742 is not set
 # CONFIG_RTC_DRV_STK17TA8 is not set
 # CONFIG_RTC_DRV_M48T86 is not set
+# CONFIG_RTC_DRV_M48T35 is not set
 # CONFIG_RTC_DRV_M48T59 is not set
+# CONFIG_RTC_DRV_BQ4802 is not set
 # CONFIG_RTC_DRV_V3020 is not set
 
 #
@@ -1820,6 +2018,21 @@ CONFIG_DMADEVICES=y
 #
 # CONFIG_INTEL_IOATDMA is not set
 # CONFIG_UIO is not set
+# CONFIG_STAGING is not set
+CONFIG_X86_PLATFORM_DEVICES=y
+# CONFIG_ACER_WMI is not set
+# CONFIG_ASUS_LAPTOP is not set
+# CONFIG_FUJITSU_LAPTOP is not set
+# CONFIG_MSI_LAPTOP is not set
+# CONFIG_PANASONIC_LAPTOP is not set
+# CONFIG_COMPAL_LAPTOP is not set
+# CONFIG_SONY_LAPTOP is not set
+# CONFIG_THINKPAD_ACPI is not set
+# CONFIG_INTEL_MENLOW is not set
+CONFIG_EEEPC_LAPTOP=y
+# CONFIG_ACPI_WMI is not set
+# CONFIG_ACPI_ASUS is not set
+# CONFIG_ACPI_TOSHIBA is not set
 
 #
 # Firmware Drivers
@@ -1830,8 +2043,7 @@ CONFIG_EFI_VARS=y
 # CONFIG_DELL_RBU is not set
 # CONFIG_DCDBAS is not set
 CONFIG_DMIID=y
-CONFIG_ISCSI_IBFT_FIND=y
-CONFIG_ISCSI_IBFT=y
+# CONFIG_ISCSI_IBFT_FIND is not set
 
 #
 # File systems
@@ -1841,22 +2053,25 @@ CONFIG_EXT3_FS=y
 CONFIG_EXT3_FS_XATTR=y
 CONFIG_EXT3_FS_POSIX_ACL=y
 CONFIG_EXT3_FS_SECURITY=y
-# CONFIG_EXT4DEV_FS is not set
+# CONFIG_EXT4_FS is not set
 CONFIG_JBD=y
 # CONFIG_JBD_DEBUG is not set
 CONFIG_FS_MBCACHE=y
 # CONFIG_REISERFS_FS is not set
 # CONFIG_JFS_FS is not set
 CONFIG_FS_POSIX_ACL=y
+CONFIG_FILE_LOCKING=y
 # CONFIG_XFS_FS is not set
 # CONFIG_GFS2_FS is not set
 # CONFIG_OCFS2_FS is not set
+# CONFIG_BTRFS_FS is not set
 CONFIG_DNOTIFY=y
 CONFIG_INOTIFY=y
 CONFIG_INOTIFY_USER=y
 CONFIG_QUOTA=y
 CONFIG_QUOTA_NETLINK_INTERFACE=y
 # CONFIG_PRINT_QUOTA_WARNING is not set
+CONFIG_QUOTA_TREE=y
 # CONFIG_QFMT_V1 is not set
 CONFIG_QFMT_V2=y
 CONFIG_QUOTACTL=y
@@ -1890,16 +2105,14 @@ CONFIG_PROC_FS=y
 CONFIG_PROC_KCORE=y
 CONFIG_PROC_VMCORE=y
 CONFIG_PROC_SYSCTL=y
+CONFIG_PROC_PAGE_MONITOR=y
 CONFIG_SYSFS=y
 CONFIG_TMPFS=y
 CONFIG_TMPFS_POSIX_ACL=y
 CONFIG_HUGETLBFS=y
 CONFIG_HUGETLB_PAGE=y
 # CONFIG_CONFIGFS_FS is not set
-
-#
-# Miscellaneous filesystems
-#
+CONFIG_MISC_FILESYSTEMS=y
 # CONFIG_ADFS_FS is not set
 # CONFIG_AFFS_FS is not set
 # CONFIG_ECRYPT_FS is not set
@@ -1909,6 +2122,7 @@ CONFIG_HUGETLB_PAGE=y
 # CONFIG_BFS_FS is not set
 # CONFIG_EFS_FS is not set
 # CONFIG_CRAMFS is not set
+# CONFIG_SQUASHFS is not set
 # CONFIG_VXFS_FS is not set
 # CONFIG_MINIX_FS is not set
 # CONFIG_OMFS_FS is not set
@@ -1930,6 +2144,7 @@ CONFIG_NFS_ACL_SUPPORT=y
 CONFIG_NFS_COMMON=y
 CONFIG_SUNRPC=y
 CONFIG_SUNRPC_GSS=y
+# CONFIG_SUNRPC_REGISTER_V4 is not set
 CONFIG_RPCSEC_GSS_KRB5=y
 # CONFIG_RPCSEC_GSS_SPKM3 is not set
 # CONFIG_SMB_FS is not set
@@ -2006,7 +2221,7 @@ CONFIG_NLS_UTF8=y
 #
 CONFIG_TRACE_IRQFLAGS_SUPPORT=y
 CONFIG_PRINTK_TIME=y
-CONFIG_ENABLE_WARN_DEPRECATED=y
+# CONFIG_ENABLE_WARN_DEPRECATED is not set
 CONFIG_ENABLE_MUST_CHECK=y
 CONFIG_FRAME_WARN=2048
 CONFIG_MAGIC_SYSRQ=y
@@ -2035,40 +2250,60 @@ CONFIG_TIMER_STATS=y
 CONFIG_DEBUG_BUGVERBOSE=y
 # CONFIG_DEBUG_INFO is not set
 # CONFIG_DEBUG_VM is not set
+# CONFIG_DEBUG_VIRTUAL is not set
 # CONFIG_DEBUG_WRITECOUNT is not set
 CONFIG_DEBUG_MEMORY_INIT=y
 # CONFIG_DEBUG_LIST is not set
 # CONFIG_DEBUG_SG is not set
+# CONFIG_DEBUG_NOTIFIERS is not set
+CONFIG_ARCH_WANT_FRAME_POINTERS=y
 CONFIG_FRAME_POINTER=y
 # CONFIG_BOOT_PRINTK_DELAY is not set
 # CONFIG_RCU_TORTURE_TEST is not set
+# CONFIG_RCU_CPU_STALL_DETECTOR is not set
 # CONFIG_KPROBES_SANITY_TEST is not set
 # CONFIG_BACKTRACE_SELF_TEST is not set
+# CONFIG_DEBUG_BLOCK_EXT_DEVT is not set
 # CONFIG_LKDTM is not set
 # CONFIG_FAULT_INJECTION is not set
 # CONFIG_LATENCYTOP is not set
 CONFIG_SYSCTL_SYSCALL_CHECK=y
-CONFIG_HAVE_FTRACE=y
+CONFIG_USER_STACKTRACE_SUPPORT=y
+CONFIG_HAVE_FUNCTION_TRACER=y
+CONFIG_HAVE_FUNCTION_GRAPH_TRACER=y
+CONFIG_HAVE_FUNCTION_TRACE_MCOUNT_TEST=y
 CONFIG_HAVE_DYNAMIC_FTRACE=y
-# CONFIG_FTRACE is not set
+CONFIG_HAVE_FTRACE_MCOUNT_RECORD=y
+CONFIG_HAVE_HW_BRANCH_TRACER=y
+
+#
+# Tracers
+#
+# CONFIG_FUNCTION_TRACER is not set
 # CONFIG_IRQSOFF_TRACER is not set
 # CONFIG_SYSPROF_TRACER is not set
 # CONFIG_SCHED_TRACER is not set
 # CONFIG_CONTEXT_SWITCH_TRACER is not set
+# CONFIG_BOOT_TRACER is not set
+# CONFIG_TRACE_BRANCH_PROFILING is not set
+# CONFIG_POWER_TRACER is not set
+# CONFIG_STACK_TRACER is not set
+# CONFIG_HW_BRANCH_TRACER is not set
 CONFIG_PROVIDE_OHCI1394_DMA_INIT=y
+# CONFIG_DYNAMIC_PRINTK_DEBUG is not set
 # CONFIG_SAMPLES is not set
 CONFIG_HAVE_ARCH_KGDB=y
 # CONFIG_KGDB is not set
 # CONFIG_STRICT_DEVMEM is not set
 CONFIG_X86_VERBOSE_BOOTUP=y
 CONFIG_EARLY_PRINTK=y
+CONFIG_EARLY_PRINTK_DBGP=y
 CONFIG_DEBUG_STACKOVERFLOW=y
 CONFIG_DEBUG_STACK_USAGE=y
 # CONFIG_DEBUG_PAGEALLOC is not set
 # CONFIG_DEBUG_PER_CPU_MAPS is not set
 # CONFIG_X86_PTDUMP is not set
 CONFIG_DEBUG_RODATA=y
-# CONFIG_DIRECT_GBPAGES is not set
 # CONFIG_DEBUG_RODATA_TEST is not set
 CONFIG_DEBUG_NX_TEST=m
 # CONFIG_IOMMU_DEBUG is not set
@@ -2092,8 +2327,10 @@ CONFIG_OPTIMIZE_INLINING=y
 CONFIG_KEYS=y
 CONFIG_KEYS_DEBUG_PROC_KEYS=y
 CONFIG_SECURITY=y
+# CONFIG_SECURITYFS is not set
 CONFIG_SECURITY_NETWORK=y
 # CONFIG_SECURITY_NETWORK_XFRM is not set
+# CONFIG_SECURITY_PATH is not set
 CONFIG_SECURITY_FILE_CAPABILITIES=y
 # CONFIG_SECURITY_ROOTPLUG is not set
 CONFIG_SECURITY_DEFAULT_MMAP_MIN_ADDR=65536
@@ -2104,7 +2341,6 @@ CONFIG_SECURITY_SELINUX_DISABLE=y
 CONFIG_SECURITY_SELINUX_DEVELOP=y
 CONFIG_SECURITY_SELINUX_AVC_STATS=y
 CONFIG_SECURITY_SELINUX_CHECKREQPROT_VALUE=1
-# CONFIG_SECURITY_SELINUX_ENABLE_SECMARK_DEFAULT is not set
 # CONFIG_SECURITY_SELINUX_POLICYDB_VERSION_MAX is not set
 # CONFIG_SECURITY_SMACK is not set
 CONFIG_CRYPTO=y
@@ -2112,11 +2348,18 @@ CONFIG_CRYPTO=y
 #
 # Crypto core or helper
 #
+# CONFIG_CRYPTO_FIPS is not set
 CONFIG_CRYPTO_ALGAPI=y
+CONFIG_CRYPTO_ALGAPI2=y
 CONFIG_CRYPTO_AEAD=y
+CONFIG_CRYPTO_AEAD2=y
 CONFIG_CRYPTO_BLKCIPHER=y
+CONFIG_CRYPTO_BLKCIPHER2=y
 CONFIG_CRYPTO_HASH=y
+CONFIG_CRYPTO_HASH2=y
+CONFIG_CRYPTO_RNG2=y
 CONFIG_CRYPTO_MANAGER=y
+CONFIG_CRYPTO_MANAGER2=y
 # CONFIG_CRYPTO_GF128MUL is not set
 # CONFIG_CRYPTO_NULL is not set
 # CONFIG_CRYPTO_CRYPTD is not set
@@ -2151,6 +2394,7 @@ CONFIG_CRYPTO_HMAC=y
 # Digest
 #
 # CONFIG_CRYPTO_CRC32C is not set
+# CONFIG_CRYPTO_CRC32C_INTEL is not set
 # CONFIG_CRYPTO_MD4 is not set
 CONFIG_CRYPTO_MD5=y
 # CONFIG_CRYPTO_MICHAEL_MIC is not set
@@ -2191,6 +2435,11 @@ CONFIG_CRYPTO_DES=y
 #
 # CONFIG_CRYPTO_DEFLATE is not set
 # CONFIG_CRYPTO_LZO is not set
+
+#
+# Random Number Generation
+#
+# CONFIG_CRYPTO_ANSI_CPRNG is not set
 CONFIG_CRYPTO_HW=y
 # CONFIG_CRYPTO_DEV_HIFN_795X is not set
 CONFIG_HAVE_KVM=y
@@ -2205,6 +2454,7 @@ CONFIG_VIRTUALIZATION=y
 CONFIG_BITREVERSE=y
 CONFIG_GENERIC_FIND_FIRST_BIT=y
 CONFIG_GENERIC_FIND_NEXT_BIT=y
+CONFIG_GENERIC_FIND_LAST_BIT=y
 # CONFIG_CRC_CCITT is not set
 # CONFIG_CRC16 is not set
 CONFIG_CRC_T10DIF=y
diff --git a/arch/x86/ia32/ia32_signal.c b/arch/x86/ia32/ia32_signal.c
index 9dabd00e980..dd77ac0cac4 100644
--- a/arch/x86/ia32/ia32_signal.c
+++ b/arch/x86/ia32/ia32_signal.c
@@ -46,78 +46,83 @@ void signal_fault(struct pt_regs *regs, void __user *frame, char *where);
 
 int copy_siginfo_to_user32(compat_siginfo_t __user *to, siginfo_t *from)
 {
-        int err;
+        int err = 0;
 
         if (!access_ok(VERIFY_WRITE, to, sizeof(compat_siginfo_t)))
                 return -EFAULT;
 
-        /* If you change siginfo_t structure, please make sure that
-           this code is fixed accordingly.
-           It should never copy any pad contained in the structure
-           to avoid security leaks, but must copy the generic
-           3 ints plus the relevant union member.  */
-        err = __put_user(from->si_signo, &to->si_signo);
-        err |= __put_user(from->si_errno, &to->si_errno);
-        err |= __put_user((short)from->si_code, &to->si_code);
-
-        if (from->si_code < 0) {
-                err |= __put_user(from->si_pid, &to->si_pid);
-                err |= __put_user(from->si_uid, &to->si_uid);
-                err |= __put_user(ptr_to_compat(from->si_ptr), &to->si_ptr);
-        } else {
-                /*
-                 * First 32bits of unions are always present:
-                 * si_pid === si_band === si_tid === si_addr(LS half)
-                 */
-                err |= __put_user(from->_sifields._pad[0],
-                                  &to->_sifields._pad[0]);
-                switch (from->si_code >> 16) {
-                case __SI_FAULT >> 16:
-                        break;
-                case __SI_CHLD >> 16:
-                        err |= __put_user(from->si_utime, &to->si_utime);
-                        err |= __put_user(from->si_stime, &to->si_stime);
-                        err |= __put_user(from->si_status, &to->si_status);
-                        /* FALL THROUGH */
-                default:
-                case __SI_KILL >> 16:
-                        err |= __put_user(from->si_uid, &to->si_uid);
-                        break;
-                case __SI_POLL >> 16:
-                        err |= __put_user(from->si_fd, &to->si_fd);
-                        break;
-                case __SI_TIMER >> 16:
-                        err |= __put_user(from->si_overrun, &to->si_overrun);
-                        err |= __put_user(ptr_to_compat(from->si_ptr),
-                                          &to->si_ptr);
-                        break;
-                         /* This is not generated by the kernel as of now.  */
-                case __SI_RT >> 16:
-                case __SI_MESGQ >> 16:
-                        err |= __put_user(from->si_uid, &to->si_uid);
-                        err |= __put_user(from->si_int, &to->si_int);
-                        break;
+        put_user_try {
+                /* If you change siginfo_t structure, please make sure that
+                   this code is fixed accordingly.
+                   It should never copy any pad contained in the structure
+                   to avoid security leaks, but must copy the generic
+                   3 ints plus the relevant union member.  */
+                put_user_ex(from->si_signo, &to->si_signo);
+                put_user_ex(from->si_errno, &to->si_errno);
+                put_user_ex((short)from->si_code, &to->si_code);
+
+                if (from->si_code < 0) {
+                        put_user_ex(from->si_pid, &to->si_pid);
+                        put_user_ex(from->si_uid, &to->si_uid);
+                        put_user_ex(ptr_to_compat(from->si_ptr), &to->si_ptr);
+                } else {
+                        /*
+                         * First 32bits of unions are always present:
+                         * si_pid === si_band === si_tid === si_addr(LS half)
+                         */
+                        put_user_ex(from->_sifields._pad[0],
+                                          &to->_sifields._pad[0]);
+                        switch (from->si_code >> 16) {
+                        case __SI_FAULT >> 16:
+                                break;
+                        case __SI_CHLD >> 16:
+                                put_user_ex(from->si_utime, &to->si_utime);
+                                put_user_ex(from->si_stime, &to->si_stime);
+                                put_user_ex(from->si_status, &to->si_status);
+                                /* FALL THROUGH */
+                        default:
+                        case __SI_KILL >> 16:
+                                put_user_ex(from->si_uid, &to->si_uid);
+                                break;
+                        case __SI_POLL >> 16:
+                                put_user_ex(from->si_fd, &to->si_fd);
+                                break;
+                        case __SI_TIMER >> 16:
+                                put_user_ex(from->si_overrun, &to->si_overrun);
+                                put_user_ex(ptr_to_compat(from->si_ptr),
+                                            &to->si_ptr);
+                                break;
+                                 /* This is not generated by the kernel as of now.  */
+                        case __SI_RT >> 16:
+                        case __SI_MESGQ >> 16:
+                                put_user_ex(from->si_uid, &to->si_uid);
+                                put_user_ex(from->si_int, &to->si_int);
+                                break;
+                        }
                 }
-        }
+        } put_user_catch(err);
+
         return err;
 }
 
 int copy_siginfo_from_user32(siginfo_t *to, compat_siginfo_t __user *from)
 {
-        int err;
+        int err = 0;
         u32 ptr32;
 
         if (!access_ok(VERIFY_READ, from, sizeof(compat_siginfo_t)))
                 return -EFAULT;
 
-        err = __get_user(to->si_signo, &from->si_signo);
-        err |= __get_user(to->si_errno, &from->si_errno);
-        err |= __get_user(to->si_code, &from->si_code);
+        get_user_try {
+                get_user_ex(to->si_signo, &from->si_signo);
+                get_user_ex(to->si_errno, &from->si_errno);
+                get_user_ex(to->si_code, &from->si_code);
 
-        err |= __get_user(to->si_pid, &from->si_pid);
-        err |= __get_user(to->si_uid, &from->si_uid);
-        err |= __get_user(ptr32, &from->si_ptr);
-        to->si_ptr = compat_ptr(ptr32);
+                get_user_ex(to->si_pid, &from->si_pid);
+                get_user_ex(to->si_uid, &from->si_uid);
+                get_user_ex(ptr32, &from->si_ptr);
+                to->si_ptr = compat_ptr(ptr32);
+        } get_user_catch(err);
 
         return err;
 }
@@ -142,17 +147,23 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
                                   struct pt_regs *regs)
 {
         stack_t uss, uoss;
-        int ret;
+        int ret, err = 0;
         mm_segment_t seg;
 
         if (uss_ptr) {
                 u32 ptr;
 
                 memset(&uss, 0, sizeof(stack_t));
-                if (!access_ok(VERIFY_READ, uss_ptr, sizeof(stack_ia32_t)) ||
-                            __get_user(ptr, &uss_ptr->ss_sp) ||
-                            __get_user(uss.ss_flags, &uss_ptr->ss_flags) ||
-                            __get_user(uss.ss_size, &uss_ptr->ss_size))
+                if (!access_ok(VERIFY_READ, uss_ptr, sizeof(stack_ia32_t)))
+                        return -EFAULT;
+
+                get_user_try {
+                        get_user_ex(ptr, &uss_ptr->ss_sp);
+                        get_user_ex(uss.ss_flags, &uss_ptr->ss_flags);
+                        get_user_ex(uss.ss_size, &uss_ptr->ss_size);
+                } get_user_catch(err);
+
+                if (err)
                         return -EFAULT;
                 uss.ss_sp = compat_ptr(ptr);
         }
@@ -161,10 +172,16 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
         ret = do_sigaltstack(uss_ptr ? &uss : NULL, &uoss, regs->sp);
         set_fs(seg);
         if (ret >= 0 && uoss_ptr)  {
-                if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)) ||
-                    __put_user(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp) ||
-                    __put_user(uoss.ss_flags, &uoss_ptr->ss_flags) ||
-                    __put_user(uoss.ss_size, &uoss_ptr->ss_size))
+                if (!access_ok(VERIFY_WRITE, uoss_ptr, sizeof(stack_ia32_t)))
+                        return -EFAULT;
+
+                put_user_try {
+                        put_user_ex(ptr_to_compat(uoss.ss_sp), &uoss_ptr->ss_sp);
+                        put_user_ex(uoss.ss_flags, &uoss_ptr->ss_flags);
+                        put_user_ex(uoss.ss_size, &uoss_ptr->ss_size);
+                } put_user_catch(err);
+
+                if (err)
                         ret = -EFAULT;
         }
         return ret;
@@ -174,18 +191,18 @@ asmlinkage long sys32_sigaltstack(const stack_ia32_t __user *uss_ptr,
  * Do a signal return; undo the signal stack.
  */
 #define COPY(x)                 {               \
-        err |= __get_user(regs->x, &sc->x);     \
+        get_user_ex(regs->x, &sc->x);           \
 }
 
 #define COPY_SEG_CPL3(seg)      {                       \
                 unsigned short tmp;                     \
-                err |= __get_user(tmp, &sc->seg);       \
+                get_user_ex(tmp, &sc->seg);             \
                 regs->seg = tmp | 3;                    \
 }
 
 #define RELOAD_SEG(seg)         {               \
         unsigned int cur, pre;                  \
-        err |= __get_user(pre, &sc->seg);       \
+        get_user_ex(pre, &sc->seg);             \
         savesegment(seg, cur);                  \
         pre |= 3;                               \
         if (pre != cur)                         \
@@ -209,39 +226,42 @@ static int ia32_restore_sigcontext(struct pt_regs *regs,
                sc, sc->err, sc->ip, sc->cs, sc->flags);
 #endif
 
-        /*
-         * Reload fs and gs if they have changed in the signal
-         * handler.  This does not handle long fs/gs base changes in
-         * the handler, but does not clobber them at least in the
-         * normal case.
-         */
-        err |= __get_user(gs, &sc->gs);
-        gs |= 3;
-        savesegment(gs, oldgs);
-        if (gs != oldgs)
-                load_gs_index(gs);
-
-        RELOAD_SEG(fs);
-        RELOAD_SEG(ds);
-        RELOAD_SEG(es);
-
-        COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
-        COPY(dx); COPY(cx); COPY(ip);
-        /* Don't touch extended registers */
-
-        COPY_SEG_CPL3(cs);
-        COPY_SEG_CPL3(ss);
-
-        err |= __get_user(tmpflags, &sc->flags);
-        regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
-        /* disable syscall checks */
-        regs->orig_ax = -1;
-
-        err |= __get_user(tmp, &sc->fpstate);
-        buf = compat_ptr(tmp);
-        err |= restore_i387_xstate_ia32(buf);
-
-        err |= __get_user(*pax, &sc->ax);
+        get_user_try {
+                /*
+                 * Reload fs and gs if they have changed in the signal
+                 * handler.  This does not handle long fs/gs base changes in
+                 * the handler, but does not clobber them at least in the
+                 * normal case.
+                 */
+                get_user_ex(gs, &sc->gs);
+                gs |= 3;
+                savesegment(gs, oldgs);
+                if (gs != oldgs)
+                        load_gs_index(gs);
+
+                RELOAD_SEG(fs);
+                RELOAD_SEG(ds);
+                RELOAD_SEG(es);
+
+                COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
+                COPY(dx); COPY(cx); COPY(ip);
+                /* Don't touch extended registers */
+
+                COPY_SEG_CPL3(cs);
+                COPY_SEG_CPL3(ss);
+
+                get_user_ex(tmpflags, &sc->flags);
+                regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
+                /* disable syscall checks */
+                regs->orig_ax = -1;
+
+                get_user_ex(tmp, &sc->fpstate);
+                buf = compat_ptr(tmp);
+                err |= restore_i387_xstate_ia32(buf);
+
+                get_user_ex(*pax, &sc->ax);
+        } get_user_catch(err);
+
         return err;
 }
 
@@ -319,36 +339,38 @@ static int ia32_setup_sigcontext(struct sigcontext_ia32 __user *sc,
 {
         int tmp, err = 0;
 
-        savesegment(gs, tmp);
-        err |= __put_user(tmp, (unsigned int __user *)&sc->gs);
-        savesegment(fs, tmp);
-        err |= __put_user(tmp, (unsigned int __user *)&sc->fs);
-        savesegment(ds, tmp);
-        err |= __put_user(tmp, (unsigned int __user *)&sc->ds);
-        savesegment(es, tmp);
-        err |= __put_user(tmp, (unsigned int __user *)&sc->es);
-
-        err |= __put_user(regs->di, &sc->di);
-        err |= __put_user(regs->si, &sc->si);
-        err |= __put_user(regs->bp, &sc->bp);
-        err |= __put_user(regs->sp, &sc->sp);
-        err |= __put_user(regs->bx, &sc->bx);
-        err |= __put_user(regs->dx, &sc->dx);
-        err |= __put_user(regs->cx, &sc->cx);
-        err |= __put_user(regs->ax, &sc->ax);
-        err |= __put_user(current->thread.trap_no, &sc->trapno);
-        err |= __put_user(current->thread.error_code, &sc->err);
-        err |= __put_user(regs->ip, &sc->ip);
-        err |= __put_user(regs->cs, (unsigned int __user *)&sc->cs);
-        err |= __put_user(regs->flags, &sc->flags);
-        err |= __put_user(regs->sp, &sc->sp_at_signal);
-        err |= __put_user(regs->ss, (unsigned int __user *)&sc->ss);
-
-        err |= __put_user(ptr_to_compat(fpstate), &sc->fpstate);
-
-        /* non-iBCS2 extensions.. */
-        err |= __put_user(mask, &sc->oldmask);
-        err |= __put_user(current->thread.cr2, &sc->cr2);
+        put_user_try {
+                savesegment(gs, tmp);
+                put_user_ex(tmp, (unsigned int __user *)&sc->gs);
+                savesegment(fs, tmp);
+                put_user_ex(tmp, (unsigned int __user *)&sc->fs);
+                savesegment(ds, tmp);
+                put_user_ex(tmp, (unsigned int __user *)&sc->ds);
+                savesegment(es, tmp);
+                put_user_ex(tmp, (unsigned int __user *)&sc->es);
+
+                put_user_ex(regs->di, &sc->di);
+                put_user_ex(regs->si, &sc->si);
+                put_user_ex(regs->bp, &sc->bp);
+                put_user_ex(regs->sp, &sc->sp);
+                put_user_ex(regs->bx, &sc->bx);
+                put_user_ex(regs->dx, &sc->dx);
+                put_user_ex(regs->cx, &sc->cx);
+                put_user_ex(regs->ax, &sc->ax);
+                put_user_ex(current->thread.trap_no, &sc->trapno);
+                put_user_ex(current->thread.error_code, &sc->err);
+                put_user_ex(regs->ip, &sc->ip);
+                put_user_ex(regs->cs, (unsigned int __user *)&sc->cs);
+                put_user_ex(regs->flags, &sc->flags);
+                put_user_ex(regs->sp, &sc->sp_at_signal);
+                put_user_ex(regs->ss, (unsigned int __user *)&sc->ss);
+
+                put_user_ex(ptr_to_compat(fpstate), &sc->fpstate);
+
+                /* non-iBCS2 extensions.. */
+                put_user_ex(mask, &sc->oldmask);
+                put_user_ex(current->thread.cr2, &sc->cr2);
+        } put_user_catch(err);
 
         return err;
 }
@@ -437,13 +459,17 @@ int ia32_setup_frame(int sig, struct k_sigaction *ka,
                 else
                         restorer = &frame->retcode;
         }
-        err |= __put_user(ptr_to_compat(restorer), &frame->pretcode);
 
-        /*
-         * These are actually not used anymore, but left because some
-         * gdb versions depend on them as a marker.
-         */
-        err |= __put_user(*((u64 *)&code), (u64 *)frame->retcode);
+        put_user_try {
+                put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
+
+                /*
+                 * These are actually not used anymore, but left because some
+                 * gdb versions depend on them as a marker.
+                 */
+                put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
+        } put_user_catch(err);
+
         if (err)
                 return -EFAULT;
 
@@ -496,41 +522,40 @@ int ia32_setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                 return -EFAULT;
 
-        err |= __put_user(sig, &frame->sig);
-        err |= __put_user(ptr_to_compat(&frame->info), &frame->pinfo);
-        err |= __put_user(ptr_to_compat(&frame->uc), &frame->puc);
-        err |= copy_siginfo_to_user32(&frame->info, info);
-        if (err)
-                return -EFAULT;
+        put_user_try {
+                put_user_ex(sig, &frame->sig);
+                put_user_ex(ptr_to_compat(&frame->info), &frame->pinfo);
+                put_user_ex(ptr_to_compat(&frame->uc), &frame->puc);
+                err |= copy_siginfo_to_user32(&frame->info, info);
 
-        /* Create the ucontext.  */
-        if (cpu_has_xsave)
-                err |= __put_user(UC_FP_XSTATE, &frame->uc.uc_flags);
-        else
-                err |= __put_user(0, &frame->uc.uc_flags);
-        err |= __put_user(0, &frame->uc.uc_link);
-        err |= __put_user(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
-        err |= __put_user(sas_ss_flags(regs->sp),
-                          &frame->uc.uc_stack.ss_flags);
-        err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
-        err |= ia32_setup_sigcontext(&frame->uc.uc_mcontext, fpstate,
-                                     regs, set->sig[0]);
-        err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
-        if (err)
-                return -EFAULT;
+                /* Create the ucontext.  */
+                if (cpu_has_xsave)
+                        put_user_ex(UC_FP_XSTATE, &frame->uc.uc_flags);
+                else
+                        put_user_ex(0, &frame->uc.uc_flags);
+                put_user_ex(0, &frame->uc.uc_link);
+                put_user_ex(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
+                put_user_ex(sas_ss_flags(regs->sp),
+                            &frame->uc.uc_stack.ss_flags);
+                put_user_ex(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
+                err |= ia32_setup_sigcontext(&frame->uc.uc_mcontext, fpstate,
+                                             regs, set->sig[0]);
+                err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+
+                if (ka->sa.sa_flags & SA_RESTORER)
+                        restorer = ka->sa.sa_restorer;
+                else
+                        restorer = VDSO32_SYMBOL(current->mm->context.vdso,
+                                                 rt_sigreturn);
+                put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
+
+                /*
+                 * Not actually used anymore, but left because some gdb
+                 * versions need it.
+                 */
+                put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
+        } put_user_catch(err);
 
-        if (ka->sa.sa_flags & SA_RESTORER)
-                restorer = ka->sa.sa_restorer;
-        else
-                restorer = VDSO32_SYMBOL(current->mm->context.vdso,
-                                         rt_sigreturn);
-        err |= __put_user(ptr_to_compat(restorer), &frame->pretcode);
-
-        /*
-         * Not actually used anymore, but left because some gdb
-         * versions need it.
-         */
-        err |= __put_user(*((u64 *)&code), (u64 *)frame->retcode);
         if (err)
                 return -EFAULT;
 
diff --git a/arch/x86/ia32/ia32entry.S b/arch/x86/ia32/ia32entry.S
index 256b00b6189..097a6b64c24 100644
--- a/arch/x86/ia32/ia32entry.S
+++ b/arch/x86/ia32/ia32entry.S
@@ -112,8 +112,8 @@ ENTRY(ia32_sysenter_target)
         CFI_DEF_CFA     rsp,0
         CFI_REGISTER    rsp,rbp
         SWAPGS_UNSAFE_STACK
-        movq    %gs:pda_kernelstack, %rsp
-        addq    $(PDA_STACKOFFSET),%rsp 
+        movq    PER_CPU_VAR(kernel_stack), %rsp
+        addq    $(KERNEL_STACK_OFFSET),%rsp
         /*
          * No need to follow this irqs on/off section: the syscall
          * disabled irqs, here we enable it straight after entry:
@@ -273,13 +273,13 @@ ENDPROC(ia32_sysenter_target)
 ENTRY(ia32_cstar_target)
         CFI_STARTPROC32 simple
         CFI_SIGNAL_FRAME
-        CFI_DEF_CFA     rsp,PDA_STACKOFFSET
+        CFI_DEF_CFA     rsp,KERNEL_STACK_OFFSET
         CFI_REGISTER    rip,rcx
         /*CFI_REGISTER  rflags,r11*/
         SWAPGS_UNSAFE_STACK
         movl    %esp,%r8d
         CFI_REGISTER    rsp,r8
-        movq    %gs:pda_kernelstack,%rsp
+        movq    PER_CPU_VAR(kernel_stack),%rsp
         /*
          * No need to follow this irqs on/off section: the syscall
          * disabled irqs and here we enable it straight after entry:
@@ -418,9 +418,9 @@ ENTRY(ia32_syscall)
         orl   $TS_COMPAT,TI_status(%r10)
         testl $_TIF_WORK_SYSCALL_ENTRY,TI_flags(%r10)
         jnz ia32_tracesys
-ia32_do_syscall:        
         cmpl $(IA32_NR_syscalls-1),%eax
-        ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
+        ja ia32_badsys
+ia32_do_call:
         IA32_ARG_FIXUP
         call *ia32_sys_call_table(,%rax,8) # xxx: rip relative
 ia32_sysret:
@@ -435,7 +435,9 @@ ia32_tracesys:
         call syscall_trace_enter
         LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
         RESTORE_REST
-        jmp ia32_do_syscall
+        cmpl $(IA32_NR_syscalls-1),%eax
+        ja  int_ret_from_sys_call       /* ia32_tracesys has set RAX(%rsp) */
+        jmp ia32_do_call
 END(ia32_syscall)
 
 ia32_badsys:
diff --git a/arch/x86/include/asm/a.out-core.h b/arch/x86/include/asm/a.out-core.h
index 37822206083..bb70e397aa8 100644
--- a/arch/x86/include/asm/a.out-core.h
+++ b/arch/x86/include/asm/a.out-core.h
@@ -23,8 +23,6 @@
  */
 static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
 {
-        u16 gs;
-
 /* changed the size calculations - should hopefully work better. lbt */
         dump->magic = CMAGIC;
         dump->start_code = 0;
@@ -57,7 +55,7 @@ static inline void aout_dump_thread(struct pt_regs *regs, struct user *dump)
         dump->regs.ds = (u16)regs->ds;
         dump->regs.es = (u16)regs->es;
         dump->regs.fs = (u16)regs->fs;
-        savesegment(gs, gs);
+        dump->regs.gs = get_user_gs(regs);
         dump->regs.orig_ax = regs->orig_ax;
         dump->regs.ip = regs->ip;
         dump->regs.cs = (u16)regs->cs;
diff --git a/arch/x86/include/asm/acpi.h b/arch/x86/include/asm/acpi.h
index 9830681446a..4518dc50090 100644
--- a/arch/x86/include/asm/acpi.h
+++ b/arch/x86/include/asm/acpi.h
@@ -102,9 +102,6 @@ static inline void disable_acpi(void)
         acpi_noirq = 1;
 }
 
-/* Fixmap pages to reserve for ACPI boot-time tables (see fixmap.h) */
-#define FIX_ACPI_PAGES 4
-
 extern int acpi_gsi_to_irq(u32 gsi, unsigned int *irq);
 
 static inline void acpi_noirq_set(void) { acpi_noirq = 1; }
diff --git a/arch/x86/include/asm/apic.h b/arch/x86/include/asm/apic.h
index ab1d51a8855..fba49f66228 100644
--- a/arch/x86/include/asm/apic.h
+++ b/arch/x86/include/asm/apic.h
@@ -33,7 +33,13 @@
         } while (0)
 
 
+#if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_X86_32)
 extern void generic_apic_probe(void);
+#else
+static inline void generic_apic_probe(void)
+{
+}
+#endif
 
 #ifdef CONFIG_X86_LOCAL_APIC
 
@@ -41,6 +47,21 @@ extern unsigned int apic_verbosity;
 extern int local_apic_timer_c2_ok;
 
 extern int disable_apic;
+
+#ifdef CONFIG_SMP
+extern void __inquire_remote_apic(int apicid);
+#else /* CONFIG_SMP */
+static inline void __inquire_remote_apic(int apicid)
+{
+}
+#endif /* CONFIG_SMP */
+
+static inline void default_inquire_remote_apic(int apicid)
+{
+        if (apic_verbosity >= APIC_DEBUG)
+                __inquire_remote_apic(apicid);
+}
+
 /*
  * Basic functions accessing APICs.
  */
@@ -124,12 +145,35 @@ struct apic_ops {
 
 extern struct apic_ops *apic_ops;
 
-#define apic_read (apic_ops->read)
-#define apic_write (apic_ops->write)
-#define apic_icr_read (apic_ops->icr_read)
-#define apic_icr_write (apic_ops->icr_write)
-#define apic_wait_icr_idle (apic_ops->wait_icr_idle)
-#define safe_apic_wait_icr_idle (apic_ops->safe_wait_icr_idle)
+static inline u32 apic_read(u32 reg)
+{
+        return apic_ops->read(reg);
+}
+
+static inline void apic_write(u32 reg, u32 val)
+{
+        apic_ops->write(reg, val);
+}
+
+static inline u64 apic_icr_read(void)
+{
+        return apic_ops->icr_read();
+}
+
+static inline void apic_icr_write(u32 low, u32 high)
+{
+        apic_ops->icr_write(low, high);
+}
+
+static inline void apic_wait_icr_idle(void)
+{
+        apic_ops->wait_icr_idle();
+}
+
+static inline u32 safe_apic_wait_icr_idle(void)
+{
+        return apic_ops->safe_wait_icr_idle();
+}
 
 extern int get_physical_broadcast(void);
 
@@ -196,4 +240,22 @@ static inline void disable_local_APIC(void) { }
 
 #endif /* !CONFIG_X86_LOCAL_APIC */
 
+#ifdef CONFIG_X86_64
+#define SET_APIC_ID(x)          (apic->set_apic_id(x))
+#else
+
+#ifdef CONFIG_X86_LOCAL_APIC
+static inline unsigned default_get_apic_id(unsigned long x)
+{
+        unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR));
+
+        if (APIC_XAPIC(ver))
+                return (x >> 24) & 0xFF;
+        else
+                return (x >> 24) & 0x0F;
+}
+#endif
+
+#endif
+
 #endif /* _ASM_X86_APIC_H */
diff --git a/arch/x86/include/asm/apicnum.h b/arch/x86/include/asm/apicnum.h
new file mode 100644
index 00000000000..82f613c607c
--- /dev/null
+++ b/arch/x86/include/asm/apicnum.h
@@ -0,0 +1,12 @@
+#ifndef _ASM_X86_APICNUM_H
+#define _ASM_X86_APICNUM_H
+
+/* define MAX_IO_APICS */
+#ifdef CONFIG_X86_32
+# define MAX_IO_APICS 64
+#else
+# define MAX_IO_APICS 128
+# define MAX_LOCAL_APIC 32768
+#endif
+
+#endif /* _ASM_X86_APICNUM_H */
diff --git a/arch/x86/include/asm/mach-default/apm.h b/arch/x86/include/asm/apm.h
index 20370c6db74..20370c6db74 100644
--- a/arch/x86/include/asm/mach-default/apm.h
+++ b/arch/x86/include/asm/apm.h
diff --git a/arch/x86/include/asm/bigsmp/apic.h b/arch/x86/include/asm/bigsmp/apic.h
deleted file mode 100644
index d8dd9f53791..00000000000
--- a/arch/x86/include/asm/bigsmp/apic.h
+++ /dev/null
@@ -1,155 +0,0 @@
-#ifndef __ASM_MACH_APIC_H
-#define __ASM_MACH_APIC_H
-
-#define xapic_phys_to_log_apicid(cpu) (per_cpu(x86_bios_cpu_apicid, cpu))
-#define esr_disable (1)
-
-static inline int apic_id_registered(void)
-{
-        return (1);
-}
-
-static inline const cpumask_t *target_cpus(void)
-{
-#ifdef CONFIG_SMP
-        return &cpu_online_map;
-#else
-        return &cpumask_of_cpu(0);
-#endif
-}
-
-#undef APIC_DEST_LOGICAL
-#define APIC_DEST_LOGICAL       0
-#define APIC_DFR_VALUE          (APIC_DFR_FLAT)
-#define INT_DELIVERY_MODE       (dest_Fixed)
-#define INT_DEST_MODE           (0)    /* phys delivery to target proc */
-#define NO_BALANCE_IRQ          (0)
-
-static inline unsigned long check_apicid_used(physid_mask_t bitmap, int apicid)
-{
-        return (0);
-}
-
-static inline unsigned long check_apicid_present(int bit)
-{
-        return (1);
-}
-
-static inline unsigned long calculate_ldr(int cpu)
-{
-        unsigned long val, id;
-        val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
-        id = xapic_phys_to_log_apicid(cpu);
-        val |= SET_APIC_LOGICAL_ID(id);
-        return val;
-}
-
-/*
- * Set up the logical destination ID.
- *
- * Intel recommends to set DFR, LDR and TPR before enabling
- * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
- * document number 292116).  So here it goes...
- */
-static inline void init_apic_ldr(void)
-{
-        unsigned long val;
-        int cpu = smp_processor_id();
-
-        apic_write(APIC_DFR, APIC_DFR_VALUE);
-        val = calculate_ldr(cpu);
-        apic_write(APIC_LDR, val);
-}
-
-static inline void setup_apic_routing(void)
-{
-        printk("Enabling APIC mode:  %s.  Using %d I/O APICs\n",
-                "Physflat", nr_ioapics);
-}
-
-static inline int multi_timer_check(int apic, int irq)
-{
-        return (0);
-}
-
-static inline int apicid_to_node(int logical_apicid)
-{
-        return apicid_2_node[hard_smp_processor_id()];
-}
-
-static inline int cpu_present_to_apicid(int mps_cpu)
-{
-        if (mps_cpu < nr_cpu_ids)
-                return (int) per_cpu(x86_bios_cpu_apicid, mps_cpu);
-
-        return BAD_APICID;
-}
-
-static inline physid_mask_t apicid_to_cpu_present(int phys_apicid)
-{
-        return physid_mask_of_physid(phys_apicid);
-}
-
-extern u8 cpu_2_logical_apicid[];
-/* Mapping from cpu number to logical apicid */
-static inline int cpu_to_logical_apicid(int cpu)
-{
-        if (cpu >= nr_cpu_ids)
-                return BAD_APICID;
-        return cpu_physical_id(cpu);
-}
-
-static inline physid_mask_t ioapic_phys_id_map(physid_mask_t phys_map)
-{
-        /* For clustered we don't have a good way to do this yet - hack */
-        return physids_promote(0xFFL);
-}
-
-static inline void setup_portio_remap(void)
-{
-}
-
-static inline void enable_apic_mode(void)
-{
-}
-
-static inline int check_phys_apicid_present(int boot_cpu_physical_apicid)
-{
-        return (1);
-}
-
-/* As we are using single CPU as destination, pick only one CPU here */
-static inline unsigned int cpu_mask_to_apicid(const cpumask_t *cpumask)
-{
-        int cpu;
-        int apicid;     
-
-        cpu = first_cpu(*cpumask);
-        apicid = cpu_to_logical_apicid(cpu);
-        return apicid;
-}
-
-static inline unsigned int cpu_mask_to_apicid_and(const struct cpumask *cpumask,
-                                                  const struct cpumask *andmask)
-{
-        int cpu;
-
-        /*
-         * We're using fixed IRQ delivery, can only return one phys APIC ID.
-         * May as well be the first.
-         */
-        for_each_cpu_and(cpu, cpumask, andmask)
-                if (cpumask_test_cpu(cpu, cpu_online_mask))
-                        break;
-        if (cpu < nr_cpu_ids)
-                return cpu_to_logical_apicid(cpu);
-
-        return BAD_APICID;
-}
-
-static inline u32 phys_pkg_id(u32 cpuid_apic, int index_msb)
-{
-        return cpuid_apic >> index_msb;
-}
-
-#endif /* __ASM_MACH_APIC_H */
diff --git a/arch/x86/include/asm/bigsmp/apicdef.h b/arch/x86/include/asm/bigsmp/apicdef.h
deleted file mode 100644
index 392c3f5ef2f..00000000000
--- a/arch/x86/include/asm/bigsmp/apicdef.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#ifndef __ASM_MACH_APICDEF_H
-#define __ASM_MACH_APICDEF_H
-
-#define         APIC_ID_MASK            (0xFF<<24)
-
-static inline unsigned get_apic_id(unsigned long x)
-{
-        return (((x)>>24)&0xFF);
-}
-
-#define         GET_APIC_ID(x)  get_apic_id(x)
-
-#endif
diff --git a/arch/x86/include/asm/bigsmp/ipi.h b/arch/x86/include/asm/bigsmp/ipi.h
deleted file mode 100644
index 27fcd01b3ae..00000000000
--- a/arch/x86/include/asm/bigsmp/ipi.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef __ASM_MACH_IPI_H
-#define __ASM_MACH_IPI_H
-
-void send_IPI_mask_sequence(const struct cpumask *mask, int vector);
-void send_IPI_mask_allbutself(const struct cpumask *mask, int vector);
-
-static inline void send_IPI_mask(const struct cpumask *mask, int vector)
-{
-        send_IPI_mask_sequence(mask, vector);
-}
-
-static inline void send_IPI_allbutself(int vector)
-{
-        send_IPI_mask_allbutself(cpu_online_mask, vector);
-}
-
-static inline void send_IPI_all(int vector)
-{
-        send_IPI_mask(cpu_online_mask, vector);
-}
-
-#endif /* __ASM_MACH_IPI_H */
diff --git a/arch/x86/include/asm/calling.h b/arch/x86/include/asm/calling.h
index 2bc162e0ec6..0e63c9a2a8d 100644
--- a/arch/x86/include/asm/calling.h
+++ b/arch/x86/include/asm/calling.h
@@ -1,5 +1,55 @@
 /*
- * Some macros to handle stack frames in assembly.
+
+ x86 function call convention, 64-bit:
+ -------------------------------------
+  arguments           |  callee-saved      | extra caller-saved | return
+ [callee-clobbered]   |                    | [callee-clobbered] |
+ ---------------------------------------------------------------------------
+ rdi rsi rdx rcx r8-9 | rbx rbp [*] r12-15 | r10-11             | rax, rdx [**]
+
+ ( rsp is obviously invariant across normal function calls. (gcc can 'merge'
+   functions when it sees tail-call optimization possibilities) rflags is
+   clobbered. Leftover arguments are passed over the stack frame.)
+
+ [*]  In the frame-pointers case rbp is fixed to the stack frame.
+
+ [**] for struct return values wider than 64 bits the return convention is a
+      bit more complex: up to 128 bits width we return small structures
+      straight in rax, rdx. For structures larger than that (3 words or
+      larger) the caller puts a pointer to an on-stack return struct
+      [allocated in the caller's stack frame] into the first argument - i.e.
+      into rdi. All other arguments shift up by one in this case.
+      Fortunately this case is rare in the kernel.
+
+For 32-bit we have the following conventions - kernel is built with
+-mregparm=3 and -freg-struct-return:
+
+ x86 function calling convention, 32-bit:
+ ----------------------------------------
+  arguments         | callee-saved        | extra caller-saved | return
+ [callee-clobbered] |                     | [callee-clobbered] |
+ -------------------------------------------------------------------------
+ eax edx ecx        | ebx edi esi ebp [*] | <none>             | eax, edx [**]
+
+ ( here too esp is obviously invariant across normal function calls. eflags
+   is clobbered. Leftover arguments are passed over the stack frame. )
+
+ [*]  In the frame-pointers case ebp is fixed to the stack frame.
+
+ [**] We build with -freg-struct-return, which on 32-bit means similar
+      semantics as on 64-bit: edx can be used for a second return value
+      (i.e. covering integer and structure sizes up to 64 bits) - after that
+      it gets more complex and more expensive: 3-word or larger struct returns
+      get done in the caller's frame and the pointer to the return struct goes
+      into regparm0, i.e. eax - the other arguments shift up and the
+      function's register parameters degenerate to regparm=2 in essence.
+
+*/
+
+
+/*
+ * 64-bit system call stack frame layout defines and helpers,
+ * for assembly code:
  */
 
 #define R15               0
@@ -9,7 +59,7 @@
 #define RBP              32
 #define RBX              40
 
-/* arguments: interrupts/non tracing syscalls only save upto here*/
+/* arguments: interrupts/non tracing syscalls only save up to here: */
 #define R11              48
 #define R10              56
 #define R9               64
@@ -22,7 +72,7 @@
 #define ORIG_RAX        120       /* + error_code */
 /* end of arguments */
 
-/* cpu exception frame or undefined in case of fast syscall. */
+/* cpu exception frame or undefined in case of fast syscall: */
 #define RIP             128
 #define CS              136
 #define EFLAGS          144
diff --git a/arch/x86/include/asm/cpu.h b/arch/x86/include/asm/cpu.h
index bae482df603..b185091bf19 100644
--- a/arch/x86/include/asm/cpu.h
+++ b/arch/x86/include/asm/cpu.h
@@ -7,6 +7,20 @@
 #include <linux/nodemask.h>
 #include <linux/percpu.h>
 
+#ifdef CONFIG_SMP
+
+extern void prefill_possible_map(void);
+
+#else /* CONFIG_SMP */
+
+static inline void prefill_possible_map(void) {}
+
+#define cpu_physical_id(cpu)                    boot_cpu_physical_apicid
+#define safe_smp_processor_id()                 0
+#define stack_smp_processor_id()                0
+
+#endif /* CONFIG_SMP */
+
 struct x86_cpu {
         struct cpu cpu;
 };
@@ -17,4 +31,7 @@ extern void arch_unregister_cpu(int);
 #endif
 
 DECLARE_PER_CPU(int, cpu_state);
+
+extern unsigned int boot_cpu_id;
+
 #endif /* _ASM_X86_CPU_H */
diff --git a/arch/x86/include/asm/cpufeature.h b/arch/x86/include/asm/cpufeature.h
index ea408dcba51..7301e60dc4a 100644
--- a/arch/x86/include/asm/cpufeature.h
+++ b/arch/x86/include/asm/cpufeature.h
@@ -93,6 +93,7 @@
 #define X86_FEATURE_XTOPOLOGY   (3*32+22) /* cpu topology enum extensions */
 #define X86_FEATURE_TSC_RELIABLE (3*32+23) /* TSC is known to be reliable */
 #define X86_FEATURE_NONSTOP_TSC (3*32+24) /* TSC does not stop in C states */
+#define X86_FEATURE_CLFLUSH_MONITOR (3*32+25) /* "" clflush reqd with monitor */
 
 /* Intel-defined CPU features, CPUID level 0x00000001 (ecx), word 4 */
 #define X86_FEATURE_XMM3        (4*32+ 0) /* "pni" SSE-3 */
diff --git a/arch/x86/include/asm/cpumask.h b/arch/x86/include/asm/cpumask.h
new file mode 100644
index 00000000000..a7f3c75f8ad
--- /dev/null
+++ b/arch/x86/include/asm/cpumask.h
@@ -0,0 +1,32 @@
+#ifndef _ASM_X86_CPUMASK_H
+#define _ASM_X86_CPUMASK_H
+#ifndef __ASSEMBLY__
+#include <linux/cpumask.h>
+
+#ifdef CONFIG_X86_64
+
+extern cpumask_var_t cpu_callin_mask;
+extern cpumask_var_t cpu_callout_mask;
+extern cpumask_var_t cpu_initialized_mask;
+extern cpumask_var_t cpu_sibling_setup_mask;
+
+extern void setup_cpu_local_masks(void);
+
+#else /* CONFIG_X86_32 */
+
+extern cpumask_t cpu_callin_map;
+extern cpumask_t cpu_callout_map;
+extern cpumask_t cpu_initialized;
+extern cpumask_t cpu_sibling_setup_map;
+
+#define cpu_callin_mask         ((struct cpumask *)&cpu_callin_map)
+#define cpu_callout_mask        ((struct cpumask *)&cpu_callout_map)
+#define cpu_initialized_mask    ((struct cpumask *)&cpu_initialized)
+#define cpu_sibling_setup_mask  ((struct cpumask *)&cpu_sibling_setup_map)
+
+static inline void setup_cpu_local_masks(void) { }
+
+#endif /* CONFIG_X86_32 */
+
+#endif /* __ASSEMBLY__ */
+#endif /* _ASM_X86_CPUMASK_H */
diff --git a/arch/x86/include/asm/current.h b/arch/x86/include/asm/current.h
index 0930b4f8d67..c68c361697e 100644
--- a/arch/x86/include/asm/current.h
+++ b/arch/x86/include/asm/current.h
@@ -1,39 +1,21 @@
 #ifndef _ASM_X86_CURRENT_H
 #define _ASM_X86_CURRENT_H
 
-#ifdef CONFIG_X86_32
 #include <linux/compiler.h>
 #include <asm/percpu.h>
 
+#ifndef __ASSEMBLY__
 struct task_struct;
 
 DECLARE_PER_CPU(struct task_struct *, current_task);
-static __always_inline struct task_struct *get_current(void)
-{
-        return x86_read_percpu(current_task);
-}
-
-#else /* X86_32 */
-
-#ifndef __ASSEMBLY__
-#include <asm/pda.h>
-
-struct task_struct;
 
 static __always_inline struct task_struct *get_current(void)
 {
-        return read_pda(pcurrent);
+        return percpu_read(current_task);
 }
 
-#else /* __ASSEMBLY__ */
-
-#include <asm/asm-offsets.h>
-#define GET_CURRENT(reg) movq %gs:(pda_pcurrent),reg
+#define current get_current()
 
 #endif /* __ASSEMBLY__ */
 
-#endif /* X86_32 */
-
-#define current get_current()
-
 #endif /* _ASM_X86_CURRENT_H */
diff --git a/arch/x86/include/asm/mach-default/do_timer.h b/arch/x86/include/asm/do_timer.h
index 23ecda0b28a..23ecda0b28a 100644
--- a/arch/x86/include/asm/mach-default/do_timer.h
+++ b/arch/x86/include/asm/do_timer.h
diff --git a/arch/x86/include/asm/elf.h b/arch/x86/include/asm/elf.h
index f51a3ddde01..83c1bc8d2e8 100644
--- a/arch/x86/include/asm/elf.h
+++ b/arch/x86/include/asm/elf.h
@@ -112,7 +112,7 @@ extern unsigned int vdso_enabled;
  * now struct_user_regs, they are different)
  */
 
-#define ELF_CORE_COPY_REGS(pr_reg, regs)        \
+#define ELF_CORE_COPY_REGS_COMMON(pr_reg, regs) \
 do {                                            \
         pr_reg[0] = regs->bx;                   \
         pr_reg[1] = regs->cx;                   \
@@ -124,7 +124,6 @@ do {						\
         pr_reg[7] = regs->ds & 0xffff;          \
         pr_reg[8] = regs->es & 0xffff;          \
         pr_reg[9] = regs->fs & 0xffff;          \
-        savesegment(gs, pr_reg[10]);            \
         pr_reg[11] = regs->orig_ax;             \
         pr_reg[12] = regs->ip;                  \
         pr_reg[13] = regs->cs & 0xffff;         \
@@ -133,6 +132,18 @@ do {						\
         pr_reg[16] = regs->ss & 0xffff;         \
 } while (0);
 
+#define ELF_CORE_COPY_REGS(pr_reg, regs)        \
+do {                                            \
+        ELF_CORE_COPY_REGS_COMMON(pr_reg, regs);\
+        pr_reg[10] = get_user_gs(regs);         \
+} while (0);
+
+#define ELF_CORE_COPY_KERNEL_REGS(pr_reg, regs) \
+do {                                            \
+        ELF_CORE_COPY_REGS_COMMON(pr_reg, regs);\
+        savesegment(gs, pr_reg[10]);            \
+} while (0);
+
 #define ELF_PLATFORM    (utsname()->machine)
 #define set_personality_64bit() do { } while (0)
 
diff --git a/arch/x86/include/asm/mach-default/entry_arch.h b/arch/x86/include/asm/entry_arch.h
index 6b1add8e31d..854d538ae85 100644
--- a/arch/x86/include/asm/mach-default/entry_arch.h
+++ b/arch/x86/include/asm/entry_arch.h
@@ -9,12 +9,28 @@
  * is no hardware IRQ pin equivalent for them, they are triggered
  * through the ICC by us (IPIs)
  */
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_SMP
 BUILD_INTERRUPT(reschedule_interrupt,RESCHEDULE_VECTOR)
-BUILD_INTERRUPT(invalidate_interrupt,INVALIDATE_TLB_VECTOR)
 BUILD_INTERRUPT(call_function_interrupt,CALL_FUNCTION_VECTOR)
 BUILD_INTERRUPT(call_function_single_interrupt,CALL_FUNCTION_SINGLE_VECTOR)
 BUILD_INTERRUPT(irq_move_cleanup_interrupt,IRQ_MOVE_CLEANUP_VECTOR)
+
+BUILD_INTERRUPT3(invalidate_interrupt0,INVALIDATE_TLB_VECTOR_START+0,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt1,INVALIDATE_TLB_VECTOR_START+1,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt2,INVALIDATE_TLB_VECTOR_START+2,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt3,INVALIDATE_TLB_VECTOR_START+3,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt4,INVALIDATE_TLB_VECTOR_START+4,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt5,INVALIDATE_TLB_VECTOR_START+5,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt6,INVALIDATE_TLB_VECTOR_START+6,
+                 smp_invalidate_interrupt)
+BUILD_INTERRUPT3(invalidate_interrupt7,INVALIDATE_TLB_VECTOR_START+7,
+                 smp_invalidate_interrupt)
 #endif
 
 /*
@@ -25,10 +41,15 @@ BUILD_INTERRUPT(irq_move_cleanup_interrupt,IRQ_MOVE_CLEANUP_VECTOR)
  * a much simpler SMP time architecture:
  */
 #ifdef CONFIG_X86_LOCAL_APIC
+
 BUILD_INTERRUPT(apic_timer_interrupt,LOCAL_TIMER_VECTOR)
 BUILD_INTERRUPT(error_interrupt,ERROR_APIC_VECTOR)
 BUILD_INTERRUPT(spurious_interrupt,SPURIOUS_APIC_VECTOR)
 
+#ifdef CONFIG_PERF_COUNTERS
+BUILD_INTERRUPT(perf_counter_interrupt, LOCAL_PERF_VECTOR)
+#endif
+
 #ifdef CONFIG_X86_MCE_P4THERMAL
 BUILD_INTERRUPT(thermal_interrupt,THERMAL_APIC_VECTOR)
 #endif
diff --git a/arch/x86/include/asm/es7000/apic.h b/arch/x86/include/asm/es7000/apic.h
deleted file mode 100644
index c58b9cc7446..00000000000
--- a/arch/x86/include/asm/es7000/apic.h
+++ /dev/null
@@ -1,242 +0,0 @@
-#ifndef __ASM_ES7000_APIC_H
-#define __ASM_ES7000_APIC_H
-
-#include <linux/gfp.h>
-
-#define xapic_phys_to_log_apicid(cpu) per_cpu(x86_bios_cpu_apicid, cpu)
-#define esr_disable (1)
-
-static inline int apic_id_registered(void)
-{
-                return (1);
-}
-
-static inline const cpumask_t *target_cpus_cluster(void)
-{
-        return &CPU_MASK_ALL;
-}
-
-static inline const cpumask_t *target_cpus(void)
-{
-        return &cpumask_of_cpu(smp_processor_id());
-}
-
-#define APIC_DFR_VALUE_CLUSTER          (APIC_DFR_CLUSTER)
-#define INT_DELIVERY_MODE_CLUSTER       (dest_LowestPrio)
-#define INT_DEST_MODE_CLUSTER           (1) /* logical delivery broadcast to all procs */
-#define NO_BALANCE_IRQ_CLUSTER          (1)
-
-#define APIC_DFR_VALUE          (APIC_DFR_FLAT)
-#define INT_DELIVERY_MODE       (dest_Fixed)
-#define INT_DEST_MODE           (0)    /* phys delivery to target procs */
-#define NO_BALANCE_IRQ          (0)
-#undef  APIC_DEST_LOGICAL
-#define APIC_DEST_LOGICAL       0x0
-
-static inline unsigned long check_apicid_used(physid_mask_t bitmap, int apicid)
-{
-        return 0;
-}
-static inline unsigned long check_apicid_present(int bit)
-{
-        return physid_isset(bit, phys_cpu_present_map);
-}
-
-#define apicid_cluster(apicid) (apicid & 0xF0)
-
-static inline unsigned long calculate_ldr(int cpu)
-{
-        unsigned long id;
-        id = xapic_phys_to_log_apicid(cpu);
-        return (SET_APIC_LOGICAL_ID(id));
-}
-
-/*
- * Set up the logical destination ID.
- *
- * Intel recommends to set DFR, LdR and TPR before enabling
- * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
- * document number 292116).  So here it goes...
- */
-static inline void init_apic_ldr_cluster(void)
-{
-        unsigned long val;
-        int cpu = smp_processor_id();
-
-        apic_write(APIC_DFR, APIC_DFR_VALUE_CLUSTER);
-        val = calculate_ldr(cpu);
-        apic_write(APIC_LDR, val);
-}
-
-static inline void init_apic_ldr(void)
-{
-        unsigned long val;
-        int cpu = smp_processor_id();
-
-        apic_write(APIC_DFR, APIC_DFR_VALUE);
-        val = calculate_ldr(cpu);
-        apic_write(APIC_LDR, val);
-}
-
-extern int apic_version [MAX_APICS];
-static inline void setup_apic_routing(void)
-{
-        int apic = per_cpu(x86_bios_cpu_apicid, smp_processor_id());
-        printk("Enabling APIC mode:  %s. Using %d I/O APICs, target cpus %lx\n",
-                (apic_version[apic] == 0x14) ?
-                        "Physical Cluster" : "Logical Cluster",
-                        nr_ioapics, cpus_addr(*target_cpus())[0]);
-}
-
-static inline int multi_timer_check(int apic, int irq)
-{
-        return 0;
-}
-
-static inline int apicid_to_node(int logical_apicid)
-{
-        return 0;
-}
-
-
-static inline int cpu_present_to_apicid(int mps_cpu)
-{
-        if (!mps_cpu)
-                return boot_cpu_physical_apicid;
-        else if (mps_cpu < nr_cpu_ids)
-                return (int) per_cpu(x86_bios_cpu_apicid, mps_cpu);
-        else
-                return BAD_APICID;
-}
-
-static inline physid_mask_t apicid_to_cpu_present(int phys_apicid)
-{
-        static int id = 0;
-        physid_mask_t mask;
-        mask = physid_mask_of_physid(id);
-        ++id;
-        return mask;
-}
-
-extern u8 cpu_2_logical_apicid[];
-/* Mapping from cpu number to logical apicid */
-static inline int cpu_to_logical_apicid(int cpu)
-{
-#ifdef CONFIG_SMP
-        if (cpu >= nr_cpu_ids)
-                return BAD_APICID;
-        return (int)cpu_2_logical_apicid[cpu];
-#else
-        return logical_smp_processor_id();
-#endif
-}
-
-static inline physid_mask_t ioapic_phys_id_map(physid_mask_t phys_map)
-{
-        /* For clustered we don't have a good way to do this yet - hack */
-        return physids_promote(0xff);
-}
-
-
-static inline void setup_portio_remap(void)
-{
-}
-
-extern unsigned int boot_cpu_physical_apicid;
-static inline int check_phys_apicid_present(int cpu_physical_apicid)
-{
-        boot_cpu_physical_apicid = read_apic_id();
-        return (1);
-}
-
-static inline unsigned int
-cpu_mask_to_apicid_cluster(const struct cpumask *cpumask)
-{
-        int num_bits_set;
-        int cpus_found = 0;
-        int cpu;
-        int apicid;
-
-        num_bits_set = cpumask_weight(cpumask);
-        /* Return id to all */
-        if (num_bits_set == nr_cpu_ids)
-                return 0xFF;
-        /*
-         * The cpus in the mask must all be on the apic cluster.  If are not
-         * on the same apicid cluster return default value of TARGET_CPUS.
-         */
-        cpu = cpumask_first(cpumask);
-        apicid = cpu_to_logical_apicid(cpu);
-        while (cpus_found < num_bits_set) {
-                if (cpumask_test_cpu(cpu, cpumask)) {
-                        int new_apicid = cpu_to_logical_apicid(cpu);
-                        if (apicid_cluster(apicid) !=
-                                        apicid_cluster(new_apicid)){
-                                printk ("%s: Not a valid mask!\n", __func__);
-                                return 0xFF;
-                        }
-                        apicid = new_apicid;
-                        cpus_found++;
-                }
-                cpu++;
-        }
-        return apicid;
-}
-
-static inline unsigned int cpu_mask_to_apicid(const cpumask_t *cpumask)
-{
-        int num_bits_set;
-        int cpus_found = 0;
-        int cpu;
-        int apicid;
-
-        num_bits_set = cpus_weight(*cpumask);
-        /* Return id to all */
-        if (num_bits_set == nr_cpu_ids)
-                return cpu_to_logical_apicid(0);
-        /*
-         * The cpus in the mask must all be on the apic cluster.  If are not
-         * on the same apicid cluster return default value of TARGET_CPUS.
-         */
-        cpu = first_cpu(*cpumask);
-        apicid = cpu_to_logical_apicid(cpu);
-        while (cpus_found < num_bits_set) {
-                if (cpu_isset(cpu, *cpumask)) {
-                        int new_apicid = cpu_to_logical_apicid(cpu);
-                        if (apicid_cluster(apicid) !=
-                                        apicid_cluster(new_apicid)){
-                                printk ("%s: Not a valid mask!\n", __func__);
-                                return cpu_to_logical_apicid(0);
-                        }
-                        apicid = new_apicid;
-                        cpus_found++;
-                }
-                cpu++;
-        }
-        return apicid;
-}
-
-
-static inline unsigned int cpu_mask_to_apicid_and(const struct cpumask *inmask,
-                                                  const struct cpumask *andmask)
-{
-        int apicid = cpu_to_logical_apicid(0);
-        cpumask_var_t cpumask;
-
-        if (!alloc_cpumask_var(&cpumask, GFP_ATOMIC))
-                return apicid;
-
-        cpumask_and(cpumask, inmask, andmask);
-        cpumask_and(cpumask, cpumask, cpu_online_mask);
-        apicid = cpu_mask_to_apicid(cpumask);
-
-        free_cpumask_var(cpumask);
-        return apicid;
-}
-
-static inline u32 phys_pkg_id(u32 cpuid_apic, int index_msb)
-{
-        return cpuid_apic >> index_msb;
-}
-
-#endif /* __ASM_ES7000_APIC_H */
diff --git a/arch/x86/include/asm/es7000/apicdef.h b/arch/x86/include/asm/es7000/apicdef.h
deleted file mode 100644
index 8b234a3cb85..00000000000
--- a/arch/x86/include/asm/es7000/apicdef.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#ifndef __ASM_ES7000_APICDEF_H
-#define __ASM_ES7000_APICDEF_H
-
-#define         APIC_ID_MASK            (0xFF<<24)
-
-static inline unsigned get_apic_id(unsigned long x)
-{
-        return (((x)>>24)&0xFF);
-}
-
-#define         GET_APIC_ID(x)  get_apic_id(x)
-
-#endif
diff --git a/arch/x86/include/asm/es7000/ipi.h b/arch/x86/include/asm/es7000/ipi.h
deleted file mode 100644
index 7e8ed24d4b8..00000000000
--- a/arch/x86/include/asm/es7000/ipi.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef __ASM_ES7000_IPI_H
-#define __ASM_ES7000_IPI_H
-
-void send_IPI_mask_sequence(const struct cpumask *mask, int vector);
-void send_IPI_mask_allbutself(const struct cpumask *mask, int vector);
-
-static inline void send_IPI_mask(const struct cpumask *mask, int vector)
-{
-        send_IPI_mask_sequence(mask, vector);
-}
-
-static inline void send_IPI_allbutself(int vector)
-{
-        send_IPI_mask_allbutself(cpu_online_mask, vector);
-}
-
-static inline void send_IPI_all(int vector)
-{
-        send_IPI_mask(cpu_online_mask, vector);
-}
-
-#endif /* __ASM_ES7000_IPI_H */
diff --git a/arch/x86/include/asm/es7000/mpparse.h b/arch/x86/include/asm/es7000/mpparse.h
deleted file mode 100644
index c1629b090ec..00000000000
--- a/arch/x86/include/asm/es7000/mpparse.h
+++ /dev/null
@@ -1,29 +0,0 @@
-#ifndef __ASM_ES7000_MPPARSE_H
-#define __ASM_ES7000_MPPARSE_H
-
-#include <linux/acpi.h>
-
-extern int parse_unisys_oem (char *oemptr);
-extern int find_unisys_acpi_oem_table(unsigned long *oem_addr);
-extern void unmap_unisys_acpi_oem_table(unsigned long oem_addr);
-extern void setup_unisys(void);
-
-#ifndef CONFIG_X86_GENERICARCH
-extern int acpi_madt_oem_check(char *oem_id, char *oem_table_id);
-extern int mps_oem_check(struct mpc_table *mpc, char *oem, char *productid);
-#endif
-
-#ifdef CONFIG_ACPI
-
-static inline int es7000_check_dsdt(void)
-{
-        struct acpi_table_header header;
-
-        if (ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_DSDT, 0, &header)) &&
-            !strncmp(header.oem_id, "UNISYS", 6))
-                return 1;
-        return 0;
-}
-#endif
-
-#endif /* __ASM_MACH_MPPARSE_H */
diff --git a/arch/x86/include/asm/es7000/wakecpu.h b/arch/x86/include/asm/es7000/wakecpu.h
deleted file mode 100644
index 78f0daaee43..00000000000
--- a/arch/x86/include/asm/es7000/wakecpu.h
+++ /dev/null
@@ -1,37 +0,0 @@
-#ifndef __ASM_ES7000_WAKECPU_H
-#define __ASM_ES7000_WAKECPU_H
-
-#define TRAMPOLINE_PHYS_LOW     0x467
-#define TRAMPOLINE_PHYS_HIGH    0x469
-
-static inline void wait_for_init_deassert(atomic_t *deassert)
-{
-#ifndef CONFIG_ES7000_CLUSTERED_APIC
-        while (!atomic_read(deassert))
-                cpu_relax();
-#endif
-        return;
-}
-
-/* Nothing to do for most platforms, since cleared by the INIT cycle */
-static inline void smp_callin_clear_local_apic(void)
-{
-}
-
-static inline void store_NMI_vector(unsigned short *high, unsigned short *low)
-{
-}
-
-static inline void restore_NMI_vector(unsigned short *high, unsigned short *low)
-{
-}
-
-extern void __inquire_remote_apic(int apicid);
-
-static inline void inquire_remote_apic(int apicid)
-{
-        if (apic_verbosity >= APIC_DEBUG)
-                __inquire_remote_apic(apicid);
-}
-
-#endif /* __ASM_MACH_WAKECPU_H */
diff --git a/arch/x86/include/asm/fixmap_32.h b/arch/x86/include/asm/fixmap_32.h
index c7115c1d721..047d9bab2b3 100644
--- a/arch/x86/include/asm/fixmap_32.h
+++ b/arch/x86/include/asm/fixmap_32.h
@@ -95,10 +95,6 @@ enum fixed_addresses {
                         (__end_of_permanent_fixed_addresses & 255),
         FIX_BTMAP_BEGIN = FIX_BTMAP_END + NR_FIX_BTMAPS*FIX_BTMAPS_SLOTS - 1,
         FIX_WP_TEST,
-#ifdef CONFIG_ACPI
-        FIX_ACPI_BEGIN,
-        FIX_ACPI_END = FIX_ACPI_BEGIN + FIX_ACPI_PAGES - 1,
-#endif
 #ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
         FIX_OHCI1394_BASE,
 #endif
diff --git a/arch/x86/include/asm/fixmap_64.h b/arch/x86/include/asm/fixmap_64.h
index 00a30ab9b1a..298d9ba3fae 100644
--- a/arch/x86/include/asm/fixmap_64.h
+++ b/arch/x86/include/asm/fixmap_64.h
@@ -50,10 +50,6 @@ enum fixed_addresses {
         FIX_PARAVIRT_BOOTMAP,
 #endif
         __end_of_permanent_fixed_addresses,
-#ifdef CONFIG_ACPI
-        FIX_ACPI_BEGIN,
-        FIX_ACPI_END = FIX_ACPI_BEGIN + FIX_ACPI_PAGES - 1,
-#endif
 #ifdef CONFIG_PROVIDE_OHCI1394_DMA_INIT
         FIX_OHCI1394_BASE,
 #endif
diff --git a/arch/x86/include/asm/genapic.h b/arch/x86/include/asm/genapic.h
index d48bee663a6..273b99452ae 100644
--- a/arch/x86/include/asm/genapic.h
+++ b/arch/x86/include/asm/genapic.h
@@ -1,5 +1,263 @@
+#ifndef _ASM_X86_GENAPIC_H
+#define _ASM_X86_GENAPIC_H
+
+#include <linux/cpumask.h>
+
+#include <asm/mpspec.h>
+#include <asm/atomic.h>
+
+/*
+ * Copyright 2004 James Cleverdon, IBM.
+ * Subject to the GNU Public License, v.2
+ *
+ * Generic APIC sub-arch data struct.
+ *
+ * Hacked for x86-64 by James Cleverdon from i386 architecture code by
+ * Martin Bligh, Andi Kleen, James Bottomley, John Stultz, and
+ * James Cleverdon.
+ */
+struct genapic {
+        char *name;
+
+        int (*probe)(void);
+        int (*acpi_madt_oem_check)(char *oem_id, char *oem_table_id);
+        int (*apic_id_registered)(void);
+
+        u32 irq_delivery_mode;
+        u32 irq_dest_mode;
+
+        const struct cpumask *(*target_cpus)(void);
+
+        int disable_esr;
+
+        int dest_logical;
+        unsigned long (*check_apicid_used)(physid_mask_t bitmap, int apicid);
+        unsigned long (*check_apicid_present)(int apicid);
+
+        void (*vector_allocation_domain)(int cpu, struct cpumask *retmask);
+        void (*init_apic_ldr)(void);
+
+        physid_mask_t (*ioapic_phys_id_map)(physid_mask_t map);
+
+        void (*setup_apic_routing)(void);
+        int (*multi_timer_check)(int apic, int irq);
+        int (*apicid_to_node)(int logical_apicid);
+        int (*cpu_to_logical_apicid)(int cpu);
+        int (*cpu_present_to_apicid)(int mps_cpu);
+        physid_mask_t (*apicid_to_cpu_present)(int phys_apicid);
+        void (*setup_portio_remap)(void);
+        int (*check_phys_apicid_present)(int boot_cpu_physical_apicid);
+        void (*enable_apic_mode)(void);
+        int (*phys_pkg_id)(int cpuid_apic, int index_msb);
+
+        /*
+         * When one of the next two hooks returns 1 the genapic
+         * is switched to this. Essentially they are additional
+         * probe functions:
+         */
+        int (*mps_oem_check)(struct mpc_table *mpc, char *oem, char *productid);
+
+        unsigned int (*get_apic_id)(unsigned long x);
+        unsigned long (*set_apic_id)(unsigned int id);
+        unsigned long apic_id_mask;
+
+        unsigned int (*cpu_mask_to_apicid)(const struct cpumask *cpumask);
+        unsigned int (*cpu_mask_to_apicid_and)(const struct cpumask *cpumask,
+                                               const struct cpumask *andmask);
+
+        /* ipi */
+        void (*send_IPI_mask)(const struct cpumask *mask, int vector);
+        void (*send_IPI_mask_allbutself)(const struct cpumask *mask,
+                                         int vector);
+        void (*send_IPI_allbutself)(int vector);
+        void (*send_IPI_all)(int vector);
+        void (*send_IPI_self)(int vector);
+
+        /* wakeup_secondary_cpu */
+        int (*wakeup_cpu)(int apicid, unsigned long start_eip);
+
+        int trampoline_phys_low;
+        int trampoline_phys_high;
+
+        void (*wait_for_init_deassert)(atomic_t *deassert);
+        void (*smp_callin_clear_local_apic)(void);
+        void (*store_NMI_vector)(unsigned short *high, unsigned short *low);
+        void (*inquire_remote_apic)(int apicid);
+};
+
+extern struct genapic *apic;
+
+/*
+ * Warm reset vector default position:
+ */
+#define DEFAULT_TRAMPOLINE_PHYS_LOW             0x467
+#define DEFAULT_TRAMPOLINE_PHYS_HIGH            0x469
+
 #ifdef CONFIG_X86_32
-# include "genapic_32.h"
+extern void es7000_update_genapic_to_cluster(void);
 #else
-# include "genapic_64.h"
+extern struct genapic apic_flat;
+extern struct genapic apic_physflat;
+extern struct genapic apic_x2apic_cluster;
+extern struct genapic apic_x2apic_phys;
+extern int default_acpi_madt_oem_check(char *, char *);
+
+extern void apic_send_IPI_self(int vector);
+
+extern struct genapic apic_x2apic_uv_x;
+DECLARE_PER_CPU(int, x2apic_extra_bits);
+
+extern void default_setup_apic_routing(void);
+
+extern int default_cpu_present_to_apicid(int mps_cpu);
+extern int default_check_phys_apicid_present(int boot_cpu_physical_apicid);
 #endif
+
+static inline void default_wait_for_init_deassert(atomic_t *deassert)
+{
+        while (!atomic_read(deassert))
+                cpu_relax();
+        return;
+}
+
+extern void generic_bigsmp_probe(void);
+
+
+#ifdef CONFIG_X86_LOCAL_APIC
+
+#include <asm/smp.h>
+
+#define APIC_DFR_VALUE  (APIC_DFR_FLAT)
+
+static inline const struct cpumask *default_target_cpus(void)
+{
+#ifdef CONFIG_SMP
+        return cpu_online_mask;
+#else
+        return cpumask_of(0);
+#endif
+}
+
+DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
+
+
+static inline unsigned int read_apic_id(void)
+{
+        unsigned int reg;
+
+        reg = apic_read(APIC_ID);
+
+        return apic->get_apic_id(reg);
+}
+
+#ifdef CONFIG_X86_64
+extern void default_setup_apic_routing(void);
+#else
+
+/*
+ * Set up the logical destination ID.
+ *
+ * Intel recommends to set DFR, LDR and TPR before enabling
+ * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
+ * document number 292116).  So here it goes...
+ */
+extern void default_init_apic_ldr(void);
+
+static inline int default_apic_id_registered(void)
+{
+        return physid_isset(read_apic_id(), phys_cpu_present_map);
+}
+
+static inline unsigned int
+default_cpu_mask_to_apicid(const struct cpumask *cpumask)
+{
+        return cpumask_bits(cpumask)[0];
+}
+
+static inline unsigned int
+default_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
+                               const struct cpumask *andmask)
+{
+        unsigned long mask1 = cpumask_bits(cpumask)[0];
+        unsigned long mask2 = cpumask_bits(andmask)[0];
+        unsigned long mask3 = cpumask_bits(cpu_online_mask)[0];
+
+        return (unsigned int)(mask1 & mask2 & mask3);
+}
+
+static inline int default_phys_pkg_id(int cpuid_apic, int index_msb)
+{
+        return cpuid_apic >> index_msb;
+}
+
+static inline void default_setup_apic_routing(void)
+{
+#ifdef CONFIG_X86_IO_APIC
+        printk("Enabling APIC mode:  %s.  Using %d I/O APICs\n",
+                                        "Flat", nr_ioapics);
+#endif
+}
+
+extern int default_apicid_to_node(int logical_apicid);
+
+#endif
+
+static inline unsigned long default_check_apicid_used(physid_mask_t bitmap, int apicid)
+{
+        return physid_isset(apicid, bitmap);
+}
+
+static inline unsigned long default_check_apicid_present(int bit)
+{
+        return physid_isset(bit, phys_cpu_present_map);
+}
+
+static inline physid_mask_t default_ioapic_phys_id_map(physid_mask_t phys_map)
+{
+        return phys_map;
+}
+
+/* Mapping from cpu number to logical apicid */
+static inline int default_cpu_to_logical_apicid(int cpu)
+{
+        return 1 << cpu;
+}
+
+static inline int __default_cpu_present_to_apicid(int mps_cpu)
+{
+        if (mps_cpu < nr_cpu_ids && cpu_present(mps_cpu))
+                return (int)per_cpu(x86_bios_cpu_apicid, mps_cpu);
+        else
+                return BAD_APICID;
+}
+
+static inline int
+__default_check_phys_apicid_present(int boot_cpu_physical_apicid)
+{
+        return physid_isset(boot_cpu_physical_apicid, phys_cpu_present_map);
+}
+
+#ifdef CONFIG_X86_32
+static inline int default_cpu_present_to_apicid(int mps_cpu)
+{
+        return __default_cpu_present_to_apicid(mps_cpu);
+}
+
+static inline int
+default_check_phys_apicid_present(int boot_cpu_physical_apicid)
+{
+        return __default_check_phys_apicid_present(boot_cpu_physical_apicid);
+}
+#else
+extern int default_cpu_present_to_apicid(int mps_cpu);
+extern int default_check_phys_apicid_present(int boot_cpu_physical_apicid);
+#endif
+
+static inline physid_mask_t default_apicid_to_cpu_present(int phys_apicid)
+{
+        return physid_mask_of_physid(phys_apicid);
+}
+
+#endif /* CONFIG_X86_LOCAL_APIC */
+
+#endif /* _ASM_X86_GENAPIC_64_H */
diff --git a/arch/x86/include/asm/genapic_32.h b/arch/x86/include/asm/genapic_32.h
deleted file mode 100644
index 2c05b737ee2..00000000000
--- a/arch/x86/include/asm/genapic_32.h
+++ /dev/null
@@ -1,148 +0,0 @@
-#ifndef _ASM_X86_GENAPIC_32_H
-#define _ASM_X86_GENAPIC_32_H
-
-#include <asm/mpspec.h>
-#include <asm/atomic.h>
-
-/*
- * Generic APIC driver interface.
- *
- * An straight forward mapping of the APIC related parts of the
- * x86 subarchitecture interface to a dynamic object.
- *
- * This is used by the "generic" x86 subarchitecture.
- *
- * Copyright 2003 Andi Kleen, SuSE Labs.
- */
-
-struct mpc_bus;
-struct mpc_table;
-struct mpc_cpu;
-
-struct genapic {
-        char *name;
-        int (*probe)(void);
-
-        int (*apic_id_registered)(void);
-        const struct cpumask *(*target_cpus)(void);
-        int int_delivery_mode;
-        int int_dest_mode;
-        int ESR_DISABLE;
-        int apic_destination_logical;
-        unsigned long (*check_apicid_used)(physid_mask_t bitmap, int apicid);
-        unsigned long (*check_apicid_present)(int apicid);
-        int no_balance_irq;
-        int no_ioapic_check;
-        void (*init_apic_ldr)(void);
-        physid_mask_t (*ioapic_phys_id_map)(physid_mask_t map);
-
-        void (*setup_apic_routing)(void);
-        int (*multi_timer_check)(int apic, int irq);
-        int (*apicid_to_node)(int logical_apicid);
-        int (*cpu_to_logical_apicid)(int cpu);
-        int (*cpu_present_to_apicid)(int mps_cpu);
-        physid_mask_t (*apicid_to_cpu_present)(int phys_apicid);
-        void (*setup_portio_remap)(void);
-        int (*check_phys_apicid_present)(int boot_cpu_physical_apicid);
-        void (*enable_apic_mode)(void);
-        u32 (*phys_pkg_id)(u32 cpuid_apic, int index_msb);
-
-        /* mpparse */
-        /* When one of the next two hooks returns 1 the genapic
-           is switched to this. Essentially they are additional probe
-           functions. */
-        int (*mps_oem_check)(struct mpc_table *mpc, char *oem,
-                             char *productid);
-        int (*acpi_madt_oem_check)(char *oem_id, char *oem_table_id);
-
-        unsigned (*get_apic_id)(unsigned long x);
-        unsigned long apic_id_mask;
-        unsigned int (*cpu_mask_to_apicid)(const struct cpumask *cpumask);
-        unsigned int (*cpu_mask_to_apicid_and)(const struct cpumask *cpumask,
-                                               const struct cpumask *andmask);
-        void (*vector_allocation_domain)(int cpu, struct cpumask *retmask);
-
-#ifdef CONFIG_SMP
-        /* ipi */
-        void (*send_IPI_mask)(const struct cpumask *mask, int vector);
-        void (*send_IPI_mask_allbutself)(const struct cpumask *mask,
-                                         int vector);
-        void (*send_IPI_allbutself)(int vector);
-        void (*send_IPI_all)(int vector);
-#endif
-        int (*wakeup_cpu)(int apicid, unsigned long start_eip);
-        int trampoline_phys_low;
-        int trampoline_phys_high;
-        void (*wait_for_init_deassert)(atomic_t *deassert);
-        void (*smp_callin_clear_local_apic)(void);
-        void (*store_NMI_vector)(unsigned short *high, unsigned short *low);
-        void (*restore_NMI_vector)(unsigned short *high, unsigned short *low);
-        void (*inquire_remote_apic)(int apicid);
-};
-
-#define APICFUNC(x) .x = x,
-
-/* More functions could be probably marked IPIFUNC and save some space
-   in UP GENERICARCH kernels, but I don't have the nerve right now
-   to untangle this mess. -AK  */
-#ifdef CONFIG_SMP
-#define IPIFUNC(x) APICFUNC(x)
-#else
-#define IPIFUNC(x)
-#endif
-
-#define APIC_INIT(aname, aprobe)                        \
-{                                                       \
-        .name = aname,                                  \
-        .probe = aprobe,                                \
-        .int_delivery_mode = INT_DELIVERY_MODE,         \
-        .int_dest_mode = INT_DEST_MODE,                 \
-        .no_balance_irq = NO_BALANCE_IRQ,               \
-        .ESR_DISABLE = esr_disable,                     \
-        .apic_destination_logical = APIC_DEST_LOGICAL,  \
-        APICFUNC(apic_id_registered)                    \
-        APICFUNC(target_cpus)                           \
-        APICFUNC(check_apicid_used)                     \
-        APICFUNC(check_apicid_present)                  \
-        APICFUNC(init_apic_ldr)                         \
-        APICFUNC(ioapic_phys_id_map)                    \
-        APICFUNC(setup_apic_routing)                    \
-        APICFUNC(multi_timer_check)                     \
-        APICFUNC(apicid_to_node)                        \
-        APICFUNC(cpu_to_logical_apicid)                 \
-        APICFUNC(cpu_present_to_apicid)                 \
-        APICFUNC(apicid_to_cpu_present)                 \
-        APICFUNC(setup_portio_remap)                    \
-        APICFUNC(check_phys_apicid_present)             \
-        APICFUNC(mps_oem_check)                         \
-        APICFUNC(get_apic_id)                           \
-        .apic_id_mask = APIC_ID_MASK,                   \
-        APICFUNC(cpu_mask_to_apicid)                    \
-        APICFUNC(cpu_mask_to_apicid_and)                \
-        APICFUNC(vector_allocation_domain)              \
-        APICFUNC(acpi_madt_oem_check)                   \
-        IPIFUNC(send_IPI_mask)                          \
-        IPIFUNC(send_IPI_allbutself)                    \
-        IPIFUNC(send_IPI_all)                           \
-        APICFUNC(enable_apic_mode)                      \
-        APICFUNC(phys_pkg_id)                           \
-        .trampoline_phys_low = TRAMPOLINE_PHYS_LOW,             \
-        .trampoline_phys_high = TRAMPOLINE_PHYS_HIGH,           \
-        APICFUNC(wait_for_init_deassert)                \
-        APICFUNC(smp_callin_clear_local_apic)           \
-        APICFUNC(store_NMI_vector)                      \
-        APICFUNC(restore_NMI_vector)                    \
-        APICFUNC(inquire_remote_apic)                   \
-}
-
-extern struct genapic *genapic;
-extern void es7000_update_genapic_to_cluster(void);
-
-enum uv_system_type {UV_NONE, UV_LEGACY_APIC, UV_X2APIC, UV_NON_UNIQUE_APIC};
-#define get_uv_system_type()            UV_NONE
-#define is_uv_system()                  0
-#define uv_wakeup_secondary(a, b)       1
-#define uv_system_init()                do {} while (0)
-
-
-#endif /* _ASM_X86_GENAPIC_32_H */
diff --git a/arch/x86/include/asm/genapic_64.h b/arch/x86/include/asm/genapic_64.h
deleted file mode 100644
index adf32fb56aa..00000000000
--- a/arch/x86/include/asm/genapic_64.h
+++ /dev/null
@@ -1,66 +0,0 @@
-#ifndef _ASM_X86_GENAPIC_64_H
-#define _ASM_X86_GENAPIC_64_H
-
-#include <linux/cpumask.h>
-
-/*
- * Copyright 2004 James Cleverdon, IBM.
- * Subject to the GNU Public License, v.2
- *
- * Generic APIC sub-arch data struct.
- *
- * Hacked for x86-64 by James Cleverdon from i386 architecture code by
- * Martin Bligh, Andi Kleen, James Bottomley, John Stultz, and
- * James Cleverdon.
- */
-
-struct genapic {
-        char *name;
-        int (*acpi_madt_oem_check)(char *oem_id, char *oem_table_id);
-        u32 int_delivery_mode;
-        u32 int_dest_mode;
-        int (*apic_id_registered)(void);
-        const struct cpumask *(*target_cpus)(void);
-        void (*vector_allocation_domain)(int cpu, struct cpumask *retmask);
-        void (*init_apic_ldr)(void);
-        /* ipi */
-        void (*send_IPI_mask)(const struct cpumask *mask, int vector);
-        void (*send_IPI_mask_allbutself)(const struct cpumask *mask,
-                                         int vector);
-        void (*send_IPI_allbutself)(int vector);
-        void (*send_IPI_all)(int vector);
-        void (*send_IPI_self)(int vector);
-        /* */
-        unsigned int (*cpu_mask_to_apicid)(const struct cpumask *cpumask);
-        unsigned int (*cpu_mask_to_apicid_and)(const struct cpumask *cpumask,
-                                               const struct cpumask *andmask);
-        unsigned int (*phys_pkg_id)(int index_msb);
-        unsigned int (*get_apic_id)(unsigned long x);
-        unsigned long (*set_apic_id)(unsigned int id);
-        unsigned long apic_id_mask;
-        /* wakeup_secondary_cpu */
-        int (*wakeup_cpu)(int apicid, unsigned long start_eip);
-};
-
-extern struct genapic *genapic;
-
-extern struct genapic apic_flat;
-extern struct genapic apic_physflat;
-extern struct genapic apic_x2apic_cluster;
-extern struct genapic apic_x2apic_phys;
-extern int acpi_madt_oem_check(char *, char *);
-
-extern void apic_send_IPI_self(int vector);
-enum uv_system_type {UV_NONE, UV_LEGACY_APIC, UV_X2APIC, UV_NON_UNIQUE_APIC};
-extern enum uv_system_type get_uv_system_type(void);
-extern int is_uv_system(void);
-
-extern struct genapic apic_x2apic_uv_x;
-DECLARE_PER_CPU(int, x2apic_extra_bits);
-extern void uv_cpu_init(void);
-extern void uv_system_init(void);
-extern int uv_wakeup_secondary(int phys_apicid, unsigned int start_rip);
-
-extern void setup_apic_routing(void);
-
-#endif /* _ASM_X86_GENAPIC_64_H */
diff --git a/arch/x86/include/asm/hardirq.h b/arch/x86/include/asm/hardirq.h
index 000787df66e..176f058e715 100644
--- a/arch/x86/include/asm/hardirq.h
+++ b/arch/x86/include/asm/hardirq.h
@@ -1,11 +1,52 @@
-#ifdef CONFIG_X86_32
-# include "hardirq_32.h"
-#else
-# include "hardirq_64.h"
+#ifndef _ASM_X86_HARDIRQ_H
+#define _ASM_X86_HARDIRQ_H
+
+#include <linux/threads.h>
+#include <linux/irq.h>
+
+typedef struct {
+        unsigned int __softirq_pending;
+        unsigned int __nmi_count;       /* arch dependent */
+        unsigned int irq0_irqs;
+#ifdef CONFIG_X86_LOCAL_APIC
+        unsigned int apic_timer_irqs;   /* arch dependent */
+        unsigned int irq_spurious_count;
+#endif
+#ifdef CONFIG_SMP
+        unsigned int irq_resched_count;
+        unsigned int irq_call_count;
+        unsigned int irq_tlb_count;
+#endif
+#ifdef CONFIG_X86_MCE
+        unsigned int irq_thermal_count;
+# ifdef CONFIG_X86_64
+        unsigned int irq_threshold_count;
+# endif
 #endif
+} ____cacheline_aligned irq_cpustat_t;
+
+DECLARE_PER_CPU(irq_cpustat_t, irq_stat);
+
+/* We can have at most NR_VECTORS irqs routed to a cpu at a time */
+#define MAX_HARDIRQS_PER_CPU NR_VECTORS
+
+#define __ARCH_IRQ_STAT
+
+#define inc_irq_stat(member)    percpu_add(irq_stat.member, 1)
+
+#define local_softirq_pending() percpu_read(irq_stat.__softirq_pending)
+
+#define __ARCH_SET_SOFTIRQ_PENDING
+
+#define set_softirq_pending(x)  percpu_write(irq_stat.__softirq_pending, (x))
+#define or_softirq_pending(x)   percpu_or(irq_stat.__softirq_pending, (x))
+
+extern void ack_bad_irq(unsigned int irq);
 
 extern u64 arch_irq_stat_cpu(unsigned int cpu);
 #define arch_irq_stat_cpu       arch_irq_stat_cpu
 
 extern u64 arch_irq_stat(void);
 #define arch_irq_stat           arch_irq_stat
+
+#endif /* _ASM_X86_HARDIRQ_H */
diff --git a/arch/x86/include/asm/hardirq_32.h b/arch/x86/include/asm/hardirq_32.h
deleted file mode 100644
index cf7954d1405..00000000000
--- a/arch/x86/include/asm/hardirq_32.h
+++ /dev/null
@@ -1,30 +0,0 @@
-#ifndef _ASM_X86_HARDIRQ_32_H
-#define _ASM_X86_HARDIRQ_32_H
-
-#include <linux/threads.h>
-#include <linux/irq.h>
-
-typedef struct {
-        unsigned int __softirq_pending;
-        unsigned long idle_timestamp;
-        unsigned int __nmi_count;       /* arch dependent */
-        unsigned int apic_timer_irqs;   /* arch dependent */
-        unsigned int irq0_irqs;
-        unsigned int irq_resched_count;
-        unsigned int irq_call_count;
-        unsigned int irq_tlb_count;
-        unsigned int irq_thermal_count;
-        unsigned int irq_spurious_count;
-} ____cacheline_aligned irq_cpustat_t;
-
-DECLARE_PER_CPU(irq_cpustat_t, irq_stat);
-
-#define __ARCH_IRQ_STAT
-#define __IRQ_STAT(cpu, member) (per_cpu(irq_stat, cpu).member)
-
-#define inc_irq_stat(member)    (__get_cpu_var(irq_stat).member++)
-
-void ack_bad_irq(unsigned int irq);
-#include <linux/irq_cpustat.h>
-
-#endif /* _ASM_X86_HARDIRQ_32_H */
diff --git a/arch/x86/include/asm/hardirq_64.h b/arch/x86/include/asm/hardirq_64.h
deleted file mode 100644
index b5a6b5d5670..00000000000
--- a/arch/x86/include/asm/hardirq_64.h
+++ /dev/null
@@ -1,25 +0,0 @@
-#ifndef _ASM_X86_HARDIRQ_64_H
-#define _ASM_X86_HARDIRQ_64_H
-
-#include <linux/threads.h>
-#include <linux/irq.h>
-#include <asm/pda.h>
-#include <asm/apic.h>
-
-/* We can have at most NR_VECTORS irqs routed to a cpu at a time */
-#define MAX_HARDIRQS_PER_CPU NR_VECTORS
-
-#define __ARCH_IRQ_STAT 1
-
-#define inc_irq_stat(member)    add_pda(member, 1)
-
-#define local_softirq_pending() read_pda(__softirq_pending)
-
-#define __ARCH_SET_SOFTIRQ_PENDING 1
-
-#define set_softirq_pending(x) write_pda(__softirq_pending, (x))
-#define or_softirq_pending(x)  or_pda(__softirq_pending, (x))
-
-extern void ack_bad_irq(unsigned int irq);
-
-#endif /* _ASM_X86_HARDIRQ_64_H */
diff --git a/arch/x86/include/asm/hw_irq.h b/arch/x86/include/asm/hw_irq.h
index 8de644b6b95..370e1c83bb4 100644
--- a/arch/x86/include/asm/hw_irq.h
+++ b/arch/x86/include/asm/hw_irq.h
@@ -25,8 +25,6 @@
 #include <asm/irq.h>
 #include <asm/sections.h>
 
-#define platform_legacy_irq(irq)        ((irq) < 16)
-
 /* Interrupt handlers registered during init_IRQ */
 extern void apic_timer_interrupt(void);
 extern void error_interrupt(void);
@@ -58,7 +56,7 @@ extern void make_8259A_irq(unsigned int irq);
 extern void init_8259A(int aeoi);
 
 /* IOAPIC */
-#define IO_APIC_IRQ(x) (((x) >= 16) || ((1<<(x)) & io_apic_irqs))
+#define IO_APIC_IRQ(x) (((x) >= NR_IRQS_LEGACY) || ((1<<(x)) & io_apic_irqs))
 extern unsigned long io_apic_irqs;
 
 extern void init_VISWS_APIC_irqs(void);
@@ -67,15 +65,7 @@ extern void disable_IO_APIC(void);
 extern int IO_APIC_get_PCI_irq_vector(int bus, int slot, int fn);
 extern void setup_ioapic_dest(void);
 
-#ifdef CONFIG_X86_64
 extern void enable_IO_APIC(void);
-#endif
-
-/* IPI functions */
-#ifdef CONFIG_X86_32
-extern void send_IPI_self(int vector);
-#endif
-extern void send_IPI(int dest, int vector);
 
 /* Statistics */
 extern atomic_t irq_err_count;
@@ -84,21 +74,11 @@ extern atomic_t irq_mis_count;
 /* EISA */
 extern void eisa_set_level_irq(unsigned int irq);
 
-/* Voyager functions */
-extern asmlinkage void vic_cpi_interrupt(void);
-extern asmlinkage void vic_sys_interrupt(void);
-extern asmlinkage void vic_cmn_interrupt(void);
-extern asmlinkage void qic_timer_interrupt(void);
-extern asmlinkage void qic_invalidate_interrupt(void);
-extern asmlinkage void qic_reschedule_interrupt(void);
-extern asmlinkage void qic_enable_irq_interrupt(void);
-extern asmlinkage void qic_call_function_interrupt(void);
-
 /* SMP */
 extern void smp_apic_timer_interrupt(struct pt_regs *);
 extern void smp_spurious_interrupt(struct pt_regs *);
 extern void smp_error_interrupt(struct pt_regs *);
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_SMP
 extern void smp_reschedule_interrupt(struct pt_regs *);
 extern void smp_call_function_interrupt(struct pt_regs *);
 extern void smp_call_function_single_interrupt(struct pt_regs *);
diff --git a/arch/x86/include/asm/io.h b/arch/x86/include/asm/io.h
index 1dbbdf4be9b..4f8e820cf38 100644
--- a/arch/x86/include/asm/io.h
+++ b/arch/x86/include/asm/io.h
@@ -5,6 +5,7 @@
 
 #include <linux/compiler.h>
 #include <asm-generic/int-ll64.h>
+#include <asm/page.h>
 
 #define build_mmio_read(name, size, type, reg, barrier) \
 static inline type name(const volatile void __iomem *addr) \
@@ -80,6 +81,95 @@ static inline void writeq(__u64 val, volatile void __iomem *addr)
 #define readq                   readq
 #define writeq                  writeq
 
+/**
+ *      virt_to_phys    -       map virtual addresses to physical
+ *      @address: address to remap
+ *
+ *      The returned physical address is the physical (CPU) mapping for
+ *      the memory address given. It is only valid to use this function on
+ *      addresses directly mapped or allocated via kmalloc.
+ *
+ *      This function does not give bus mappings for DMA transfers. In
+ *      almost all conceivable cases a device driver should not be using
+ *      this function
+ */
+
+static inline phys_addr_t virt_to_phys(volatile void *address)
+{
+        return __pa(address);
+}
+
+/**
+ *      phys_to_virt    -       map physical address to virtual
+ *      @address: address to remap
+ *
+ *      The returned virtual address is a current CPU mapping for
+ *      the memory address given. It is only valid to use this function on
+ *      addresses that have a kernel mapping
+ *
+ *      This function does not handle bus mappings for DMA transfers. In
+ *      almost all conceivable cases a device driver should not be using
+ *      this function
+ */
+
+static inline void *phys_to_virt(phys_addr_t address)
+{
+        return __va(address);
+}
+
+/*
+ * Change "struct page" to physical address.
+ */
+#define page_to_phys(page)    ((dma_addr_t)page_to_pfn(page) << PAGE_SHIFT)
+
+/*
+ * ISA I/O bus memory addresses are 1:1 with the physical address.
+ */
+#define isa_virt_to_bus (unsigned long)virt_to_phys
+#define isa_page_to_bus page_to_phys
+#define isa_bus_to_virt phys_to_virt
+
+/*
+ * However PCI ones are not necessarily 1:1 and therefore these interfaces
+ * are forbidden in portable PCI drivers.
+ *
+ * Allow them on x86 for legacy drivers, though.
+ */
+#define virt_to_bus virt_to_phys
+#define bus_to_virt phys_to_virt
+
+/**
+ * ioremap     -   map bus memory into CPU space
+ * @offset:    bus address of the memory
+ * @size:      size of the resource to map
+ *
+ * ioremap performs a platform specific sequence of operations to
+ * make bus memory CPU accessible via the readb/readw/readl/writeb/
+ * writew/writel functions and the other mmio helpers. The returned
+ * address is not guaranteed to be usable directly as a virtual
+ * address.
+ *
+ * If the area you are trying to map is a PCI BAR you should have a
+ * look at pci_iomap().
+ */
+extern void __iomem *ioremap_nocache(resource_size_t offset, unsigned long size);
+extern void __iomem *ioremap_cache(resource_size_t offset, unsigned long size);
+extern void __iomem *ioremap_prot(resource_size_t offset, unsigned long size,
+                                unsigned long prot_val);
+
+/*
+ * The default ioremap() behavior is non-cached:
+ */
+static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
+{
+        return ioremap_nocache(offset, size);
+}
+
+extern void iounmap(volatile void __iomem *addr);
+
+extern void __iomem *fix_ioremap(unsigned idx, unsigned long phys);
+
+
 #ifdef CONFIG_X86_32
 # include "io_32.h"
 #else
@@ -91,7 +181,7 @@ extern void unxlate_dev_mem_ptr(unsigned long phys, void *addr);
 
 extern int ioremap_change_attr(unsigned long vaddr, unsigned long size,
                                 unsigned long prot_val);
-extern void __iomem *ioremap_wc(unsigned long offset, unsigned long size);
+extern void __iomem *ioremap_wc(resource_size_t offset, unsigned long size);
 
 /*
  * early_ioremap() and early_iounmap() are for temporary early boot-time
@@ -105,5 +195,6 @@ extern void __iomem *early_memremap(unsigned long offset, unsigned long size);
 extern void early_iounmap(void __iomem *addr, unsigned long size);
 extern void __iomem *fix_ioremap(unsigned idx, unsigned long phys);
 
+#define IO_SPACE_LIMIT 0xffff
 
 #endif /* _ASM_X86_IO_H */
diff --git a/arch/x86/include/asm/io_32.h b/arch/x86/include/asm/io_32.h
index d8e242e1b39..a299900f592 100644
--- a/arch/x86/include/asm/io_32.h
+++ b/arch/x86/include/asm/io_32.h
@@ -37,8 +37,6 @@
   *  - Arnaldo Carvalho de Melo <acme@conectiva.com.br>
   */
 
-#define IO_SPACE_LIMIT 0xffff
-
 #define XQUAD_PORTIO_BASE 0xfe400000
 #define XQUAD_PORTIO_QUAD 0x40000  /* 256k per quad. */
 
@@ -53,92 +51,6 @@
  */
 #define xlate_dev_kmem_ptr(p)   p
 
-/**
- *      virt_to_phys    -       map virtual addresses to physical
- *      @address: address to remap
- *
- *      The returned physical address is the physical (CPU) mapping for
- *      the memory address given. It is only valid to use this function on
- *      addresses directly mapped or allocated via kmalloc.
- *
- *      This function does not give bus mappings for DMA transfers. In
- *      almost all conceivable cases a device driver should not be using
- *      this function
- */
-
-static inline unsigned long virt_to_phys(volatile void *address)
-{
-        return __pa(address);
-}
-
-/**
- *      phys_to_virt    -       map physical address to virtual
- *      @address: address to remap
- *
- *      The returned virtual address is a current CPU mapping for
- *      the memory address given. It is only valid to use this function on
- *      addresses that have a kernel mapping
- *
- *      This function does not handle bus mappings for DMA transfers. In
- *      almost all conceivable cases a device driver should not be using
- *      this function
- */
-
-static inline void *phys_to_virt(unsigned long address)
-{
-        return __va(address);
-}
-
-/*
- * Change "struct page" to physical address.
- */
-#define page_to_phys(page)    ((dma_addr_t)page_to_pfn(page) << PAGE_SHIFT)
-
-/**
- * ioremap     -   map bus memory into CPU space
- * @offset:    bus address of the memory
- * @size:      size of the resource to map
- *
- * ioremap performs a platform specific sequence of operations to
- * make bus memory CPU accessible via the readb/readw/readl/writeb/
- * writew/writel functions and the other mmio helpers. The returned
- * address is not guaranteed to be usable directly as a virtual
- * address.
- *
- * If the area you are trying to map is a PCI BAR you should have a
- * look at pci_iomap().
- */
-extern void __iomem *ioremap_nocache(resource_size_t offset, unsigned long size);
-extern void __iomem *ioremap_cache(resource_size_t offset, unsigned long size);
-extern void __iomem *ioremap_prot(resource_size_t offset, unsigned long size,
-                                unsigned long prot_val);
-
-/*
- * The default ioremap() behavior is non-cached:
- */
-static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
-{
-        return ioremap_nocache(offset, size);
-}
-
-extern void iounmap(volatile void __iomem *addr);
-
-/*
- * ISA I/O bus memory addresses are 1:1 with the physical address.
- */
-#define isa_virt_to_bus virt_to_phys
-#define isa_page_to_bus page_to_phys
-#define isa_bus_to_virt phys_to_virt
-
-/*
- * However PCI ones are not necessarily 1:1 and therefore these interfaces
- * are forbidden in portable PCI drivers.
- *
- * Allow them on x86 for legacy drivers, though.
- */
-#define virt_to_bus virt_to_phys
-#define bus_to_virt phys_to_virt
-
 static inline void
 memset_io(volatile void __iomem *addr, unsigned char val, int count)
 {
diff --git a/arch/x86/include/asm/io_64.h b/arch/x86/include/asm/io_64.h
index 563c16270ba..244067893af 100644
--- a/arch/x86/include/asm/io_64.h
+++ b/arch/x86/include/asm/io_64.h
@@ -136,73 +136,12 @@ __OUTS(b)
 __OUTS(w)
 __OUTS(l)
 
-#define IO_SPACE_LIMIT 0xffff
-
 #if defined(__KERNEL__) && defined(__x86_64__)
 
 #include <linux/vmalloc.h>
 
-#ifndef __i386__
-/*
- * Change virtual addresses to physical addresses and vv.
- * These are pretty trivial
- */
-static inline unsigned long virt_to_phys(volatile void *address)
-{
-        return __pa(address);
-}
-
-static inline void *phys_to_virt(unsigned long address)
-{
-        return __va(address);
-}
-#endif
-
-/*
- * Change "struct page" to physical address.
- */
-#define page_to_phys(page)    ((dma_addr_t)page_to_pfn(page) << PAGE_SHIFT)
-
 #include <asm-generic/iomap.h>
 
-/*
- * This one maps high address device memory and turns off caching for that area.
- * it's useful if some control registers are in such an area and write combining
- * or read caching is not desirable:
- */
-extern void __iomem *ioremap_nocache(resource_size_t offset, unsigned long size);
-extern void __iomem *ioremap_cache(resource_size_t offset, unsigned long size);
-extern void __iomem *ioremap_prot(resource_size_t offset, unsigned long size,
-                                unsigned long prot_val);
-
-/*
- * The default ioremap() behavior is non-cached:
- */
-static inline void __iomem *ioremap(resource_size_t offset, unsigned long size)
-{
-        return ioremap_nocache(offset, size);
-}
-
-extern void iounmap(volatile void __iomem *addr);
-
-extern void __iomem *fix_ioremap(unsigned idx, unsigned long phys);
-
-/*
- * ISA I/O bus memory addresses are 1:1 with the physical address.
- */
-#define isa_virt_to_bus virt_to_phys
-#define isa_page_to_bus page_to_phys
-#define isa_bus_to_virt phys_to_virt
-
-/*
- * However PCI ones are not necessarily 1:1 and therefore these interfaces
- * are forbidden in portable PCI drivers.
- *
- * Allow them on x86 for legacy drivers, though.
- */
-#define virt_to_bus virt_to_phys
-#define bus_to_virt phys_to_virt
-
 void __memcpy_fromio(void *, unsigned long, unsigned);
 void __memcpy_toio(unsigned long, const void *, unsigned);
 
diff --git a/arch/x86/include/asm/io_apic.h b/arch/x86/include/asm/io_apic.h
index 7a1f44ac1f1..59cb4a1317b 100644
--- a/arch/x86/include/asm/io_apic.h
+++ b/arch/x86/include/asm/io_apic.h
@@ -114,38 +114,16 @@ struct IR_IO_APIC_route_entry {
 extern int nr_ioapics;
 extern int nr_ioapic_registers[MAX_IO_APICS];
 
-/*
- * MP-BIOS irq configuration table structures:
- */
-
 #define MP_MAX_IOAPIC_PIN 127
 
-struct mp_config_ioapic {
-        unsigned long mp_apicaddr;
-        unsigned int mp_apicid;
-        unsigned char mp_type;
-        unsigned char mp_apicver;
-        unsigned char mp_flags;
-};
-
-struct mp_config_intsrc {
-        unsigned int mp_dstapic;
-        unsigned char mp_type;
-        unsigned char mp_irqtype;
-        unsigned short mp_irqflag;
-        unsigned char mp_srcbus;
-        unsigned char mp_srcbusirq;
-        unsigned char mp_dstirq;
-};
-
 /* I/O APIC entries */
-extern struct mp_config_ioapic mp_ioapics[MAX_IO_APICS];
+extern struct mpc_ioapic mp_ioapics[MAX_IO_APICS];
 
 /* # of MP IRQ source entries */
 extern int mp_irq_entries;
 
 /* MP IRQ source entries */
-extern struct mp_config_intsrc mp_irqs[MAX_IRQ_SOURCES];
+extern struct mpc_intsrc mp_irqs[MAX_IRQ_SOURCES];
 
 /* non-0 if default (table-less) MP configuration */
 extern int mpc_default_type;
@@ -165,15 +143,6 @@ extern int noioapicreroute;
 /* 1 if the timer IRQ uses the '8259A Virtual Wire' mode */
 extern int timer_through_8259;
 
-static inline void disable_ioapic_setup(void)
-{
-#ifdef CONFIG_PCI
-        noioapicquirk = 1;
-        noioapicreroute = -1;
-#endif
-        skip_ioapic_setup = 1;
-}
-
 /*
  * If we use the IO-APIC for IRQ routing, disable automatic
  * assignment of PCI IRQ's.
@@ -200,6 +169,12 @@ extern void reinit_intr_remapped_IO_APIC(int);
 
 extern void probe_nr_irqs_gsi(void);
 
+extern int setup_ioapic_entry(int apic, int irq,
+                              struct IO_APIC_route_entry *entry,
+                              unsigned int destination, int trigger,
+                              int polarity, int vector);
+extern void ioapic_write_entry(int apic, int pin,
+                               struct IO_APIC_route_entry e);
 #else  /* !CONFIG_X86_IO_APIC */
 #define io_apic_assign_pci_irqs 0
 static const int timer_through_8259 = 0;
diff --git a/arch/x86/include/asm/ipi.h b/arch/x86/include/asm/ipi.h
index c745a306f7d..5f2efc5d992 100644
--- a/arch/x86/include/asm/ipi.h
+++ b/arch/x86/include/asm/ipi.h
@@ -1,6 +1,8 @@
 #ifndef _ASM_X86_IPI_H
 #define _ASM_X86_IPI_H
 
+#ifdef CONFIG_X86_LOCAL_APIC
+
 /*
  * Copyright 2004 James Cleverdon, IBM.
  * Subject to the GNU Public License, v.2
@@ -55,8 +57,8 @@ static inline void __xapic_wait_icr_idle(void)
                 cpu_relax();
 }
 
-static inline void __send_IPI_shortcut(unsigned int shortcut, int vector,
-                                       unsigned int dest)
+static inline void
+__default_send_IPI_shortcut(unsigned int shortcut, int vector, unsigned int dest)
 {
         /*
          * Subtle. In the case of the 'never do double writes' workaround
@@ -87,8 +89,8 @@ static inline void __send_IPI_shortcut(unsigned int shortcut, int vector,
  * This is used to send an IPI with no shorthand notation (the destination is
  * specified in bits 56 to 63 of the ICR).
  */
-static inline void __send_IPI_dest_field(unsigned int mask, int vector,
-                                         unsigned int dest)
+static inline void
+ __default_send_IPI_dest_field(unsigned int mask, int vector, unsigned int dest)
 {
         unsigned long cfg;
 
@@ -117,41 +119,46 @@ static inline void __send_IPI_dest_field(unsigned int mask, int vector,
         native_apic_mem_write(APIC_ICR, cfg);
 }
 
-static inline void send_IPI_mask_sequence(const struct cpumask *mask,
-                                          int vector)
-{
-        unsigned long flags;
-        unsigned long query_cpu;
+extern void default_send_IPI_mask_sequence_phys(const struct cpumask *mask,
+                                                 int vector);
+extern void default_send_IPI_mask_allbutself_phys(const struct cpumask *mask,
+                                                         int vector);
+#include <asm/genapic.h>
 
-        /*
-         * Hack. The clustered APIC addressing mode doesn't allow us to send
-         * to an arbitrary mask, so I do a unicast to each CPU instead.
-         * - mbligh
-         */
-        local_irq_save(flags);
-        for_each_cpu(query_cpu, mask) {
-                __send_IPI_dest_field(per_cpu(x86_cpu_to_apicid, query_cpu),
-                                      vector, APIC_DEST_PHYSICAL);
-        }
-        local_irq_restore(flags);
+extern void default_send_IPI_mask_sequence_logical(const struct cpumask *mask,
+                                                         int vector);
+extern void default_send_IPI_mask_allbutself_logical(const struct cpumask *mask,
+                                                         int vector);
+
+/* Avoid include hell */
+#define NMI_VECTOR 0x02
+
+extern int no_broadcast;
+
+static inline void __default_local_send_IPI_allbutself(int vector)
+{
+        if (no_broadcast || vector == NMI_VECTOR)
+                apic->send_IPI_mask_allbutself(cpu_online_mask, vector);
+        else
+                __default_send_IPI_shortcut(APIC_DEST_ALLBUT, vector, apic->dest_logical);
 }
 
-static inline void send_IPI_mask_allbutself(const struct cpumask *mask,
-                                            int vector)
+static inline void __default_local_send_IPI_all(int vector)
 {
-        unsigned long flags;
-        unsigned int query_cpu;
-        unsigned int this_cpu = smp_processor_id();
-
-        /* See Hack comment above */
-
-        local_irq_save(flags);
-        for_each_cpu(query_cpu, mask)
-                if (query_cpu != this_cpu)
-                        __send_IPI_dest_field(
-                                per_cpu(x86_cpu_to_apicid, query_cpu),
-                                vector, APIC_DEST_PHYSICAL);
-        local_irq_restore(flags);
+        if (no_broadcast || vector == NMI_VECTOR)
+                apic->send_IPI_mask(cpu_online_mask, vector);
+        else
+                __default_send_IPI_shortcut(APIC_DEST_ALLINC, vector, apic->dest_logical);
 }
 
+#ifdef CONFIG_X86_32
+extern void default_send_IPI_mask_logical(const struct cpumask *mask,
+                                                 int vector);
+extern void default_send_IPI_allbutself(int vector);
+extern void default_send_IPI_all(int vector);
+extern void default_send_IPI_self(int vector);
+#endif
+
+#endif
+
 #endif /* _ASM_X86_IPI_H */
diff --git a/arch/x86/include/asm/irq.h b/arch/x86/include/asm/irq.h
index 592688ed04d..107eb219669 100644
--- a/arch/x86/include/asm/irq.h
+++ b/arch/x86/include/asm/irq.h
@@ -36,9 +36,11 @@ static inline int irq_canonicalize(int irq)
 extern void fixup_irqs(void);
 #endif
 
-extern unsigned int do_IRQ(struct pt_regs *regs);
 extern void init_IRQ(void);
 extern void native_init_IRQ(void);
+extern bool handle_irq(unsigned irq, struct pt_regs *regs);
+
+extern unsigned int do_IRQ(struct pt_regs *regs);
 
 /* Interrupt vector management */
 extern DECLARE_BITMAP(used_vectors, NR_VECTORS);
diff --git a/arch/x86/include/asm/irq_regs.h b/arch/x86/include/asm/irq_regs.h
index 89c898ab298..77843225b7e 100644
--- a/arch/x86/include/asm/irq_regs.h
+++ b/arch/x86/include/asm/irq_regs.h
@@ -1,5 +1,31 @@
-#ifdef CONFIG_X86_32
-# include "irq_regs_32.h"
-#else
-# include "irq_regs_64.h"
-#endif
+/*
+ * Per-cpu current frame pointer - the location of the last exception frame on
+ * the stack, stored in the per-cpu area.
+ *
+ * Jeremy Fitzhardinge <jeremy@goop.org>
+ */
+#ifndef _ASM_X86_IRQ_REGS_H
+#define _ASM_X86_IRQ_REGS_H
+
+#include <asm/percpu.h>
+
+#define ARCH_HAS_OWN_IRQ_REGS
+
+DECLARE_PER_CPU(struct pt_regs *, irq_regs);
+
+static inline struct pt_regs *get_irq_regs(void)
+{
+        return percpu_read(irq_regs);
+}
+
+static inline struct pt_regs *set_irq_regs(struct pt_regs *new_regs)
+{
+        struct pt_regs *old_regs;
+
+        old_regs = get_irq_regs();
+        percpu_write(irq_regs, new_regs);
+
+        return old_regs;
+}
+
+#endif /* _ASM_X86_IRQ_REGS_32_H */
diff --git a/arch/x86/include/asm/irq_regs_32.h b/arch/x86/include/asm/irq_regs_32.h
deleted file mode 100644
index 86afd747345..00000000000
--- a/arch/x86/include/asm/irq_regs_32.h
+++ /dev/null
@@ -1,31 +0,0 @@
-/*
- * Per-cpu current frame pointer - the location of the last exception frame on
- * the stack, stored in the per-cpu area.
- *
- * Jeremy Fitzhardinge <jeremy@goop.org>
- */
-#ifndef _ASM_X86_IRQ_REGS_32_H
-#define _ASM_X86_IRQ_REGS_32_H
-
-#include <asm/percpu.h>
-
-#define ARCH_HAS_OWN_IRQ_REGS
-
-DECLARE_PER_CPU(struct pt_regs *, irq_regs);
-
-static inline struct pt_regs *get_irq_regs(void)
-{
-        return x86_read_percpu(irq_regs);
-}
-
-static inline struct pt_regs *set_irq_regs(struct pt_regs *new_regs)
-{
-        struct pt_regs *old_regs;
-
-        old_regs = get_irq_regs();
-        x86_write_percpu(irq_regs, new_regs);
-
-        return old_regs;
-}
-
-#endif /* _ASM_X86_IRQ_REGS_32_H */
diff --git a/arch/x86/include/asm/irq_regs_64.h b/arch/x86/include/asm/irq_regs_64.h
deleted file mode 100644
index 3dd9c0b7027..00000000000
--- a/arch/x86/include/asm/irq_regs_64.h
+++ /dev/null
@@ -1 +0,0 @@
-#include <asm-generic/irq_regs.h>
diff --git a/arch/x86/include/asm/irq_vectors.h b/arch/x86/include/asm/irq_vectors.h
index f7ff65032b9..b07278c55e9 100644
--- a/arch/x86/include/asm/irq_vectors.h
+++ b/arch/x86/include/asm/irq_vectors.h
@@ -1,47 +1,69 @@
 #ifndef _ASM_X86_IRQ_VECTORS_H
 #define _ASM_X86_IRQ_VECTORS_H
 
-#include <linux/threads.h>
+/*
+ * Linux IRQ vector layout.
+ *
+ * There are 256 IDT entries (per CPU - each entry is 8 bytes) which can
+ * be defined by Linux. They are used as a jump table by the CPU when a
+ * given vector is triggered - by a CPU-external, CPU-internal or
+ * software-triggered event.
+ *
+ * Linux sets the kernel code address each entry jumps to early during
+ * bootup, and never changes them. This is the general layout of the
+ * IDT entries:
+ *
+ *  Vectors   0 ...  31 : system traps and exceptions - hardcoded events
+ *  Vectors  32 ... 127 : device interrupts
+ *  Vector  128         : legacy int80 syscall interface
+ *  Vectors 129 ... 237 : device interrupts
+ *  Vectors 238 ... 255 : special interrupts
+ *
+ * 64-bit x86 has per CPU IDT tables, 32-bit has one shared IDT table.
+ *
+ * This file enumerates the exact layout of them:
+ */
 
-#define NMI_VECTOR              0x02
+#define NMI_VECTOR                      0x02
 
 /*
  * IDT vectors usable for external interrupt sources start
  * at 0x20:
  */
-#define FIRST_EXTERNAL_VECTOR   0x20
+#define FIRST_EXTERNAL_VECTOR           0x20
 
 #ifdef CONFIG_X86_32
-# define SYSCALL_VECTOR         0x80
+# define SYSCALL_VECTOR                 0x80
 #else
-# define IA32_SYSCALL_VECTOR    0x80
+# define IA32_SYSCALL_VECTOR            0x80
 #endif
 
 /*
  * Reserve the lowest usable priority level 0x20 - 0x2f for triggering
  * cleanup after irq migration.
  */
-#define IRQ_MOVE_CLEANUP_VECTOR FIRST_EXTERNAL_VECTOR
+#define IRQ_MOVE_CLEANUP_VECTOR         FIRST_EXTERNAL_VECTOR
 
 /*
  * Vectors 0x30-0x3f are used for ISA interrupts.
  */
-#define IRQ0_VECTOR             (FIRST_EXTERNAL_VECTOR + 0x10)
-#define IRQ1_VECTOR             (IRQ0_VECTOR + 1)
-#define IRQ2_VECTOR             (IRQ0_VECTOR + 2)
-#define IRQ3_VECTOR             (IRQ0_VECTOR + 3)
-#define IRQ4_VECTOR             (IRQ0_VECTOR + 4)
-#define IRQ5_VECTOR             (IRQ0_VECTOR + 5)
-#define IRQ6_VECTOR             (IRQ0_VECTOR + 6)
-#define IRQ7_VECTOR             (IRQ0_VECTOR + 7)
-#define IRQ8_VECTOR             (IRQ0_VECTOR + 8)
-#define IRQ9_VECTOR             (IRQ0_VECTOR + 9)
-#define IRQ10_VECTOR            (IRQ0_VECTOR + 10)
-#define IRQ11_VECTOR            (IRQ0_VECTOR + 11)
-#define IRQ12_VECTOR            (IRQ0_VECTOR + 12)
-#define IRQ13_VECTOR            (IRQ0_VECTOR + 13)
-#define IRQ14_VECTOR            (IRQ0_VECTOR + 14)
-#define IRQ15_VECTOR            (IRQ0_VECTOR + 15)
+#define IRQ0_VECTOR                     (FIRST_EXTERNAL_VECTOR + 0x10)
+
+#define IRQ1_VECTOR                     (IRQ0_VECTOR +  1)
+#define IRQ2_VECTOR                     (IRQ0_VECTOR +  2)
+#define IRQ3_VECTOR                     (IRQ0_VECTOR +  3)
+#define IRQ4_VECTOR                     (IRQ0_VECTOR +  4)
+#define IRQ5_VECTOR                     (IRQ0_VECTOR +  5)
+#define IRQ6_VECTOR                     (IRQ0_VECTOR +  6)
+#define IRQ7_VECTOR                     (IRQ0_VECTOR +  7)
+#define IRQ8_VECTOR                     (IRQ0_VECTOR +  8)
+#define IRQ9_VECTOR                     (IRQ0_VECTOR +  9)
+#define IRQ10_VECTOR                    (IRQ0_VECTOR + 10)
+#define IRQ11_VECTOR                    (IRQ0_VECTOR + 11)
+#define IRQ12_VECTOR                    (IRQ0_VECTOR + 12)
+#define IRQ13_VECTOR                    (IRQ0_VECTOR + 13)
+#define IRQ14_VECTOR                    (IRQ0_VECTOR + 14)
+#define IRQ15_VECTOR                    (IRQ0_VECTOR + 15)
 
 /*
  * Special IRQ vectors used by the SMP architecture, 0xf0-0xff
@@ -49,119 +71,98 @@
  *  some of the following vectors are 'rare', they are merged
  *  into a single vector (CALL_FUNCTION_VECTOR) to save vector space.
  *  TLB, reschedule and local APIC vectors are performance-critical.
- *
- *  Vectors 0xf0-0xfa are free (reserved for future Linux use).
  */
-#ifdef CONFIG_X86_32
-
-# define SPURIOUS_APIC_VECTOR           0xff
-# define ERROR_APIC_VECTOR              0xfe
-# define INVALIDATE_TLB_VECTOR          0xfd
-# define RESCHEDULE_VECTOR              0xfc
-# define CALL_FUNCTION_VECTOR           0xfb
-# define CALL_FUNCTION_SINGLE_VECTOR    0xfa
-# define THERMAL_APIC_VECTOR            0xf0
-
-#else
 
 #define SPURIOUS_APIC_VECTOR            0xff
+/*
+ * Sanity check
+ */
+#if ((SPURIOUS_APIC_VECTOR & 0x0F) != 0x0F)
+# error SPURIOUS_APIC_VECTOR definition error
+#endif
+
 #define ERROR_APIC_VECTOR               0xfe
 #define RESCHEDULE_VECTOR               0xfd
 #define CALL_FUNCTION_VECTOR            0xfc
 #define CALL_FUNCTION_SINGLE_VECTOR     0xfb
 #define THERMAL_APIC_VECTOR             0xfa
-#define THRESHOLD_APIC_VECTOR           0xf9
-#define UV_BAU_MESSAGE                  0xf8
-#define INVALIDATE_TLB_VECTOR_END       0xf7
-#define INVALIDATE_TLB_VECTOR_START     0xf0    /* f0-f7 used for TLB flush */
-
-#define NUM_INVALIDATE_TLB_VECTORS      8
 
+#ifdef CONFIG_X86_32
+/* 0xf8 - 0xf9 : free */
+#else
+# define THRESHOLD_APIC_VECTOR          0xf9
+# define UV_BAU_MESSAGE                 0xf8
 #endif
 
+/* f0-f7 used for spreading out TLB flushes: */
+#define INVALIDATE_TLB_VECTOR_END       0xf7
+#define INVALIDATE_TLB_VECTOR_START     0xf0
+#define NUM_INVALIDATE_TLB_VECTORS         8
+
 /*
  * Local APIC timer IRQ vector is on a different priority level,
  * to work around the 'lost local interrupt if more than 2 IRQ
  * sources per level' errata.
  */
-#define LOCAL_TIMER_VECTOR      0xef
+#define LOCAL_TIMER_VECTOR              0xef
+
+/*
+ * Performance monitoring interrupt vector:
+ */
+#define LOCAL_PERF_VECTOR               0xee
 
 /*
  * First APIC vector available to drivers: (vectors 0x30-0xee) we
  * start at 0x31(0x41) to spread out vectors evenly between priority
  * levels. (0x80 is the syscall vector)
  */
-#define FIRST_DEVICE_VECTOR     (IRQ15_VECTOR + 2)
-
-#define NR_VECTORS              256
+#define FIRST_DEVICE_VECTOR             (IRQ15_VECTOR + 2)
 
-#define FPU_IRQ                 13
+#define NR_VECTORS                       256
 
-#define FIRST_VM86_IRQ          3
-#define LAST_VM86_IRQ           15
-#define invalid_vm86_irq(irq)   ((irq) < 3 || (irq) > 15)
+#define FPU_IRQ                           13
 
-#define NR_IRQS_LEGACY          16
+#define FIRST_VM86_IRQ                     3
+#define LAST_VM86_IRQ                     15
 
-#if defined(CONFIG_X86_IO_APIC) && !defined(CONFIG_X86_VOYAGER)
-
-#ifndef CONFIG_SPARSE_IRQ
-# if NR_CPUS < MAX_IO_APICS
-#  define NR_IRQS (NR_VECTORS + (32 * NR_CPUS))
-# else
-#  define NR_IRQS (NR_VECTORS + (32 * MAX_IO_APICS))
-# endif
-#else
-# if (8 * NR_CPUS) > (32 * MAX_IO_APICS)
-#  define NR_IRQS (NR_VECTORS + (8 * NR_CPUS))
-# else
-#  define NR_IRQS (NR_VECTORS + (32 * MAX_IO_APICS))
-# endif
+#ifndef __ASSEMBLY__
+static inline int invalid_vm86_irq(int irq)
+{
+        return irq < 3 || irq > 15;
+}
 #endif
 
-#elif defined(CONFIG_X86_VOYAGER)
-
-# define NR_IRQS                224
+/*
+ * Size the maximum number of interrupts.
+ *
+ * If the irq_desc[] array has a sparse layout, we can size things
+ * generously - it scales up linearly with the maximum number of CPUs,
+ * and the maximum number of IO-APICs, whichever is higher.
+ *
+ * In other cases we size more conservatively, to not create too large
+ * static arrays.
+ */
 
-#else /* IO_APIC || VOYAGER */
+#define NR_IRQS_LEGACY                    16
 
-# define NR_IRQS                16
+#define CPU_VECTOR_LIMIT                (  8 * NR_CPUS      )
+#define IO_APIC_VECTOR_LIMIT            ( 32 * MAX_IO_APICS )
 
+#ifdef CONFIG_X86_IO_APIC
+# ifdef CONFIG_SPARSE_IRQ
+#  define NR_IRQS                                       \
+        (CPU_VECTOR_LIMIT > IO_APIC_VECTOR_LIMIT ?      \
+                (NR_VECTORS + CPU_VECTOR_LIMIT)  :      \
+                (NR_VECTORS + IO_APIC_VECTOR_LIMIT))
+# else
+#  if NR_CPUS < MAX_IO_APICS
+#   define NR_IRQS                      (NR_VECTORS + 4*CPU_VECTOR_LIMIT)
+#  else
+#   define NR_IRQS                      (NR_VECTORS + IO_APIC_VECTOR_LIMIT)
+#  endif
+# endif
+#else /* !CONFIG_X86_IO_APIC: */
+# define NR_IRQS                        NR_IRQS_LEGACY
 #endif
 
-/* Voyager specific defines */
-/* These define the CPIs we use in linux */
-#define VIC_CPI_LEVEL0                  0
-#define VIC_CPI_LEVEL1                  1
-/* now the fake CPIs */
-#define VIC_TIMER_CPI                   2
-#define VIC_INVALIDATE_CPI              3
-#define VIC_RESCHEDULE_CPI              4
-#define VIC_ENABLE_IRQ_CPI              5
-#define VIC_CALL_FUNCTION_CPI           6
-#define VIC_CALL_FUNCTION_SINGLE_CPI    7
-
-/* Now the QIC CPIs:  Since we don't need the two initial levels,
- * these are 2 less than the VIC CPIs */
-#define QIC_CPI_OFFSET                  1
-#define QIC_TIMER_CPI                   (VIC_TIMER_CPI - QIC_CPI_OFFSET)
-#define QIC_INVALIDATE_CPI              (VIC_INVALIDATE_CPI - QIC_CPI_OFFSET)
-#define QIC_RESCHEDULE_CPI              (VIC_RESCHEDULE_CPI - QIC_CPI_OFFSET)
-#define QIC_ENABLE_IRQ_CPI              (VIC_ENABLE_IRQ_CPI - QIC_CPI_OFFSET)
-#define QIC_CALL_FUNCTION_CPI           (VIC_CALL_FUNCTION_CPI - QIC_CPI_OFFSET)
-#define QIC_CALL_FUNCTION_SINGLE_CPI    (VIC_CALL_FUNCTION_SINGLE_CPI - QIC_CPI_OFFSET)
-
-#define VIC_START_FAKE_CPI              VIC_TIMER_CPI
-#define VIC_END_FAKE_CPI                VIC_CALL_FUNCTION_SINGLE_CPI
-
-/* this is the SYS_INT CPI. */
-#define VIC_SYS_INT                     8
-#define VIC_CMN_INT                     15
-
-/* This is the boot CPI for alternate processors.  It gets overwritten
- * by the above once the system has activated all available processors */
-#define VIC_CPU_BOOT_CPI                VIC_CPI_LEVEL0
-#define VIC_CPU_BOOT_ERRATA_CPI         (VIC_CPI_LEVEL0 + 8)
-
-
 #endif /* _ASM_X86_IRQ_VECTORS_H */
diff --git a/arch/x86/include/asm/kexec.h b/arch/x86/include/asm/kexec.h
index c61d8b2ab8b..0ceb6d19ed3 100644
--- a/arch/x86/include/asm/kexec.h
+++ b/arch/x86/include/asm/kexec.h
@@ -9,23 +9,8 @@
 # define PAGES_NR               4
 #else
 # define PA_CONTROL_PAGE        0
-# define VA_CONTROL_PAGE        1
-# define PA_PGD                 2
-# define VA_PGD                 3
-# define PA_PUD_0               4
-# define VA_PUD_0               5
-# define PA_PMD_0               6
-# define VA_PMD_0               7
-# define PA_PTE_0               8
-# define VA_PTE_0               9
-# define PA_PUD_1               10
-# define VA_PUD_1               11
-# define PA_PMD_1               12
-# define VA_PMD_1               13
-# define PA_PTE_1               14
-# define VA_PTE_1               15
-# define PA_TABLE_PAGE          16
-# define PAGES_NR               17
+# define PA_TABLE_PAGE          1
+# define PAGES_NR               2
 #endif
 
 #ifdef CONFIG_X86_32
@@ -157,9 +142,9 @@ relocate_kernel(unsigned long indirection_page,
                 unsigned long start_address) ATTRIB_NORET;
 #endif
 
-#ifdef CONFIG_X86_32
 #define ARCH_HAS_KIMAGE_ARCH
 
+#ifdef CONFIG_X86_32
 struct kimage_arch {
         pgd_t *pgd;
 #ifdef CONFIG_X86_PAE
@@ -169,6 +154,12 @@ struct kimage_arch {
         pte_t *pte0;
         pte_t *pte1;
 };
+#else
+struct kimage_arch {
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte;
+};
 #endif
 
 #endif /* __ASSEMBLY__ */
diff --git a/arch/x86/include/asm/mach-default/mach_apic.h b/arch/x86/include/asm/mach-default/mach_apic.h
deleted file mode 100644
index cc09cbbee27..00000000000
--- a/arch/x86/include/asm/mach-default/mach_apic.h
+++ /dev/null
@@ -1,168 +0,0 @@
-#ifndef _ASM_X86_MACH_DEFAULT_MACH_APIC_H
-#define _ASM_X86_MACH_DEFAULT_MACH_APIC_H
-
-#ifdef CONFIG_X86_LOCAL_APIC
-
-#include <mach_apicdef.h>
-#include <asm/smp.h>
-
-#define APIC_DFR_VALUE  (APIC_DFR_FLAT)
-
-static inline const struct cpumask *target_cpus(void)
-{ 
-#ifdef CONFIG_SMP
-        return cpu_online_mask;
-#else
-        return cpumask_of(0);
-#endif
-} 
-
-#define NO_BALANCE_IRQ (0)
-#define esr_disable (0)
-
-#ifdef CONFIG_X86_64
-#include <asm/genapic.h>
-#define INT_DELIVERY_MODE (genapic->int_delivery_mode)
-#define INT_DEST_MODE (genapic->int_dest_mode)
-#define TARGET_CPUS       (genapic->target_cpus())
-#define apic_id_registered (genapic->apic_id_registered)
-#define init_apic_ldr (genapic->init_apic_ldr)
-#define cpu_mask_to_apicid (genapic->cpu_mask_to_apicid)
-#define cpu_mask_to_apicid_and (genapic->cpu_mask_to_apicid_and)
-#define phys_pkg_id     (genapic->phys_pkg_id)
-#define vector_allocation_domain    (genapic->vector_allocation_domain)
-#define read_apic_id()  (GET_APIC_ID(apic_read(APIC_ID)))
-#define send_IPI_self (genapic->send_IPI_self)
-#define wakeup_secondary_cpu (genapic->wakeup_cpu)
-extern void setup_apic_routing(void);
-#else
-#define INT_DELIVERY_MODE dest_LowestPrio
-#define INT_DEST_MODE 1     /* logical delivery broadcast to all procs */
-#define TARGET_CPUS (target_cpus())
-#define wakeup_secondary_cpu wakeup_secondary_cpu_via_init
-/*
- * Set up the logical destination ID.
- *
- * Intel recommends to set DFR, LDR and TPR before enabling
- * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
- * document number 292116).  So here it goes...
- */
-static inline void init_apic_ldr(void)
-{
-        unsigned long val;
-
-        apic_write(APIC_DFR, APIC_DFR_VALUE);
-        val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
-        val |= SET_APIC_LOGICAL_ID(1UL << smp_processor_id());
-        apic_write(APIC_LDR, val);
-}
-
-static inline int apic_id_registered(void)
-{
-        return physid_isset(read_apic_id(), phys_cpu_present_map);
-}
-
-static inline unsigned int cpu_mask_to_apicid(const struct cpumask *cpumask)
-{
-        return cpumask_bits(cpumask)[0];
-}
-
-static inline unsigned int cpu_mask_to_apicid_and(const struct cpumask *cpumask,
-                                                  const struct cpumask *andmask)
-{
-        unsigned long mask1 = cpumask_bits(cpumask)[0];
-        unsigned long mask2 = cpumask_bits(andmask)[0];
-        unsigned long mask3 = cpumask_bits(cpu_online_mask)[0];
-
-        return (unsigned int)(mask1 & mask2 & mask3);
-}
-
-static inline u32 phys_pkg_id(u32 cpuid_apic, int index_msb)
-{
-        return cpuid_apic >> index_msb;
-}
-
-static inline void setup_apic_routing(void)
-{
-#ifdef CONFIG_X86_IO_APIC
-        printk("Enabling APIC mode:  %s.  Using %d I/O APICs\n",
-                                        "Flat", nr_ioapics);
-#endif
-}
-
-static inline int apicid_to_node(int logical_apicid)
-{
-#ifdef CONFIG_SMP
-        return apicid_2_node[hard_smp_processor_id()];
-#else
-        return 0;
-#endif
-}
-
-static inline void vector_allocation_domain(int cpu, struct cpumask *retmask)
-{
-        /* Careful. Some cpus do not strictly honor the set of cpus
-         * specified in the interrupt destination when using lowest
-         * priority interrupt delivery mode.
-         *
-         * In particular there was a hyperthreading cpu observed to
-         * deliver interrupts to the wrong hyperthread when only one
-         * hyperthread was specified in the interrupt desitination.
-         */
-        *retmask = (cpumask_t) { { [0] = APIC_ALL_CPUS } };
-}
-#endif
-
-static inline unsigned long check_apicid_used(physid_mask_t bitmap, int apicid)
-{
-        return physid_isset(apicid, bitmap);
-}
-
-static inline unsigned long check_apicid_present(int bit)
-{
-        return physid_isset(bit, phys_cpu_present_map);
-}
-
-static inline physid_mask_t ioapic_phys_id_map(physid_mask_t phys_map)
-{
-        return phys_map;
-}
-
-static inline int multi_timer_check(int apic, int irq)
-{
-        return 0;
-}
-
-/* Mapping from cpu number to logical apicid */
-static inline int cpu_to_logical_apicid(int cpu)
-{
-        return 1 << cpu;
-}
-
-static inline int cpu_present_to_apicid(int mps_cpu)
-{
-        if (mps_cpu < nr_cpu_ids && cpu_present(mps_cpu))
-                return (int)per_cpu(x86_bios_cpu_apicid, mps_cpu);
-        else
-                return BAD_APICID;
-}
-
-static inline physid_mask_t apicid_to_cpu_present(int phys_apicid)
-{
-        return physid_mask_of_physid(phys_apicid);
-}
-
-static inline void setup_portio_remap(void)
-{
-}
-
-static inline int check_phys_apicid_present(int boot_cpu_physical_apicid)
-{
-        return physid_isset(boot_cpu_physical_apicid, phys_cpu_present_map);
-}
-
-static inline void enable_apic_mode(void)
-{
-}
-#endif /* CONFIG_X86_LOCAL_APIC */
-#endif /* _ASM_X86_MACH_DEFAULT_MACH_APIC_H */
diff --git a/arch/x86/include/asm/mach-default/mach_apicdef.h b/arch/x86/include/asm/mach-default/mach_apicdef.h
deleted file mode 100644
index 53179936d6c..00000000000
--- a/arch/x86/include/asm/mach-default/mach_apicdef.h
+++ /dev/null
@@ -1,24 +0,0 @@
-#ifndef _ASM_X86_MACH_DEFAULT_MACH_APICDEF_H
-#define _ASM_X86_MACH_DEFAULT_MACH_APICDEF_H
-
-#include <asm/apic.h>
-
-#ifdef CONFIG_X86_64
-#define APIC_ID_MASK            (genapic->apic_id_mask)
-#define GET_APIC_ID(x)          (genapic->get_apic_id(x))
-#define SET_APIC_ID(x)          (genapic->set_apic_id(x))
-#else
-#define         APIC_ID_MASK            (0xF<<24)
-static inline unsigned get_apic_id(unsigned long x) 
-{
-        unsigned int ver = GET_APIC_VERSION(apic_read(APIC_LVR));
-        if (APIC_XAPIC(ver))
-                return (((x)>>24)&0xFF);
-        else
-                return (((x)>>24)&0xF);
-} 
-
-#define         GET_APIC_ID(x)  get_apic_id(x)
-#endif
-
-#endif /* _ASM_X86_MACH_DEFAULT_MACH_APICDEF_H */
diff --git a/arch/x86/include/asm/mach-default/mach_ipi.h b/arch/x86/include/asm/mach-default/mach_ipi.h
deleted file mode 100644
index 191312d155d..00000000000
--- a/arch/x86/include/asm/mach-default/mach_ipi.h
+++ /dev/null
@@ -1,64 +0,0 @@
-#ifndef _ASM_X86_MACH_DEFAULT_MACH_IPI_H
-#define _ASM_X86_MACH_DEFAULT_MACH_IPI_H
-
-/* Avoid include hell */
-#define NMI_VECTOR 0x02
-
-void send_IPI_mask_bitmask(const struct cpumask *mask, int vector);
-void send_IPI_mask_allbutself(const struct cpumask *mask, int vector);
-void __send_IPI_shortcut(unsigned int shortcut, int vector);
-
-extern int no_broadcast;
-
-#ifdef CONFIG_X86_64
-#include <asm/genapic.h>
-#define send_IPI_mask (genapic->send_IPI_mask)
-#define send_IPI_mask_allbutself (genapic->send_IPI_mask_allbutself)
-#else
-static inline void send_IPI_mask(const struct cpumask *mask, int vector)
-{
-        send_IPI_mask_bitmask(mask, vector);
-}
-void send_IPI_mask_allbutself(const struct cpumask *mask, int vector);
-#endif
-
-static inline void __local_send_IPI_allbutself(int vector)
-{
-        if (no_broadcast || vector == NMI_VECTOR)
-                send_IPI_mask_allbutself(cpu_online_mask, vector);
-        else
-                __send_IPI_shortcut(APIC_DEST_ALLBUT, vector);
-}
-
-static inline void __local_send_IPI_all(int vector)
-{
-        if (no_broadcast || vector == NMI_VECTOR)
-                send_IPI_mask(cpu_online_mask, vector);
-        else
-                __send_IPI_shortcut(APIC_DEST_ALLINC, vector);
-}
-
-#ifdef CONFIG_X86_64
-#define send_IPI_allbutself (genapic->send_IPI_allbutself)
-#define send_IPI_all (genapic->send_IPI_all)
-#else
-static inline void send_IPI_allbutself(int vector)
-{
-        /*
-         * if there are no other CPUs in the system then we get an APIC send 
-         * error if we try to broadcast, thus avoid sending IPIs in this case.
-         */
-        if (!(num_online_cpus() > 1))
-                return;
-
-        __local_send_IPI_allbutself(vector);
-        return;
-}
-
-static inline void send_IPI_all(int vector)
-{
-        __local_send_IPI_all(vector);
-}
-#endif
-
-#endif /* _ASM_X86_MACH_DEFAULT_MACH_IPI_H */
diff --git a/arch/x86/include/asm/mach-default/mach_mpparse.h b/arch/x86/include/asm/mach-default/mach_mpparse.h
deleted file mode 100644
index c70a263d68c..00000000000
--- a/arch/x86/include/asm/mach-default/mach_mpparse.h
+++ /dev/null
@@ -1,17 +0,0 @@
-#ifndef _ASM_X86_MACH_DEFAULT_MACH_MPPARSE_H
-#define _ASM_X86_MACH_DEFAULT_MACH_MPPARSE_H
-
-static inline int
-mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
-{
-        return 0;
-}
-
-/* Hook from generic ACPI tables.c */
-static inline int acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-        return 0;
-}
-
-
-#endif /* _ASM_X86_MACH_DEFAULT_MACH_MPPARSE_H */
diff --git a/arch/x86/include/asm/mach-default/mach_mpspec.h b/arch/x86/include/asm/mach-default/mach_mpspec.h
deleted file mode 100644
index e85ede686be..00000000000
--- a/arch/x86/include/asm/mach-default/mach_mpspec.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef _ASM_X86_MACH_DEFAULT_MACH_MPSPEC_H
-#define _ASM_X86_MACH_DEFAULT_MACH_MPSPEC_H
-
-#define MAX_IRQ_SOURCES 256
-
-#if CONFIG_BASE_SMALL == 0
-#define MAX_MP_BUSSES 256
-#else
-#define MAX_MP_BUSSES 32
-#endif
-
-#endif /* _ASM_X86_MACH_DEFAULT_MACH_MPSPEC_H */
diff --git a/arch/x86/include/asm/mach-default/mach_wakecpu.h b/arch/x86/include/asm/mach-default/mach_wakecpu.h
deleted file mode 100644
index 89897a6a65b..00000000000
--- a/arch/x86/include/asm/mach-default/mach_wakecpu.h
+++ /dev/null
@@ -1,41 +0,0 @@
-#ifndef _ASM_X86_MACH_DEFAULT_MACH_WAKECPU_H
-#define _ASM_X86_MACH_DEFAULT_MACH_WAKECPU_H
-
-#define TRAMPOLINE_PHYS_LOW (0x467)
-#define TRAMPOLINE_PHYS_HIGH (0x469)
-
-static inline void wait_for_init_deassert(atomic_t *deassert)
-{
-        while (!atomic_read(deassert))
-                cpu_relax();
-        return;
-}
-
-/* Nothing to do for most platforms, since cleared by the INIT cycle */
-static inline void smp_callin_clear_local_apic(void)
-{
-}
-
-static inline void store_NMI_vector(unsigned short *high, unsigned short *low)
-{
-}
-
-static inline void restore_NMI_vector(unsigned short *high, unsigned short *low)
-{
-}
-
-#ifdef CONFIG_SMP
-extern void __inquire_remote_apic(int apicid);
-#else /* CONFIG_SMP */
-static inline void __inquire_remote_apic(int apicid)
-{
-}
-#endif /* CONFIG_SMP */
-
-static inline void inquire_remote_apic(int apicid)
-{
-        if (apic_verbosity >= APIC_DEBUG)
-                __inquire_remote_apic(apicid);
-}
-
-#endif /* _ASM_X86_MACH_DEFAULT_MACH_WAKECPU_H */
diff --git a/arch/x86/include/asm/mach-generic/gpio.h b/arch/x86/include/asm/mach-generic/gpio.h
deleted file mode 100644
index 995c45efdb3..00000000000
--- a/arch/x86/include/asm/mach-generic/gpio.h
+++ /dev/null
@@ -1,15 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_GPIO_H
-#define _ASM_X86_MACH_GENERIC_GPIO_H
-
-int gpio_request(unsigned gpio, const char *label);
-void gpio_free(unsigned gpio);
-int gpio_direction_input(unsigned gpio);
-int gpio_direction_output(unsigned gpio, int value);
-int gpio_get_value(unsigned gpio);
-void gpio_set_value(unsigned gpio, int value);
-int gpio_to_irq(unsigned gpio);
-int irq_to_gpio(unsigned irq);
-
-#include <asm-generic/gpio.h>           /* cansleep wrappers */
-
-#endif /* _ASM_X86_MACH_GENERIC_GPIO_H */
diff --git a/arch/x86/include/asm/mach-generic/mach_apic.h b/arch/x86/include/asm/mach-generic/mach_apic.h
deleted file mode 100644
index 48553e958ad..00000000000
--- a/arch/x86/include/asm/mach-generic/mach_apic.h
+++ /dev/null
@@ -1,35 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_MACH_APIC_H
-#define _ASM_X86_MACH_GENERIC_MACH_APIC_H
-
-#include <asm/genapic.h>
-
-#define esr_disable (genapic->ESR_DISABLE)
-#define NO_BALANCE_IRQ (genapic->no_balance_irq)
-#define INT_DELIVERY_MODE (genapic->int_delivery_mode)
-#define INT_DEST_MODE (genapic->int_dest_mode)
-#undef APIC_DEST_LOGICAL
-#define APIC_DEST_LOGICAL (genapic->apic_destination_logical)
-#define TARGET_CPUS       (genapic->target_cpus())
-#define apic_id_registered (genapic->apic_id_registered)
-#define init_apic_ldr (genapic->init_apic_ldr)
-#define ioapic_phys_id_map (genapic->ioapic_phys_id_map)
-#define setup_apic_routing (genapic->setup_apic_routing)
-#define multi_timer_check (genapic->multi_timer_check)
-#define apicid_to_node (genapic->apicid_to_node)
-#define cpu_to_logical_apicid (genapic->cpu_to_logical_apicid) 
-#define cpu_present_to_apicid (genapic->cpu_present_to_apicid)
-#define apicid_to_cpu_present (genapic->apicid_to_cpu_present)
-#define setup_portio_remap (genapic->setup_portio_remap)
-#define check_apicid_present (genapic->check_apicid_present)
-#define check_phys_apicid_present (genapic->check_phys_apicid_present)
-#define check_apicid_used (genapic->check_apicid_used)
-#define cpu_mask_to_apicid (genapic->cpu_mask_to_apicid)
-#define cpu_mask_to_apicid_and (genapic->cpu_mask_to_apicid_and)
-#define vector_allocation_domain (genapic->vector_allocation_domain)
-#define enable_apic_mode (genapic->enable_apic_mode)
-#define phys_pkg_id (genapic->phys_pkg_id)
-#define wakeup_secondary_cpu (genapic->wakeup_cpu)
-
-extern void generic_bigsmp_probe(void);
-
-#endif /* _ASM_X86_MACH_GENERIC_MACH_APIC_H */
diff --git a/arch/x86/include/asm/mach-generic/mach_apicdef.h b/arch/x86/include/asm/mach-generic/mach_apicdef.h
deleted file mode 100644
index 68041f3802f..00000000000
--- a/arch/x86/include/asm/mach-generic/mach_apicdef.h
+++ /dev/null
@@ -1,11 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_MACH_APICDEF_H
-#define _ASM_X86_MACH_GENERIC_MACH_APICDEF_H
-
-#ifndef APIC_DEFINITION
-#include <asm/genapic.h>
-
-#define GET_APIC_ID (genapic->get_apic_id)
-#define APIC_ID_MASK (genapic->apic_id_mask)
-#endif
-
-#endif /* _ASM_X86_MACH_GENERIC_MACH_APICDEF_H */
diff --git a/arch/x86/include/asm/mach-generic/mach_ipi.h b/arch/x86/include/asm/mach-generic/mach_ipi.h
deleted file mode 100644
index ffd637e3c3d..00000000000
--- a/arch/x86/include/asm/mach-generic/mach_ipi.h
+++ /dev/null
@@ -1,10 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_MACH_IPI_H
-#define _ASM_X86_MACH_GENERIC_MACH_IPI_H
-
-#include <asm/genapic.h>
-
-#define send_IPI_mask (genapic->send_IPI_mask)
-#define send_IPI_allbutself (genapic->send_IPI_allbutself)
-#define send_IPI_all (genapic->send_IPI_all)
-
-#endif /* _ASM_X86_MACH_GENERIC_MACH_IPI_H */
diff --git a/arch/x86/include/asm/mach-generic/mach_mpparse.h b/arch/x86/include/asm/mach-generic/mach_mpparse.h
deleted file mode 100644
index 9444ab8dca9..00000000000
--- a/arch/x86/include/asm/mach-generic/mach_mpparse.h
+++ /dev/null
@@ -1,9 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_MACH_MPPARSE_H
-#define _ASM_X86_MACH_GENERIC_MACH_MPPARSE_H
-
-
-extern int mps_oem_check(struct mpc_table *, char *, char *);
-
-extern int acpi_madt_oem_check(char *, char *);
-
-#endif /* _ASM_X86_MACH_GENERIC_MACH_MPPARSE_H */
diff --git a/arch/x86/include/asm/mach-generic/mach_mpspec.h b/arch/x86/include/asm/mach-generic/mach_mpspec.h
deleted file mode 100644
index 3bc40722657..00000000000
--- a/arch/x86/include/asm/mach-generic/mach_mpspec.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_MACH_MPSPEC_H
-#define _ASM_X86_MACH_GENERIC_MACH_MPSPEC_H
-
-#define MAX_IRQ_SOURCES 256
-
-/* Summit or generic (i.e. installer) kernels need lots of bus entries. */
-/* Maximum 256 PCI busses, plus 1 ISA bus in each of 4 cabinets. */
-#define MAX_MP_BUSSES 260
-
-extern void numaq_mps_oem_check(struct mpc_table *, char *, char *);
-
-#endif /* _ASM_X86_MACH_GENERIC_MACH_MPSPEC_H */
diff --git a/arch/x86/include/asm/mach-generic/mach_wakecpu.h b/arch/x86/include/asm/mach-generic/mach_wakecpu.h
deleted file mode 100644
index 1ab16b168c8..00000000000
--- a/arch/x86/include/asm/mach-generic/mach_wakecpu.h
+++ /dev/null
@@ -1,12 +0,0 @@
-#ifndef _ASM_X86_MACH_GENERIC_MACH_WAKECPU_H
-#define _ASM_X86_MACH_GENERIC_MACH_WAKECPU_H
-
-#define TRAMPOLINE_PHYS_LOW (genapic->trampoline_phys_low)
-#define TRAMPOLINE_PHYS_HIGH (genapic->trampoline_phys_high)
-#define wait_for_init_deassert (genapic->wait_for_init_deassert)
-#define smp_callin_clear_local_apic (genapic->smp_callin_clear_local_apic)
-#define store_NMI_vector (genapic->store_NMI_vector)
-#define restore_NMI_vector (genapic->restore_NMI_vector)
-#define inquire_remote_apic (genapic->inquire_remote_apic)
-
-#endif /* _ASM_X86_MACH_GENERIC_MACH_APIC_H */
diff --git a/arch/x86/include/asm/mach-rdc321x/gpio.h b/arch/x86/include/asm/mach-rdc321x/gpio.h
deleted file mode 100644
index c210ab5788b..00000000000
--- a/arch/x86/include/asm/mach-rdc321x/gpio.h
+++ /dev/null
@@ -1,60 +0,0 @@
-#ifndef _ASM_X86_MACH_RDC321X_GPIO_H
-#define _ASM_X86_MACH_RDC321X_GPIO_H
-
-#include <linux/kernel.h>
-
-extern int rdc_gpio_get_value(unsigned gpio);
-extern void rdc_gpio_set_value(unsigned gpio, int value);
-extern int rdc_gpio_direction_input(unsigned gpio);
-extern int rdc_gpio_direction_output(unsigned gpio, int value);
-extern int rdc_gpio_request(unsigned gpio, const char *label);
-extern void rdc_gpio_free(unsigned gpio);
-extern void __init rdc321x_gpio_setup(void);
-
-/* Wrappers for the arch-neutral GPIO API */
-
-static inline int gpio_request(unsigned gpio, const char *label)
-{
-        return rdc_gpio_request(gpio, label);
-}
-
-static inline void gpio_free(unsigned gpio)
-{
-        might_sleep();
-        rdc_gpio_free(gpio);
-}
-
-static inline int gpio_direction_input(unsigned gpio)
-{
-        return rdc_gpio_direction_input(gpio);
-}
-
-static inline int gpio_direction_output(unsigned gpio, int value)
-{
-        return rdc_gpio_direction_output(gpio, value);
-}
-
-static inline int gpio_get_value(unsigned gpio)
-{
-        return rdc_gpio_get_value(gpio);
-}
-
-static inline void gpio_set_value(unsigned gpio, int value)
-{
-        rdc_gpio_set_value(gpio, value);
-}
-
-static inline int gpio_to_irq(unsigned gpio)
-{
-        return gpio;
-}
-
-static inline int irq_to_gpio(unsigned irq)
-{
-        return irq;
-}
-
-/* For cansleep */
-#include <asm-generic/gpio.h>
-
-#endif /* _ASM_X86_MACH_RDC321X_GPIO_H */
diff --git a/arch/x86/include/asm/mach-default/mach_timer.h b/arch/x86/include/asm/mach_timer.h
index 853728519ae..853728519ae 100644
--- a/arch/x86/include/asm/mach-default/mach_timer.h
+++ b/arch/x86/include/asm/mach_timer.h
diff --git a/arch/x86/include/asm/mach-default/mach_traps.h b/arch/x86/include/asm/mach_traps.h
index f7920601e47..f7920601e47 100644
--- a/arch/x86/include/asm/mach-default/mach_traps.h
+++ b/arch/x86/include/asm/mach_traps.h
diff --git a/arch/x86/include/asm/math_emu.h b/arch/x86/include/asm/math_emu.h
index 5a65b107ad5..031f6266f42 100644
--- a/arch/x86/include/asm/math_emu.h
+++ b/arch/x86/include/asm/math_emu.h
@@ -1,31 +1,18 @@
 #ifndef _ASM_X86_MATH_EMU_H
 #define _ASM_X86_MATH_EMU_H
 
+#include <asm/ptrace.h>
+#include <asm/vm86.h>
+
 /* This structure matches the layout of the data saved to the stack
    following a device-not-present interrupt, part of it saved
    automatically by the 80386/80486.
    */
-struct info {
+struct math_emu_info {
         long ___orig_eip;
-        long ___ebx;
-        long ___ecx;
-        long ___edx;
-        long ___esi;
-        long ___edi;
-        long ___ebp;
-        long ___eax;
-        long ___ds;
-        long ___es;
-        long ___fs;
-        long ___orig_eax;
-        long ___eip;
-        long ___cs;
-        long ___eflags;
-        long ___esp;
-        long ___ss;
-        long ___vm86_es; /* This and the following only in vm86 mode */
-        long ___vm86_ds;
-        long ___vm86_fs;
-        long ___vm86_gs;
+        union {
+                struct pt_regs *regs;
+                struct kernel_vm86_regs *vm86;
+        };
 };
 #endif /* _ASM_X86_MATH_EMU_H */
diff --git a/arch/x86/include/asm/mmu_context.h b/arch/x86/include/asm/mmu_context.h
index 8aeeb3fd73d..f923203dc39 100644
--- a/arch/x86/include/asm/mmu_context.h
+++ b/arch/x86/include/asm/mmu_context.h
@@ -21,11 +21,54 @@ static inline void paravirt_activate_mm(struct mm_struct *prev,
 int init_new_context(struct task_struct *tsk, struct mm_struct *mm);
 void destroy_context(struct mm_struct *mm);
 
-#ifdef CONFIG_X86_32
-# include "mmu_context_32.h"
-#else
-# include "mmu_context_64.h"
+
+static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
+{
+#ifdef CONFIG_SMP
+        if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
+                percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
+#endif
+}
+
+static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
+                             struct task_struct *tsk)
+{
+        unsigned cpu = smp_processor_id();
+
+        if (likely(prev != next)) {
+                /* stop flush ipis for the previous mm */
+                cpu_clear(cpu, prev->cpu_vm_mask);
+#ifdef CONFIG_SMP
+                percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+                percpu_write(cpu_tlbstate.active_mm, next);
 #endif
+                cpu_set(cpu, next->cpu_vm_mask);
+
+                /* Re-load page tables */
+                load_cr3(next->pgd);
+
+                /*
+                 * load the LDT, if the LDT is different:
+                 */
+                if (unlikely(prev->context.ldt != next->context.ldt))
+                        load_LDT_nolock(&next->context);
+        }
+#ifdef CONFIG_SMP
+        else {
+                percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
+                BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
+
+                if (!cpu_test_and_set(cpu, next->cpu_vm_mask)) {
+                        /* We were in lazy tlb mode and leave_mm disabled
+                         * tlb flush IPI delivery. We must reload CR3
+                         * to make sure to use no freed page tables.
+                         */
+                        load_cr3(next->pgd);
+                        load_LDT_nolock(&next->context);
+                }
+        }
+#endif
+}
 
 #define activate_mm(prev, next)                 \
 do {                                            \
@@ -33,5 +76,17 @@ do {						\
         switch_mm((prev), (next), NULL);        \
 } while (0);
 
+#ifdef CONFIG_X86_32
+#define deactivate_mm(tsk, mm)                  \
+do {                                            \
+        lazy_load_gs(0);                        \
+} while (0)
+#else
+#define deactivate_mm(tsk, mm)                  \
+do {                                            \
+        load_gs_index(0);                       \
+        loadsegment(fs, 0);                     \
+} while (0)
+#endif
 
 #endif /* _ASM_X86_MMU_CONTEXT_H */
diff --git a/arch/x86/include/asm/mmu_context_32.h b/arch/x86/include/asm/mmu_context_32.h
deleted file mode 100644
index 7e98ce1d2c0..00000000000
--- a/arch/x86/include/asm/mmu_context_32.h
+++ /dev/null
@@ -1,55 +0,0 @@
-#ifndef _ASM_X86_MMU_CONTEXT_32_H
-#define _ASM_X86_MMU_CONTEXT_32_H
-
-static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
-{
-#ifdef CONFIG_SMP
-        if (x86_read_percpu(cpu_tlbstate.state) == TLBSTATE_OK)
-                x86_write_percpu(cpu_tlbstate.state, TLBSTATE_LAZY);
-#endif
-}
-
-static inline void switch_mm(struct mm_struct *prev,
-                             struct mm_struct *next,
-                             struct task_struct *tsk)
-{
-        int cpu = smp_processor_id();
-
-        if (likely(prev != next)) {
-                /* stop flush ipis for the previous mm */
-                cpu_clear(cpu, prev->cpu_vm_mask);
-#ifdef CONFIG_SMP
-                x86_write_percpu(cpu_tlbstate.state, TLBSTATE_OK);
-                x86_write_percpu(cpu_tlbstate.active_mm, next);
-#endif
-                cpu_set(cpu, next->cpu_vm_mask);
-
-                /* Re-load page tables */
-                load_cr3(next->pgd);
-
-                /*
-                 * load the LDT, if the LDT is different:
-                 */
-                if (unlikely(prev->context.ldt != next->context.ldt))
-                        load_LDT_nolock(&next->context);
-        }
-#ifdef CONFIG_SMP
-        else {
-                x86_write_percpu(cpu_tlbstate.state, TLBSTATE_OK);
-                BUG_ON(x86_read_percpu(cpu_tlbstate.active_mm) != next);
-
-                if (!cpu_test_and_set(cpu, next->cpu_vm_mask)) {
-                        /* We were in lazy tlb mode and leave_mm disabled
-                         * tlb flush IPI delivery. We must reload %cr3.
-                         */
-                        load_cr3(next->pgd);
-                        load_LDT_nolock(&next->context);
-                }
-        }
-#endif
-}
-
-#define deactivate_mm(tsk, mm)                  \
-        asm("movl %0,%%gs": :"r" (0));
-
-#endif /* _ASM_X86_MMU_CONTEXT_32_H */
diff --git a/arch/x86/include/asm/mmu_context_64.h b/arch/x86/include/asm/mmu_context_64.h
deleted file mode 100644
index 677d36e9540..00000000000
--- a/arch/x86/include/asm/mmu_context_64.h
+++ /dev/null
@@ -1,54 +0,0 @@
-#ifndef _ASM_X86_MMU_CONTEXT_64_H
-#define _ASM_X86_MMU_CONTEXT_64_H
-
-#include <asm/pda.h>
-
-static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
-{
-#ifdef CONFIG_SMP
-        if (read_pda(mmu_state) == TLBSTATE_OK)
-                write_pda(mmu_state, TLBSTATE_LAZY);
-#endif
-}
-
-static inline void switch_mm(struct mm_struct *prev, struct mm_struct *next,
-                             struct task_struct *tsk)
-{
-        unsigned cpu = smp_processor_id();
-        if (likely(prev != next)) {
-                /* stop flush ipis for the previous mm */
-                cpu_clear(cpu, prev->cpu_vm_mask);
-#ifdef CONFIG_SMP
-                write_pda(mmu_state, TLBSTATE_OK);
-                write_pda(active_mm, next);
-#endif
-                cpu_set(cpu, next->cpu_vm_mask);
-                load_cr3(next->pgd);
-
-                if (unlikely(next->context.ldt != prev->context.ldt))
-                        load_LDT_nolock(&next->context);
-        }
-#ifdef CONFIG_SMP
-        else {
-                write_pda(mmu_state, TLBSTATE_OK);
-                if (read_pda(active_mm) != next)
-                        BUG();
-                if (!cpu_test_and_set(cpu, next->cpu_vm_mask)) {
-                        /* We were in lazy tlb mode and leave_mm disabled
-                         * tlb flush IPI delivery. We must reload CR3
-                         * to make sure to use no freed page tables.
-                         */
-                        load_cr3(next->pgd);
-                        load_LDT_nolock(&next->context);
-                }
-        }
-#endif
-}
-
-#define deactivate_mm(tsk, mm)                  \
-do {                                            \
-        load_gs_index(0);                       \
-        asm volatile("movl %0,%%fs"::"r"(0));   \
-} while (0)
-
-#endif /* _ASM_X86_MMU_CONTEXT_64_H */
diff --git a/arch/x86/include/asm/mpspec.h b/arch/x86/include/asm/mpspec.h
index 62d14ce3cd0..5916c8df09d 100644
--- a/arch/x86/include/asm/mpspec.h
+++ b/arch/x86/include/asm/mpspec.h
@@ -9,7 +9,18 @@ extern int apic_version[MAX_APICS];
 extern int pic_mode;
 
 #ifdef CONFIG_X86_32
-#include <mach_mpspec.h>
+
+/*
+ * Summit or generic (i.e. installer) kernels need lots of bus entries.
+ * Maximum 256 PCI busses, plus 1 ISA bus in each of 4 cabinets.
+ */
+#if CONFIG_BASE_SMALL == 0
+# define MAX_MP_BUSSES          260
+#else
+# define MAX_MP_BUSSES          32
+#endif
+
+#define MAX_IRQ_SOURCES         256
 
 extern unsigned int def_to_bigsmp;
 extern u8 apicid_2_node[];
@@ -20,15 +31,15 @@ extern int mp_bus_id_to_local[MAX_MP_BUSSES];
 extern int quad_local_to_mp_bus_id [NR_CPUS/4][4];
 #endif
 
-#define MAX_APICID 256
+#define MAX_APICID              256
 
-#else
+#else /* CONFIG_X86_64: */
 
-#define MAX_MP_BUSSES 256
+#define MAX_MP_BUSSES           256
 /* Each PCI slot may be a combo card with its own bus.  4 IRQ pins per slot. */
-#define MAX_IRQ_SOURCES (MAX_MP_BUSSES * 4)
+#define MAX_IRQ_SOURCES         (MAX_MP_BUSSES * 4)
 
-#endif
+#endif /* CONFIG_X86_64 */
 
 extern void early_find_smp_config(void);
 extern void early_get_smp_config(void);
@@ -45,11 +56,13 @@ extern int smp_found_config;
 extern int mpc_default_type;
 extern unsigned long mp_lapic_addr;
 
-extern void find_smp_config(void);
 extern void get_smp_config(void);
+
 #ifdef CONFIG_X86_MPPARSE
+extern void find_smp_config(void);
 extern void early_reserve_e820_mpc_new(void);
 #else
+static inline void find_smp_config(void) { }
 static inline void early_reserve_e820_mpc_new(void) { }
 #endif
 
@@ -60,9 +73,12 @@ extern void mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger,
                                    u32 gsi);
 extern void mp_config_acpi_legacy_irqs(void);
 extern int mp_register_gsi(u32 gsi, int edge_level, int active_high_low);
+extern int acpi_probe_gsi(void);
 #ifdef CONFIG_X86_IO_APIC
 extern int mp_config_acpi_gsi(unsigned char number, unsigned int devfn, u8 pin,
                                 u32 gsi, int triggering, int polarity);
+extern int mp_find_ioapic(int gsi);
+extern int mp_find_ioapic_pin(int ioapic, int gsi);
 #else
 static inline int
 mp_config_acpi_gsi(unsigned char number, unsigned int devfn, u8 pin,
@@ -71,6 +87,11 @@ mp_config_acpi_gsi(unsigned char number, unsigned int devfn, u8 pin,
         return 0;
 }
 #endif
+#else /* !CONFIG_ACPI: */
+static inline int acpi_probe_gsi(void)
+{
+        return 0;
+}
 #endif /* CONFIG_ACPI */
 
 #define PHYSID_ARRAY_SIZE       BITS_TO_LONGS(MAX_APICS)
@@ -142,4 +163,10 @@ static inline void physid_set_mask_of_physid(int physid, physid_mask_t *map)
 
 extern physid_mask_t phys_cpu_present_map;
 
+extern int generic_mps_oem_check(struct mpc_table *, char *, char *);
+
+extern int default_acpi_madt_oem_check(char *, char *);
+
+extern void numaq_mps_oem_check(struct mpc_table *, char *, char *);
+
 #endif /* _ASM_X86_MPSPEC_H */
diff --git a/arch/x86/include/asm/mpspec_def.h b/arch/x86/include/asm/mpspec_def.h
index 59568bc4767..4a7f96d7c18 100644
--- a/arch/x86/include/asm/mpspec_def.h
+++ b/arch/x86/include/asm/mpspec_def.h
@@ -24,17 +24,18 @@
 # endif
 #endif
 
-struct intel_mp_floating {
-        char mpf_signature[4];          /* "_MP_"                       */
-        unsigned int mpf_physptr;       /* Configuration table address  */
-        unsigned char mpf_length;       /* Our length (paragraphs)      */
-        unsigned char mpf_specification;/* Specification version        */
-        unsigned char mpf_checksum;     /* Checksum (makes sum 0)       */
-        unsigned char mpf_feature1;     /* Standard or configuration ?  */
-        unsigned char mpf_feature2;     /* Bit7 set for IMCR|PIC        */
-        unsigned char mpf_feature3;     /* Unused (0)                   */
-        unsigned char mpf_feature4;     /* Unused (0)                   */
-        unsigned char mpf_feature5;     /* Unused (0)                   */
+/* Intel MP Floating Pointer Structure */
+struct mpf_intel {
+        char signature[4];              /* "_MP_"                       */
+        unsigned int physptr;           /* Configuration table address  */
+        unsigned char length;           /* Our length (paragraphs)      */
+        unsigned char specification;    /* Specification version        */
+        unsigned char checksum;         /* Checksum (makes sum 0)       */
+        unsigned char feature1;         /* Standard or configuration ?  */
+        unsigned char feature2;         /* Bit7 set for IMCR|PIC        */
+        unsigned char feature3;         /* Unused (0)                   */
+        unsigned char feature4;         /* Unused (0)                   */
+        unsigned char feature5;         /* Unused (0)                   */
 };
 
 #define MPC_SIGNATURE "PCMP"
diff --git a/arch/x86/include/asm/numaq.h b/arch/x86/include/asm/numaq.h
index 1e8bd30b4c1..9f0a5f5d29e 100644
--- a/arch/x86/include/asm/numaq.h
+++ b/arch/x86/include/asm/numaq.h
@@ -31,6 +31,8 @@
 extern int found_numaq;
 extern int get_memcfg_numaq(void);
 
+extern void *xquad_portio;
+
 /*
  * SYS_CFG_DATA_PRIV_ADDR, struct eachquadmem, and struct sys_cfg_data are the
  */
diff --git a/arch/x86/include/asm/numaq/apic.h b/arch/x86/include/asm/numaq/apic.h
deleted file mode 100644
index bf37bc49bd8..00000000000
--- a/arch/x86/include/asm/numaq/apic.h
+++ /dev/null
@@ -1,142 +0,0 @@
-#ifndef __ASM_NUMAQ_APIC_H
-#define __ASM_NUMAQ_APIC_H
-
-#include <asm/io.h>
-#include <linux/mmzone.h>
-#include <linux/nodemask.h>
-
-#define APIC_DFR_VALUE  (APIC_DFR_CLUSTER)
-
-static inline const cpumask_t *target_cpus(void)
-{
-        return &CPU_MASK_ALL;
-}
-
-#define NO_BALANCE_IRQ (1)
-#define esr_disable (1)
-
-#define INT_DELIVERY_MODE dest_LowestPrio
-#define INT_DEST_MODE 0     /* physical delivery on LOCAL quad */
- 
-static inline unsigned long check_apicid_used(physid_mask_t bitmap, int apicid)
-{
-        return physid_isset(apicid, bitmap);
-}
-static inline unsigned long check_apicid_present(int bit)
-{
-        return physid_isset(bit, phys_cpu_present_map);
-}
-#define apicid_cluster(apicid) (apicid & 0xF0)
-
-static inline int apic_id_registered(void)
-{
-        return 1;
-}
-
-static inline void init_apic_ldr(void)
-{
-        /* Already done in NUMA-Q firmware */
-}
-
-static inline void setup_apic_routing(void)
-{
-        printk("Enabling APIC mode:  %s.  Using %d I/O APICs\n",
-                "NUMA-Q", nr_ioapics);
-}
-
-/*
- * Skip adding the timer int on secondary nodes, which causes
- * a small but painful rift in the time-space continuum.
- */
-static inline int multi_timer_check(int apic, int irq)
-{
-        return apic != 0 && irq == 0;
-}
-
-static inline physid_mask_t ioapic_phys_id_map(physid_mask_t phys_map)
-{
-        /* We don't have a good way to do this yet - hack */
-        return physids_promote(0xFUL);
-}
-
-/* Mapping from cpu number to logical apicid */
-extern u8 cpu_2_logical_apicid[];
-static inline int cpu_to_logical_apicid(int cpu)
-{
-        if (cpu >= nr_cpu_ids)
-                return BAD_APICID;
-        return (int)cpu_2_logical_apicid[cpu];
-}
-
-/*
- * Supporting over 60 cpus on NUMA-Q requires a locality-dependent
- * cpu to APIC ID relation to properly interact with the intelligent
- * mode of the cluster controller.
- */
-static inline int cpu_present_to_apicid(int mps_cpu)
-{
-        if (mps_cpu < 60)
-                return ((mps_cpu >> 2) << 4) | (1 << (mps_cpu & 0x3));
-        else
-                return BAD_APICID;
-}
-
-static inline int apicid_to_node(int logical_apicid) 
-{
-        return logical_apicid >> 4;
-}
-
-static inline physid_mask_t apicid_to_cpu_present(int logical_apicid)
-{
-        int node = apicid_to_node(logical_apicid);
-        int cpu = __ffs(logical_apicid & 0xf);
-
-        return physid_mask_of_physid(cpu + 4*node);
-}
-
-extern void *xquad_portio;
-
-static inline void setup_portio_remap(void)
-{
-        int num_quads = num_online_nodes();
-
-        if (num_quads <= 1)
-                return;
-
-        printk("Remapping cross-quad port I/O for %d quads\n", num_quads);
-        xquad_portio = ioremap(XQUAD_PORTIO_BASE, num_quads*XQUAD_PORTIO_QUAD);
-        printk("xquad_portio vaddr 0x%08lx, len %08lx\n",
-                (u_long) xquad_portio, (u_long) num_quads*XQUAD_PORTIO_QUAD);
-}
-
-static inline int check_phys_apicid_present(int boot_cpu_physical_apicid)
-{
-        return (1);
-}
-
-static inline void enable_apic_mode(void)
-{
-}
-
-/*
- * We use physical apicids here, not logical, so just return the default
- * physical broadcast to stop people from breaking us
- */
-static inline unsigned int cpu_mask_to_apicid(const cpumask_t *cpumask)
-{
-        return (int) 0xF;
-}
-
-static inline unsigned int cpu_mask_to_apicid_and(const struct cpumask *cpumask,
-                                                  const struct cpumask *andmask)
-{
-        return (int) 0xF;
-}
-
-/* No NUMA-Q box has a HT CPU, but it can't hurt to use the default code. */
-static inline u32 phys_pkg_id(u32 cpuid_apic, int index_msb)
-{
-        return cpuid_apic >> index_msb;
-}
-
-#endif /* __ASM_NUMAQ_APIC_H */
diff --git a/arch/x86/include/asm/numaq/apicdef.h b/arch/x86/include/asm/numaq/apicdef.h
deleted file mode 100644
index e012a46cc22..00000000000
--- a/arch/x86/include/asm/numaq/apicdef.h
+++ /dev/null
@@ -1,14 +0,0 @@
-#ifndef __ASM_NUMAQ_APICDEF_H
-#define __ASM_NUMAQ_APICDEF_H
-
-
-#define APIC_ID_MASK (0xF<<24)
-
-static inline unsigned get_apic_id(unsigned long x)
-{
-                return (((x)>>24)&0x0F);
-}
-
-#define         GET_APIC_ID(x)  get_apic_id(x)
-
-#endif
diff --git a/arch/x86/include/asm/numaq/ipi.h b/arch/x86/include/asm/numaq/ipi.h
deleted file mode 100644
index a8374c65277..00000000000
--- a/arch/x86/include/asm/numaq/ipi.h
+++ /dev/null
@@ -1,22 +0,0 @@
-#ifndef __ASM_NUMAQ_IPI_H
-#define __ASM_NUMAQ_IPI_H
-
-void send_IPI_mask_sequence(const struct cpumask *mask, int vector);
-void send_IPI_mask_allbutself(const struct cpumask *mask, int vector);
-
-static inline void send_IPI_mask(const struct cpumask *mask, int vector)
-{
-        send_IPI_mask_sequence(mask, vector);
-}
-
-static inline void send_IPI_allbutself(int vector)
-{
-        send_IPI_mask_allbutself(cpu_online_mask, vector);
-}
-
-static inline void send_IPI_all(int vector)
-{
-        send_IPI_mask(cpu_online_mask, vector);
-}
-
-#endif /* __ASM_NUMAQ_IPI_H */
diff --git a/arch/x86/include/asm/numaq/mpparse.h b/arch/x86/include/asm/numaq/mpparse.h
deleted file mode 100644
index a2eeefcd1cc..00000000000
--- a/arch/x86/include/asm/numaq/mpparse.h
+++ /dev/null
@@ -1,6 +0,0 @@
-#ifndef __ASM_NUMAQ_MPPARSE_H
-#define __ASM_NUMAQ_MPPARSE_H
-
-extern void numaq_mps_oem_check(struct mpc_table *, char *, char *);
-
-#endif /* __ASM_NUMAQ_MPPARSE_H */
diff --git a/arch/x86/include/asm/numaq/wakecpu.h b/arch/x86/include/asm/numaq/wakecpu.h
deleted file mode 100644
index 6f499df8edd..00000000000
--- a/arch/x86/include/asm/numaq/wakecpu.h
+++ /dev/null
@@ -1,45 +0,0 @@
-#ifndef __ASM_NUMAQ_WAKECPU_H
-#define __ASM_NUMAQ_WAKECPU_H
-
-/* This file copes with machines that wakeup secondary CPUs by NMIs */
-
-#define TRAMPOLINE_PHYS_LOW (0x8)
-#define TRAMPOLINE_PHYS_HIGH (0xa)
-
-/* We don't do anything here because we use NMI's to boot instead */
-static inline void wait_for_init_deassert(atomic_t *deassert)
-{
-}
-
-/*
- * Because we use NMIs rather than the INIT-STARTUP sequence to
- * bootstrap the CPUs, the APIC may be in a weird state. Kick it.
- */
-static inline void smp_callin_clear_local_apic(void)
-{
-        clear_local_APIC();
-}
-
-static inline void store_NMI_vector(unsigned short *high, unsigned short *low)
-{
-        printk("Storing NMI vector\n");
-        *high =
-          *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH));
-        *low =
-          *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW));
-}
-
-static inline void restore_NMI_vector(unsigned short *high, unsigned short *low)
-{
-        printk("Restoring NMI vector\n");
-        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) =
-                                                                 *high;
-        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) =
-                                                                 *low;
-}
-
-static inline void inquire_remote_apic(int apicid)
-{
-}
-
-#endif /* __ASM_NUMAQ_WAKECPU_H */
diff --git a/arch/x86/include/asm/page.h b/arch/x86/include/asm/page.h
index e9873a2e869..89ed9d70b0a 100644
--- a/arch/x86/include/asm/page.h
+++ b/arch/x86/include/asm/page.h
@@ -1,42 +1,11 @@
 #ifndef _ASM_X86_PAGE_H
 #define _ASM_X86_PAGE_H
 
-#include <linux/const.h>
-
-/* PAGE_SHIFT determines the page size */
-#define PAGE_SHIFT      12
-#define PAGE_SIZE       (_AC(1,UL) << PAGE_SHIFT)
-#define PAGE_MASK       (~(PAGE_SIZE-1))
+#include <linux/types.h>
 
 #ifdef __KERNEL__
 
-#define __PHYSICAL_MASK         ((phys_addr_t)(1ULL << __PHYSICAL_MASK_SHIFT) - 1)
-#define __VIRTUAL_MASK          ((1UL << __VIRTUAL_MASK_SHIFT) - 1)
-
-/* Cast PAGE_MASK to a signed type so that it is sign-extended if
-   virtual addresses are 32-bits but physical addresses are larger
-   (ie, 32-bit PAE). */
-#define PHYSICAL_PAGE_MASK      (((signed long)PAGE_MASK) & __PHYSICAL_MASK)
-
-/* PTE_PFN_MASK extracts the PFN from a (pte|pmd|pud|pgd)val_t */
-#define PTE_PFN_MASK            ((pteval_t)PHYSICAL_PAGE_MASK)
-
-/* PTE_FLAGS_MASK extracts the flags from a (pte|pmd|pud|pgd)val_t */
-#define PTE_FLAGS_MASK          (~PTE_PFN_MASK)
-
-#define PMD_PAGE_SIZE           (_AC(1, UL) << PMD_SHIFT)
-#define PMD_PAGE_MASK           (~(PMD_PAGE_SIZE-1))
-
-#define HPAGE_SHIFT             PMD_SHIFT
-#define HPAGE_SIZE              (_AC(1,UL) << HPAGE_SHIFT)
-#define HPAGE_MASK              (~(HPAGE_SIZE - 1))
-#define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
-
-#define HUGE_MAX_HSTATE 2
-
-#ifndef __ASSEMBLY__
-#include <linux/types.h>
-#endif
+#include <asm/page_types.h>
 
 #ifdef CONFIG_X86_64
 #include <asm/page_64.h>
@@ -44,39 +13,18 @@
 #include <asm/page_32.h>
 #endif  /* CONFIG_X86_64 */
 
-#define PAGE_OFFSET             ((unsigned long)__PAGE_OFFSET)
-
-#define VM_DATA_DEFAULT_FLAGS \
-        (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
-         VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
-
-
 #ifndef __ASSEMBLY__
 
-typedef struct { pgdval_t pgd; } pgd_t;
-typedef struct { pgprotval_t pgprot; } pgprot_t;
-
-extern int page_is_ram(unsigned long pagenr);
-extern int pagerange_is_ram(unsigned long start, unsigned long end);
-extern int devmem_is_allowed(unsigned long pagenr);
-extern void map_devmem(unsigned long pfn, unsigned long size,
-                       pgprot_t vma_prot);
-extern void unmap_devmem(unsigned long pfn, unsigned long size,
-                         pgprot_t vma_prot);
-
-extern unsigned long max_low_pfn_mapped;
-extern unsigned long max_pfn_mapped;
-
 struct page;
 
 static inline void clear_user_page(void *page, unsigned long vaddr,
-                                struct page *pg)
+                                   struct page *pg)
 {
         clear_page(page);
 }
 
 static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
-                                struct page *topage)
+                                  struct page *topage)
 {
         copy_page(to, from);
 }
@@ -85,99 +33,6 @@ static inline void copy_user_page(void *to, void *from, unsigned long vaddr,
         alloc_page_vma(GFP_HIGHUSER | __GFP_ZERO | movableflags, vma, vaddr)
 #define __HAVE_ARCH_ALLOC_ZEROED_USER_HIGHPAGE
 
-static inline pgd_t native_make_pgd(pgdval_t val)
-{
-        return (pgd_t) { val };
-}
-
-static inline pgdval_t native_pgd_val(pgd_t pgd)
-{
-        return pgd.pgd;
-}
-
-#if PAGETABLE_LEVELS >= 3
-#if PAGETABLE_LEVELS == 4
-typedef struct { pudval_t pud; } pud_t;
-
-static inline pud_t native_make_pud(pmdval_t val)
-{
-        return (pud_t) { val };
-}
-
-static inline pudval_t native_pud_val(pud_t pud)
-{
-        return pud.pud;
-}
-#else   /* PAGETABLE_LEVELS == 3 */
-#include <asm-generic/pgtable-nopud.h>
-
-static inline pudval_t native_pud_val(pud_t pud)
-{
-        return native_pgd_val(pud.pgd);
-}
-#endif  /* PAGETABLE_LEVELS == 4 */
-
-typedef struct { pmdval_t pmd; } pmd_t;
-
-static inline pmd_t native_make_pmd(pmdval_t val)
-{
-        return (pmd_t) { val };
-}
-
-static inline pmdval_t native_pmd_val(pmd_t pmd)
-{
-        return pmd.pmd;
-}
-#else  /* PAGETABLE_LEVELS == 2 */
-#include <asm-generic/pgtable-nopmd.h>
-
-static inline pmdval_t native_pmd_val(pmd_t pmd)
-{
-        return native_pgd_val(pmd.pud.pgd);
-}
-#endif  /* PAGETABLE_LEVELS >= 3 */
-
-static inline pte_t native_make_pte(pteval_t val)
-{
-        return (pte_t) { .pte = val };
-}
-
-static inline pteval_t native_pte_val(pte_t pte)
-{
-        return pte.pte;
-}
-
-static inline pteval_t native_pte_flags(pte_t pte)
-{
-        return native_pte_val(pte) & PTE_FLAGS_MASK;
-}
-
-#define pgprot_val(x)   ((x).pgprot)
-#define __pgprot(x)     ((pgprot_t) { (x) } )
-
-#ifdef CONFIG_PARAVIRT
-#include <asm/paravirt.h>
-#else  /* !CONFIG_PARAVIRT */
-
-#define pgd_val(x)      native_pgd_val(x)
-#define __pgd(x)        native_make_pgd(x)
-
-#ifndef __PAGETABLE_PUD_FOLDED
-#define pud_val(x)      native_pud_val(x)
-#define __pud(x)        native_make_pud(x)
-#endif
-
-#ifndef __PAGETABLE_PMD_FOLDED
-#define pmd_val(x)      native_pmd_val(x)
-#define __pmd(x)        native_make_pmd(x)
-#endif
-
-#define pte_val(x)      native_pte_val(x)
-#define pte_flags(x)    native_pte_flags(x)
-#define __pte(x)        native_make_pte(x)
-
-#endif  /* CONFIG_PARAVIRT */
-
 #define __pa(x)         __phys_addr((unsigned long)(x))
 #define __pa_nodebug(x) __phys_addr_nodebug((unsigned long)(x))
 /* __pa_symbol should be used for C visible symbols.
diff --git a/arch/x86/include/asm/page_32.h b/arch/x86/include/asm/page_32.h
index bcde0d7b432..da4e762406f 100644
--- a/arch/x86/include/asm/page_32.h
+++ b/arch/x86/include/asm/page_32.h
@@ -1,82 +1,14 @@
 #ifndef _ASM_X86_PAGE_32_H
 #define _ASM_X86_PAGE_32_H
 
-/*
- * This handles the memory map.
- *
- * A __PAGE_OFFSET of 0xC0000000 means that the kernel has
- * a virtual address space of one gigabyte, which limits the
- * amount of physical memory you can use to about 950MB.
- *
- * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
- * and CONFIG_HIGHMEM64G options in the kernel configuration.
- */
-#define __PAGE_OFFSET           _AC(CONFIG_PAGE_OFFSET, UL)
-
-#ifdef CONFIG_4KSTACKS
-#define THREAD_ORDER    0
-#else
-#define THREAD_ORDER    1
-#endif
-#define THREAD_SIZE     (PAGE_SIZE << THREAD_ORDER)
-
-#define STACKFAULT_STACK 0
-#define DOUBLEFAULT_STACK 1
-#define NMI_STACK 0
-#define DEBUG_STACK 0
-#define MCE_STACK 0
-#define N_EXCEPTION_STACKS 1
-
-#ifdef CONFIG_X86_PAE
-/* 44=32+12, the limit we can fit into an unsigned long pfn */
-#define __PHYSICAL_MASK_SHIFT   44
-#define __VIRTUAL_MASK_SHIFT    32
-#define PAGETABLE_LEVELS        3
-
-#ifndef __ASSEMBLY__
-typedef u64     pteval_t;
-typedef u64     pmdval_t;
-typedef u64     pudval_t;
-typedef u64     pgdval_t;
-typedef u64     pgprotval_t;
-
-typedef union {
-        struct {
-                unsigned long pte_low, pte_high;
-        };
-        pteval_t pte;
-} pte_t;
-#endif  /* __ASSEMBLY__
- */
-#else  /* !CONFIG_X86_PAE */
-#define __PHYSICAL_MASK_SHIFT   32
-#define __VIRTUAL_MASK_SHIFT    32
-#define PAGETABLE_LEVELS        2
-
-#ifndef __ASSEMBLY__
-typedef unsigned long   pteval_t;
-typedef unsigned long   pmdval_t;
-typedef unsigned long   pudval_t;
-typedef unsigned long   pgdval_t;
-typedef unsigned long   pgprotval_t;
-
-typedef union {
-        pteval_t pte;
-        pteval_t pte_low;
-} pte_t;
-
-#endif  /* __ASSEMBLY__ */
-#endif  /* CONFIG_X86_PAE */
+#include <asm/page_32_types.h>
 
 #ifndef __ASSEMBLY__
-typedef struct page *pgtable_t;
-#endif
 
 #ifdef CONFIG_HUGETLB_PAGE
 #define HAVE_ARCH_HUGETLB_UNMAPPED_AREA
 #endif
 
-#ifndef __ASSEMBLY__
 #define __phys_addr_nodebug(x)  ((x) - PAGE_OFFSET)
 #ifdef CONFIG_DEBUG_VIRTUAL
 extern unsigned long __phys_addr(unsigned long);
@@ -89,23 +21,6 @@ extern unsigned long __phys_addr(unsigned long);
 #define pfn_valid(pfn)          ((pfn) < max_mapnr)
 #endif /* CONFIG_FLATMEM */
 
-extern int nx_enabled;
-
-/*
- * This much address space is reserved for vmalloc() and iomap()
- * as well as fixmap mappings.
- */
-extern unsigned int __VMALLOC_RESERVE;
-extern int sysctl_legacy_va_layout;
-
-extern void find_low_pfn_range(void);
-extern unsigned long init_memory_mapping(unsigned long start,
-                                         unsigned long end);
-extern void initmem_init(unsigned long, unsigned long);
-extern void free_initmem(void);
-extern void setup_bootmem_allocator(void);
-
-
 #ifdef CONFIG_X86_USE_3DNOW
 #include <asm/mmx.h>
 
diff --git a/arch/x86/include/asm/page_32_types.h b/arch/x86/include/asm/page_32_types.h
new file mode 100644
index 00000000000..b5486aaf36e
--- /dev/null
+++ b/arch/x86/include/asm/page_32_types.h
@@ -0,0 +1,62 @@
+#ifndef _ASM_X86_PAGE_32_DEFS_H
+#define _ASM_X86_PAGE_32_DEFS_H
+
+#include <linux/const.h>
+
+/*
+ * This handles the memory map.
+ *
+ * A __PAGE_OFFSET of 0xC0000000 means that the kernel has
+ * a virtual address space of one gigabyte, which limits the
+ * amount of physical memory you can use to about 950MB.
+ *
+ * If you want more physical memory than this then see the CONFIG_HIGHMEM4G
+ * and CONFIG_HIGHMEM64G options in the kernel configuration.
+ */
+#define __PAGE_OFFSET           _AC(CONFIG_PAGE_OFFSET, UL)
+
+#ifdef CONFIG_4KSTACKS
+#define THREAD_ORDER    0
+#else
+#define THREAD_ORDER    1
+#endif
+#define THREAD_SIZE     (PAGE_SIZE << THREAD_ORDER)
+
+#define STACKFAULT_STACK 0
+#define DOUBLEFAULT_STACK 1
+#define NMI_STACK 0
+#define DEBUG_STACK 0
+#define MCE_STACK 0
+#define N_EXCEPTION_STACKS 1
+
+#ifdef CONFIG_X86_PAE
+/* 44=32+12, the limit we can fit into an unsigned long pfn */
+#define __PHYSICAL_MASK_SHIFT   44
+#define __VIRTUAL_MASK_SHIFT    32
+#define PAGETABLE_LEVELS        3
+
+#else  /* !CONFIG_X86_PAE */
+#define __PHYSICAL_MASK_SHIFT   32
+#define __VIRTUAL_MASK_SHIFT    32
+#define PAGETABLE_LEVELS        2
+#endif  /* CONFIG_X86_PAE */
+
+#ifndef __ASSEMBLY__
+
+/*
+ * This much address space is reserved for vmalloc() and iomap()
+ * as well as fixmap mappings.
+ */
+extern unsigned int __VMALLOC_RESERVE;
+extern int sysctl_legacy_va_layout;
+
+extern void find_low_pfn_range(void);
+extern unsigned long init_memory_mapping(unsigned long start,
+                                         unsigned long end);
+extern void initmem_init(unsigned long, unsigned long);
+extern void free_initmem(void);
+extern void setup_bootmem_allocator(void);
+
+#endif  /* !__ASSEMBLY__ */
+
+#endif /* _ASM_X86_PAGE_32_DEFS_H */
diff --git a/arch/x86/include/asm/page_64.h b/arch/x86/include/asm/page_64.h
index 5ebca29f44f..072694ed81a 100644
--- a/arch/x86/include/asm/page_64.h
+++ b/arch/x86/include/asm/page_64.h
@@ -1,105 +1,6 @@
 #ifndef _ASM_X86_PAGE_64_H
 #define _ASM_X86_PAGE_64_H
 
-#define PAGETABLE_LEVELS        4
-
-#define THREAD_ORDER    1
-#define THREAD_SIZE  (PAGE_SIZE << THREAD_ORDER)
-#define CURRENT_MASK (~(THREAD_SIZE - 1))
-
-#define EXCEPTION_STACK_ORDER 0
-#define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
-
-#define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
-#define DEBUG_STKSZ (PAGE_SIZE << DEBUG_STACK_ORDER)
-
-#define IRQSTACK_ORDER 2
-#define IRQSTACKSIZE (PAGE_SIZE << IRQSTACK_ORDER)
-
-#define STACKFAULT_STACK 1
-#define DOUBLEFAULT_STACK 2
-#define NMI_STACK 3
-#define DEBUG_STACK 4
-#define MCE_STACK 5
-#define N_EXCEPTION_STACKS 5  /* hw limit: 7 */
-
-#define PUD_PAGE_SIZE           (_AC(1, UL) << PUD_SHIFT)
-#define PUD_PAGE_MASK           (~(PUD_PAGE_SIZE-1))
-
-/*
- * Set __PAGE_OFFSET to the most negative possible address +
- * PGDIR_SIZE*16 (pgd slot 272).  The gap is to allow a space for a
- * hypervisor to fit.  Choosing 16 slots here is arbitrary, but it's
- * what Xen requires.
- */
-#define __PAGE_OFFSET           _AC(0xffff880000000000, UL)
-
-#define __PHYSICAL_START        CONFIG_PHYSICAL_START
-#define __KERNEL_ALIGN          0x200000
-
-/*
- * Make sure kernel is aligned to 2MB address. Catching it at compile
- * time is better. Change your config file and compile the kernel
- * for a 2MB aligned address (CONFIG_PHYSICAL_START)
- */
-#if (CONFIG_PHYSICAL_START % __KERNEL_ALIGN) != 0
-#error "CONFIG_PHYSICAL_START must be a multiple of 2MB"
-#endif
-
-#define __START_KERNEL          (__START_KERNEL_map + __PHYSICAL_START)
-#define __START_KERNEL_map      _AC(0xffffffff80000000, UL)
-
-/* See Documentation/x86_64/mm.txt for a description of the memory map. */
-#define __PHYSICAL_MASK_SHIFT   46
-#define __VIRTUAL_MASK_SHIFT    48
-
-/*
- * Kernel image size is limited to 512 MB (see level2_kernel_pgt in
- * arch/x86/kernel/head_64.S), and it is mapped here:
- */
-#define KERNEL_IMAGE_SIZE       (512 * 1024 * 1024)
-#define KERNEL_IMAGE_START      _AC(0xffffffff80000000, UL)
-
-#ifndef __ASSEMBLY__
-void clear_page(void *page);
-void copy_page(void *to, void *from);
-
-/* duplicated to the one in bootmem.h */
-extern unsigned long max_pfn;
-extern unsigned long phys_base;
-
-extern unsigned long __phys_addr(unsigned long);
-#define __phys_reloc_hide(x)    (x)
-
-/*
- * These are used to make use of C type-checking..
- */
-typedef unsigned long   pteval_t;
-typedef unsigned long   pmdval_t;
-typedef unsigned long   pudval_t;
-typedef unsigned long   pgdval_t;
-typedef unsigned long   pgprotval_t;
-
-typedef struct page *pgtable_t;
-
-typedef struct { pteval_t pte; } pte_t;
-
-#define vmemmap ((struct page *)VMEMMAP_START)
-
-extern unsigned long init_memory_mapping(unsigned long start,
-                                         unsigned long end);
-
-extern void initmem_init(unsigned long start_pfn, unsigned long end_pfn);
-extern void free_initmem(void);
-
-extern void init_extra_mapping_uc(unsigned long phys, unsigned long size);
-extern void init_extra_mapping_wb(unsigned long phys, unsigned long size);
-
-#endif  /* !__ASSEMBLY__ */
-
-#ifdef CONFIG_FLATMEM
-#define pfn_valid(pfn)          ((pfn) < max_pfn)
-#endif
-
+#include <asm/page_64_types.h>
 
 #endif /* _ASM_X86_PAGE_64_H */
diff --git a/arch/x86/include/asm/page_64.h.rej b/arch/x86/include/asm/page_64.h.rej
new file mode 100644
index 00000000000..9b1807f1859
--- /dev/null
+++ b/arch/x86/include/asm/page_64.h.rej
@@ -0,0 +1,114 @@
+***************
+*** 1,105 ****
+  #ifndef _ASM_X86_PAGE_64_H
+  #define _ASM_X86_PAGE_64_H
+  
+- #define PAGETABLE_LEVELS      4
+- 
+- #define THREAD_ORDER  1
+- #define THREAD_SIZE  (PAGE_SIZE << THREAD_ORDER)
+- #define CURRENT_MASK (~(THREAD_SIZE - 1))
+- 
+- #define EXCEPTION_STACK_ORDER 0
+- #define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
+- 
+- #define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
+- #define DEBUG_STKSZ (PAGE_SIZE << DEBUG_STACK_ORDER)
+- 
+- #define IRQSTACK_ORDER 2
+- #define IRQSTACKSIZE (PAGE_SIZE << IRQSTACK_ORDER)
+- 
+- #define STACKFAULT_STACK 1
+- #define DOUBLEFAULT_STACK 2
+- #define NMI_STACK 3
+- #define DEBUG_STACK 4
+- #define MCE_STACK 5
+- #define N_EXCEPTION_STACKS 5  /* hw limit: 7 */
+- 
+- #define PUD_PAGE_SIZE         (_AC(1, UL) << PUD_SHIFT)
+- #define PUD_PAGE_MASK         (~(PUD_PAGE_SIZE-1))
+- 
+- /*
+-  * Set __PAGE_OFFSET to the most negative possible address +
+-  * PGDIR_SIZE*16 (pgd slot 272).  The gap is to allow a space for a
+-  * hypervisor to fit.  Choosing 16 slots here is arbitrary, but it's
+-  * what Xen requires.
+-  */
+- #define __PAGE_OFFSET           _AC(0xffff880000000000, UL)
+- 
+- #define __PHYSICAL_START      CONFIG_PHYSICAL_START
+- #define __KERNEL_ALIGN                0x200000
+- 
+- /*
+-  * Make sure kernel is aligned to 2MB address. Catching it at compile
+-  * time is better. Change your config file and compile the kernel
+-  * for a 2MB aligned address (CONFIG_PHYSICAL_START)
+-  */
+- #if (CONFIG_PHYSICAL_START % __KERNEL_ALIGN) != 0
+- #error "CONFIG_PHYSICAL_START must be a multiple of 2MB"
+- #endif
+- 
+- #define __START_KERNEL                (__START_KERNEL_map + __PHYSICAL_START)
+- #define __START_KERNEL_map    _AC(0xffffffff80000000, UL)
+- 
+- /* See Documentation/x86_64/mm.txt for a description of the memory map. */
+- #define __PHYSICAL_MASK_SHIFT 46
+- #define __VIRTUAL_MASK_SHIFT  48
+- 
+- /*
+-  * Kernel image size is limited to 512 MB (see level2_kernel_pgt in
+-  * arch/x86/kernel/head_64.S), and it is mapped here:
+-  */
+- #define KERNEL_IMAGE_SIZE     (512 * 1024 * 1024)
+- #define KERNEL_IMAGE_START    _AC(0xffffffff80000000, UL)
+- 
+- #ifndef __ASSEMBLY__
+- void clear_page(void *page);
+- void copy_page(void *to, void *from);
+- 
+- /* duplicated to the one in bootmem.h */
+- extern unsigned long max_pfn;
+- extern unsigned long phys_base;
+- 
+- extern unsigned long __phys_addr(unsigned long);
+- #define __phys_reloc_hide(x)  (x)
+- 
+- /*
+-  * These are used to make use of C type-checking..
+-  */
+- typedef unsigned long pteval_t;
+- typedef unsigned long pmdval_t;
+- typedef unsigned long pudval_t;
+- typedef unsigned long pgdval_t;
+- typedef unsigned long pgprotval_t;
+- 
+- typedef struct page *pgtable_t;
+- 
+- typedef struct { pteval_t pte; } pte_t;
+- 
+- #define vmemmap ((struct page *)VMEMMAP_START)
+- 
+- extern unsigned long init_memory_mapping(unsigned long start,
+-                                        unsigned long end);
+- 
+- extern void initmem_init(unsigned long start_pfn, unsigned long end_pfn);
+- extern void free_initmem(void);
+- 
+- extern void init_extra_mapping_uc(unsigned long phys, unsigned long size);
+- extern void init_extra_mapping_wb(unsigned long phys, unsigned long size);
+- 
+- #endif        /* !__ASSEMBLY__ */
+- 
+- #ifdef CONFIG_FLATMEM
+- #define pfn_valid(pfn)          ((pfn) < max_pfn)
+- #endif
+- 
+  
+  #endif /* _ASM_X86_PAGE_64_H */
+--- 1,6 ----
+  #ifndef _ASM_X86_PAGE_64_H
+  #define _ASM_X86_PAGE_64_H
+  
++ #include <asm/page_64_types.h>
+  
+  #endif /* _ASM_X86_PAGE_64_H */
diff --git a/arch/x86/include/asm/page_64_types.h b/arch/x86/include/asm/page_64_types.h
new file mode 100644
index 00000000000..bc73af3eda9
--- /dev/null
+++ b/arch/x86/include/asm/page_64_types.h
@@ -0,0 +1,91 @@
+#ifndef _ASM_X86_PAGE_64_DEFS_H
+#define _ASM_X86_PAGE_64_DEFS_H
+
+#define PAGETABLE_LEVELS        4
+
+#define THREAD_ORDER    1
+#define THREAD_SIZE  (PAGE_SIZE << THREAD_ORDER)
+#define CURRENT_MASK (~(THREAD_SIZE - 1))
+
+#define EXCEPTION_STACK_ORDER 0
+#define EXCEPTION_STKSZ (PAGE_SIZE << EXCEPTION_STACK_ORDER)
+
+#define DEBUG_STACK_ORDER (EXCEPTION_STACK_ORDER + 1)
+#define DEBUG_STKSZ (PAGE_SIZE << DEBUG_STACK_ORDER)
+
+#define IRQ_STACK_ORDER 2
+#define IRQ_STACK_SIZE (PAGE_SIZE << IRQ_STACK_ORDER)
+
+#define STACKFAULT_STACK 1
+#define DOUBLEFAULT_STACK 2
+#define NMI_STACK 3
+#define DEBUG_STACK 4
+#define MCE_STACK 5
+#define N_EXCEPTION_STACKS 5  /* hw limit: 7 */
+
+#define PUD_PAGE_SIZE           (_AC(1, UL) << PUD_SHIFT)
+#define PUD_PAGE_MASK           (~(PUD_PAGE_SIZE-1))
+
+/*
+ * Set __PAGE_OFFSET to the most negative possible address +
+ * PGDIR_SIZE*16 (pgd slot 272).  The gap is to allow a space for a
+ * hypervisor to fit.  Choosing 16 slots here is arbitrary, but it's
+ * what Xen requires.
+ */
+#define __PAGE_OFFSET           _AC(0xffff880000000000, UL)
+
+#define __PHYSICAL_START        CONFIG_PHYSICAL_START
+#define __KERNEL_ALIGN          0x200000
+
+/*
+ * Make sure kernel is aligned to 2MB address. Catching it at compile
+ * time is better. Change your config file and compile the kernel
+ * for a 2MB aligned address (CONFIG_PHYSICAL_START)
+ */
+#if (CONFIG_PHYSICAL_START % __KERNEL_ALIGN) != 0
+#error "CONFIG_PHYSICAL_START must be a multiple of 2MB"
+#endif
+
+#define __START_KERNEL          (__START_KERNEL_map + __PHYSICAL_START)
+#define __START_KERNEL_map      _AC(0xffffffff80000000, UL)
+
+/* See Documentation/x86_64/mm.txt for a description of the memory map. */
+#define __PHYSICAL_MASK_SHIFT   46
+#define __VIRTUAL_MASK_SHIFT    48
+
+/*
+ * Kernel image size is limited to 512 MB (see level2_kernel_pgt in
+ * arch/x86/kernel/head_64.S), and it is mapped here:
+ */
+#define KERNEL_IMAGE_SIZE       (512 * 1024 * 1024)
+#define KERNEL_IMAGE_START      _AC(0xffffffff80000000, UL)
+
+#ifndef __ASSEMBLY__
+void clear_page(void *page);
+void copy_page(void *to, void *from);
+
+/* duplicated to the one in bootmem.h */
+extern unsigned long max_pfn;
+extern unsigned long phys_base;
+
+extern unsigned long __phys_addr(unsigned long);
+#define __phys_reloc_hide(x)    (x)
+
+#define vmemmap ((struct page *)VMEMMAP_START)
+
+extern unsigned long init_memory_mapping(unsigned long start,
+                                         unsigned long end);
+
+extern void initmem_init(unsigned long start_pfn, unsigned long end_pfn);
+extern void free_initmem(void);
+
+extern void init_extra_mapping_uc(unsigned long phys, unsigned long size);
+extern void init_extra_mapping_wb(unsigned long phys, unsigned long size);
+
+#endif  /* !__ASSEMBLY__ */
+
+#ifdef CONFIG_FLATMEM
+#define pfn_valid(pfn)          ((pfn) < max_pfn)
+#endif
+
+#endif /* _ASM_X86_PAGE_64_DEFS_H */
diff --git a/arch/x86/include/asm/page_types.h b/arch/x86/include/asm/page_types.h
new file mode 100644
index 00000000000..2c52ff76758
--- /dev/null
+++ b/arch/x86/include/asm/page_types.h
@@ -0,0 +1,63 @@
+#ifndef _ASM_X86_PAGE_DEFS_H
+#define _ASM_X86_PAGE_DEFS_H
+
+#include <linux/const.h>
+
+/* PAGE_SHIFT determines the page size */
+#define PAGE_SHIFT      12
+#define PAGE_SIZE       (_AC(1,UL) << PAGE_SHIFT)
+#define PAGE_MASK       (~(PAGE_SIZE-1))
+
+#define __PHYSICAL_MASK         ((phys_addr_t)(1ULL << __PHYSICAL_MASK_SHIFT) - 1)
+#define __VIRTUAL_MASK          ((1UL << __VIRTUAL_MASK_SHIFT) - 1)
+
+/* Cast PAGE_MASK to a signed type so that it is sign-extended if
+   virtual addresses are 32-bits but physical addresses are larger
+   (ie, 32-bit PAE). */
+#define PHYSICAL_PAGE_MASK      (((signed long)PAGE_MASK) & __PHYSICAL_MASK)
+
+/* PTE_PFN_MASK extracts the PFN from a (pte|pmd|pud|pgd)val_t */
+#define PTE_PFN_MASK            ((pteval_t)PHYSICAL_PAGE_MASK)
+
+/* PTE_FLAGS_MASK extracts the flags from a (pte|pmd|pud|pgd)val_t */
+#define PTE_FLAGS_MASK          (~PTE_PFN_MASK)
+
+#define PMD_PAGE_SIZE           (_AC(1, UL) << PMD_SHIFT)
+#define PMD_PAGE_MASK           (~(PMD_PAGE_SIZE-1))
+
+#define HPAGE_SHIFT             PMD_SHIFT
+#define HPAGE_SIZE              (_AC(1,UL) << HPAGE_SHIFT)
+#define HPAGE_MASK              (~(HPAGE_SIZE - 1))
+#define HUGETLB_PAGE_ORDER      (HPAGE_SHIFT - PAGE_SHIFT)
+
+#define HUGE_MAX_HSTATE 2
+
+#define PAGE_OFFSET             ((unsigned long)__PAGE_OFFSET)
+
+#define VM_DATA_DEFAULT_FLAGS \
+        (((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0 ) | \
+         VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+
+#ifdef CONFIG_X86_64
+#include <asm/page_64_types.h>
+#else
+#include <asm/page_32_types.h>
+#endif  /* CONFIG_X86_64 */
+
+#ifndef __ASSEMBLY__
+
+struct pgprot;
+
+extern int page_is_ram(unsigned long pagenr);
+extern int devmem_is_allowed(unsigned long pagenr);
+extern void map_devmem(unsigned long pfn, unsigned long size,
+                       struct pgprot vma_prot);
+extern void unmap_devmem(unsigned long pfn, unsigned long size,
+                         struct pgprot vma_prot);
+
+extern unsigned long max_low_pfn_mapped;
+extern unsigned long max_pfn_mapped;
+
+#endif  /* !__ASSEMBLY__ */
+
+#endif  /* _ASM_X86_PAGE_DEFS_H */
diff --git a/arch/x86/include/asm/paravirt.h b/arch/x86/include/asm/paravirt.h
index ba3e2ff6aed..0617d5cc971 100644
--- a/arch/x86/include/asm/paravirt.h
+++ b/arch/x86/include/asm/paravirt.h
@@ -4,7 +4,7 @@
  * para-virtualization: those hooks are defined here. */
 
 #ifdef CONFIG_PARAVIRT
-#include <asm/page.h>
+#include <asm/pgtable_types.h>
 #include <asm/asm.h>
 
 /* Bitmask of what can be clobbered: usually at least eax. */
@@ -12,21 +12,38 @@
 #define CLBR_EAX  (1 << 0)
 #define CLBR_ECX  (1 << 1)
 #define CLBR_EDX  (1 << 2)
+#define CLBR_EDI  (1 << 3)
 
-#ifdef CONFIG_X86_64
-#define CLBR_RSI  (1 << 3)
-#define CLBR_RDI  (1 << 4)
+#ifdef CONFIG_X86_32
+/* CLBR_ANY should match all regs platform has. For i386, that's just it */
+#define CLBR_ANY  ((1 << 4) - 1)
+
+#define CLBR_ARG_REGS   (CLBR_EAX | CLBR_EDX | CLBR_ECX)
+#define CLBR_RET_REG    (CLBR_EAX | CLBR_EDX)
+#define CLBR_SCRATCH    (0)
+#else
+#define CLBR_RAX  CLBR_EAX
+#define CLBR_RCX  CLBR_ECX
+#define CLBR_RDX  CLBR_EDX
+#define CLBR_RDI  CLBR_EDI
+#define CLBR_RSI  (1 << 4)
 #define CLBR_R8   (1 << 5)
 #define CLBR_R9   (1 << 6)
 #define CLBR_R10  (1 << 7)
 #define CLBR_R11  (1 << 8)
+
 #define CLBR_ANY  ((1 << 9) - 1)
+
+#define CLBR_ARG_REGS   (CLBR_RDI | CLBR_RSI | CLBR_RDX | \
+                         CLBR_RCX | CLBR_R8 | CLBR_R9)
+#define CLBR_RET_REG    (CLBR_RAX)
+#define CLBR_SCRATCH    (CLBR_R10 | CLBR_R11)
+
 #include <asm/desc_defs.h>
-#else
-/* CLBR_ANY should match all regs platform has. For i386, that's just it */
-#define CLBR_ANY  ((1 << 3) - 1)
 #endif /* X86_64 */
 
+#define CLBR_CALLEE_SAVE ((CLBR_ARG_REGS | CLBR_SCRATCH) & ~CLBR_RET_REG)
+
 #ifndef __ASSEMBLY__
 #include <linux/types.h>
 #include <linux/cpumask.h>
@@ -40,6 +57,14 @@ struct tss_struct;
 struct mm_struct;
 struct desc_struct;
 
+/*
+ * Wrapper type for pointers to code which uses the non-standard
+ * calling convention.  See PV_CALL_SAVE_REGS_THUNK below.
+ */
+struct paravirt_callee_save {
+        void *func;
+};
+
 /* general info */
 struct pv_info {
         unsigned int kernel_rpl;
@@ -189,11 +214,15 @@ struct pv_irq_ops {
          * expected to use X86_EFLAGS_IF; all other bits
          * returned from save_fl are undefined, and may be ignored by
          * restore_fl.
+         *
+         * NOTE: These functions callers expect the callee to preserve
+         * more registers than the standard C calling convention.
          */
-        unsigned long (*save_fl)(void);
-        void (*restore_fl)(unsigned long);
-        void (*irq_disable)(void);
-        void (*irq_enable)(void);
+        struct paravirt_callee_save save_fl;
+        struct paravirt_callee_save restore_fl;
+        struct paravirt_callee_save irq_disable;
+        struct paravirt_callee_save irq_enable;
+
         void (*safe_halt)(void);
         void (*halt)(void);
 
@@ -244,7 +273,8 @@ struct pv_mmu_ops {
         void (*flush_tlb_user)(void);
         void (*flush_tlb_kernel)(void);
         void (*flush_tlb_single)(unsigned long addr);
-        void (*flush_tlb_others)(const cpumask_t *cpus, struct mm_struct *mm,
+        void (*flush_tlb_others)(const struct cpumask *cpus,
+                                 struct mm_struct *mm,
                                  unsigned long va);
 
         /* Hooks for allocating and freeing a pagetable top-level */
@@ -278,12 +308,11 @@ struct pv_mmu_ops {
         void (*ptep_modify_prot_commit)(struct mm_struct *mm, unsigned long addr,
                                         pte_t *ptep, pte_t pte);
 
-        pteval_t (*pte_val)(pte_t);
-        pteval_t (*pte_flags)(pte_t);
-        pte_t (*make_pte)(pteval_t pte);
+        struct paravirt_callee_save pte_val;
+        struct paravirt_callee_save make_pte;
 
-        pgdval_t (*pgd_val)(pgd_t);
-        pgd_t (*make_pgd)(pgdval_t pgd);
+        struct paravirt_callee_save pgd_val;
+        struct paravirt_callee_save make_pgd;
 
 #if PAGETABLE_LEVELS >= 3
 #ifdef CONFIG_X86_PAE
@@ -298,12 +327,12 @@ struct pv_mmu_ops {
 
         void (*set_pud)(pud_t *pudp, pud_t pudval);
 
-        pmdval_t (*pmd_val)(pmd_t);
-        pmd_t (*make_pmd)(pmdval_t pmd);
+        struct paravirt_callee_save pmd_val;
+        struct paravirt_callee_save make_pmd;
 
 #if PAGETABLE_LEVELS == 4
-        pudval_t (*pud_val)(pud_t);
-        pud_t (*make_pud)(pudval_t pud);
+        struct paravirt_callee_save pud_val;
+        struct paravirt_callee_save make_pud;
 
         void (*set_pgd)(pgd_t *pudp, pgd_t pgdval);
 #endif  /* PAGETABLE_LEVELS == 4 */
@@ -388,6 +417,8 @@ extern struct pv_lock_ops pv_lock_ops;
         asm("start_" #ops "_" #name ": " code "; end_" #ops "_" #name ":")
 
 unsigned paravirt_patch_nop(void);
+unsigned paravirt_patch_ident_32(void *insnbuf, unsigned len);
+unsigned paravirt_patch_ident_64(void *insnbuf, unsigned len);
 unsigned paravirt_patch_ignore(unsigned len);
 unsigned paravirt_patch_call(void *insnbuf,
                              const void *target, u16 tgt_clobbers,
@@ -479,25 +510,45 @@ int paravirt_disable_iospace(void);
  * makes sure the incoming and outgoing types are always correct.
  */
 #ifdef CONFIG_X86_32
-#define PVOP_VCALL_ARGS                 unsigned long __eax, __edx, __ecx
+#define PVOP_VCALL_ARGS                         \
+        unsigned long __eax = __eax, __edx = __edx, __ecx = __ecx
 #define PVOP_CALL_ARGS                  PVOP_VCALL_ARGS
+
+#define PVOP_CALL_ARG1(x)               "a" ((unsigned long)(x))
+#define PVOP_CALL_ARG2(x)               "d" ((unsigned long)(x))
+#define PVOP_CALL_ARG3(x)               "c" ((unsigned long)(x))
+
 #define PVOP_VCALL_CLOBBERS             "=a" (__eax), "=d" (__edx),     \
                                         "=c" (__ecx)
 #define PVOP_CALL_CLOBBERS              PVOP_VCALL_CLOBBERS
+
+#define PVOP_VCALLEE_CLOBBERS           "=a" (__eax), "=d" (__edx)
+#define PVOP_CALLEE_CLOBBERS            PVOP_VCALLEE_CLOBBERS
+
 #define EXTRA_CLOBBERS
 #define VEXTRA_CLOBBERS
-#else
-#define PVOP_VCALL_ARGS         unsigned long __edi, __esi, __edx, __ecx
+#else  /* CONFIG_X86_64 */
+#define PVOP_VCALL_ARGS                                 \
+        unsigned long __edi = __edi, __esi = __esi,     \
+                __edx = __edx, __ecx = __ecx
 #define PVOP_CALL_ARGS          PVOP_VCALL_ARGS, __eax
+
+#define PVOP_CALL_ARG1(x)               "D" ((unsigned long)(x))
+#define PVOP_CALL_ARG2(x)               "S" ((unsigned long)(x))
+#define PVOP_CALL_ARG3(x)               "d" ((unsigned long)(x))
+#define PVOP_CALL_ARG4(x)               "c" ((unsigned long)(x))
+
 #define PVOP_VCALL_CLOBBERS     "=D" (__edi),                           \
                                 "=S" (__esi), "=d" (__edx),             \
                                 "=c" (__ecx)
-
 #define PVOP_CALL_CLOBBERS      PVOP_VCALL_CLOBBERS, "=a" (__eax)
 
+#define PVOP_VCALLEE_CLOBBERS   "=a" (__eax)
+#define PVOP_CALLEE_CLOBBERS    PVOP_VCALLEE_CLOBBERS
+
 #define EXTRA_CLOBBERS   , "r8", "r9", "r10", "r11"
 #define VEXTRA_CLOBBERS  , "rax", "r8", "r9", "r10", "r11"
-#endif
+#endif  /* CONFIG_X86_32 */
 
 #ifdef CONFIG_PARAVIRT_DEBUG
 #define PVOP_TEST_NULL(op)      BUG_ON(op == NULL)
@@ -505,10 +556,11 @@ int paravirt_disable_iospace(void);
 #define PVOP_TEST_NULL(op)      ((void)op)
 #endif
 
-#define __PVOP_CALL(rettype, op, pre, post, ...)                        \
+#define ____PVOP_CALL(rettype, op, clbr, call_clbr, extra_clbr,         \
+                      pre, post, ...)                                   \
         ({                                                              \
                 rettype __ret;                                          \
-                PVOP_CALL_ARGS;                                 \
+                PVOP_CALL_ARGS;                                         \
                 PVOP_TEST_NULL(op);                                     \
                 /* This is 32-bit specific, but is okay in 64-bit */    \
                 /* since this condition will never hold */              \
@@ -516,70 +568,113 @@ int paravirt_disable_iospace(void);
                         asm volatile(pre                                \
                                      paravirt_alt(PARAVIRT_CALL)        \
                                      post                               \
-                                     : PVOP_CALL_CLOBBERS               \
+                                     : call_clbr                        \
                                      : paravirt_type(op),               \
-                                       paravirt_clobber(CLBR_ANY),      \
+                                       paravirt_clobber(clbr),          \
                                        ##__VA_ARGS__                    \
-                                     : "memory", "cc" EXTRA_CLOBBERS);  \
+                                     : "memory", "cc" extra_clbr);      \
                         __ret = (rettype)((((u64)__edx) << 32) | __eax); \
                 } else {                                                \
                         asm volatile(pre                                \
                                      paravirt_alt(PARAVIRT_CALL)        \
                                      post                               \
-                                     : PVOP_CALL_CLOBBERS               \
+                                     : call_clbr                        \
                                      : paravirt_type(op),               \
-                                       paravirt_clobber(CLBR_ANY),      \
+                                       paravirt_clobber(clbr),          \
                                        ##__VA_ARGS__                    \
-                                     : "memory", "cc" EXTRA_CLOBBERS);  \
+                                     : "memory", "cc" extra_clbr);      \
                         __ret = (rettype)__eax;                         \
                 }                                                       \
                 __ret;                                                  \
         })
-#define __PVOP_VCALL(op, pre, post, ...)                                \
+
+#define __PVOP_CALL(rettype, op, pre, post, ...)                        \
+        ____PVOP_CALL(rettype, op, CLBR_ANY, PVOP_CALL_CLOBBERS,        \
+                      EXTRA_CLOBBERS, pre, post, ##__VA_ARGS__)
+
+#define __PVOP_CALLEESAVE(rettype, op, pre, post, ...)                  \
+        ____PVOP_CALL(rettype, op.func, CLBR_RET_REG,                   \
+                      PVOP_CALLEE_CLOBBERS, ,                           \
+                      pre, post, ##__VA_ARGS__)
+
+
+#define ____PVOP_VCALL(op, clbr, call_clbr, extra_clbr, pre, post, ...) \
         ({                                                              \
                 PVOP_VCALL_ARGS;                                        \
                 PVOP_TEST_NULL(op);                                     \
                 asm volatile(pre                                        \
                              paravirt_alt(PARAVIRT_CALL)                \
                              post                                       \
-                             : PVOP_VCALL_CLOBBERS                      \
+                             : call_clbr                                \
                              : paravirt_type(op),                       \
-                               paravirt_clobber(CLBR_ANY),              \
+                               paravirt_clobber(clbr),                  \
                                ##__VA_ARGS__                            \
-                             : "memory", "cc" VEXTRA_CLOBBERS);         \
+                             : "memory", "cc" extra_clbr);              \
         })
 
+#define __PVOP_VCALL(op, pre, post, ...)                                \
+        ____PVOP_VCALL(op, CLBR_ANY, PVOP_VCALL_CLOBBERS,               \
+                       VEXTRA_CLOBBERS,                                 \
+                       pre, post, ##__VA_ARGS__)
+
+#define __PVOP_VCALLEESAVE(rettype, op, pre, post, ...)                 \
+        ____PVOP_CALL(rettype, op.func, CLBR_RET_REG,                   \
+                      PVOP_VCALLEE_CLOBBERS, ,                          \
+                      pre, post, ##__VA_ARGS__)
+
+
+
 #define PVOP_CALL0(rettype, op)                                         \
         __PVOP_CALL(rettype, op, "", "")
 #define PVOP_VCALL0(op)                                                 \
         __PVOP_VCALL(op, "", "")
 
+#define PVOP_CALLEE0(rettype, op)                                       \
+        __PVOP_CALLEESAVE(rettype, op, "", "")
+#define PVOP_VCALLEE0(op)                                               \
+        __PVOP_VCALLEESAVE(op, "", "")
+
+
 #define PVOP_CALL1(rettype, op, arg1)                                   \
-        __PVOP_CALL(rettype, op, "", "", "0" ((unsigned long)(arg1)))
+        __PVOP_CALL(rettype, op, "", "", PVOP_CALL_ARG1(arg1))
 #define PVOP_VCALL1(op, arg1)                                           \
-        __PVOP_VCALL(op, "", "", "0" ((unsigned long)(arg1)))
+        __PVOP_VCALL(op, "", "", PVOP_CALL_ARG1(arg1))
+
+#define PVOP_CALLEE1(rettype, op, arg1)                                 \
+        __PVOP_CALLEESAVE(rettype, op, "", "", PVOP_CALL_ARG1(arg1))
+#define PVOP_VCALLEE1(op, arg1)                                         \
+        __PVOP_VCALLEESAVE(op, "", "", PVOP_CALL_ARG1(arg1))
+
 
 #define PVOP_CALL2(rettype, op, arg1, arg2)                             \
-        __PVOP_CALL(rettype, op, "", "", "0" ((unsigned long)(arg1)),   \
-        "1" ((unsigned long)(arg2)))
+        __PVOP_CALL(rettype, op, "", "", PVOP_CALL_ARG1(arg1),          \
+                    PVOP_CALL_ARG2(arg2))
 #define PVOP_VCALL2(op, arg1, arg2)                                     \
-        __PVOP_VCALL(op, "", "", "0" ((unsigned long)(arg1)),           \
-        "1" ((unsigned long)(arg2)))
+        __PVOP_VCALL(op, "", "", PVOP_CALL_ARG1(arg1),                  \
+                     PVOP_CALL_ARG2(arg2))
+
+#define PVOP_CALLEE2(rettype, op, arg1, arg2)                           \
+        __PVOP_CALLEESAVE(rettype, op, "", "", PVOP_CALL_ARG1(arg1),    \
+                          PVOP_CALL_ARG2(arg2))
+#define PVOP_VCALLEE2(op, arg1, arg2)                                   \
+        __PVOP_VCALLEESAVE(op, "", "", PVOP_CALL_ARG1(arg1),            \
+                           PVOP_CALL_ARG2(arg2))
+
 
 #define PVOP_CALL3(rettype, op, arg1, arg2, arg3)                       \
-        __PVOP_CALL(rettype, op, "", "", "0" ((unsigned long)(arg1)),   \
-        "1"((unsigned long)(arg2)), "2"((unsigned long)(arg3)))
+        __PVOP_CALL(rettype, op, "", "", PVOP_CALL_ARG1(arg1),          \
+                    PVOP_CALL_ARG2(arg2), PVOP_CALL_ARG3(arg3))
 #define PVOP_VCALL3(op, arg1, arg2, arg3)                               \
-        __PVOP_VCALL(op, "", "", "0" ((unsigned long)(arg1)),           \
-        "1"((unsigned long)(arg2)), "2"((unsigned long)(arg3)))
+        __PVOP_VCALL(op, "", "", PVOP_CALL_ARG1(arg1),                  \
+                     PVOP_CALL_ARG2(arg2), PVOP_CALL_ARG3(arg3))
 
 /* This is the only difference in x86_64. We can make it much simpler */
 #ifdef CONFIG_X86_32
 #define PVOP_CALL4(rettype, op, arg1, arg2, arg3, arg4)                 \
         __PVOP_CALL(rettype, op,                                        \
                     "push %[_arg4];", "lea 4(%%esp),%%esp;",            \
-                    "0" ((u32)(arg1)), "1" ((u32)(arg2)),               \
-                    "2" ((u32)(arg3)), [_arg4] "mr" ((u32)(arg4)))
+                    PVOP_CALL_ARG1(arg1), PVOP_CALL_ARG2(arg2),         \
+                    PVOP_CALL_ARG3(arg3), [_arg4] "mr" ((u32)(arg4)))
 #define PVOP_VCALL4(op, arg1, arg2, arg3, arg4)                         \
         __PVOP_VCALL(op,                                                \
                     "push %[_arg4];", "lea 4(%%esp),%%esp;",            \
@@ -587,13 +682,13 @@ int paravirt_disable_iospace(void);
                     "2" ((u32)(arg3)), [_arg4] "mr" ((u32)(arg4)))
 #else
 #define PVOP_CALL4(rettype, op, arg1, arg2, arg3, arg4)                 \
-        __PVOP_CALL(rettype, op, "", "", "0" ((unsigned long)(arg1)),   \
-        "1"((unsigned long)(arg2)), "2"((unsigned long)(arg3)),         \
-        "3"((unsigned long)(arg4)))
+        __PVOP_CALL(rettype, op, "", "",                                \
+                    PVOP_CALL_ARG1(arg1), PVOP_CALL_ARG2(arg2),         \
+                    PVOP_CALL_ARG3(arg3), PVOP_CALL_ARG4(arg4))
 #define PVOP_VCALL4(op, arg1, arg2, arg3, arg4)                         \
-        __PVOP_VCALL(op, "", "", "0" ((unsigned long)(arg1)),           \
-        "1"((unsigned long)(arg2)), "2"((unsigned long)(arg3)),         \
-        "3"((unsigned long)(arg4)))
+        __PVOP_VCALL(op, "", "",                                        \
+                     PVOP_CALL_ARG1(arg1), PVOP_CALL_ARG2(arg2),        \
+                     PVOP_CALL_ARG3(arg3), PVOP_CALL_ARG4(arg4))
 #endif
 
 static inline int paravirt_enabled(void)
@@ -984,10 +1079,11 @@ static inline void __flush_tlb_single(unsigned long addr)
         PVOP_VCALL1(pv_mmu_ops.flush_tlb_single, addr);
 }
 
-static inline void flush_tlb_others(cpumask_t cpumask, struct mm_struct *mm,
+static inline void flush_tlb_others(const struct cpumask *cpumask,
+                                    struct mm_struct *mm,
                                     unsigned long va)
 {
-        PVOP_VCALL3(pv_mmu_ops.flush_tlb_others, &cpumask, mm, va);
+        PVOP_VCALL3(pv_mmu_ops.flush_tlb_others, cpumask, mm, va);
 }
 
 static inline int paravirt_pgd_alloc(struct mm_struct *mm)
@@ -1059,13 +1155,13 @@ static inline pte_t __pte(pteval_t val)
         pteval_t ret;
 
         if (sizeof(pteval_t) > sizeof(long))
-                ret = PVOP_CALL2(pteval_t,
-                                 pv_mmu_ops.make_pte,
-                                 val, (u64)val >> 32);
+                ret = PVOP_CALLEE2(pteval_t,
+                                   pv_mmu_ops.make_pte,
+                                   val, (u64)val >> 32);
         else
-                ret = PVOP_CALL1(pteval_t,
-                                 pv_mmu_ops.make_pte,
-                                 val);
+                ret = PVOP_CALLEE1(pteval_t,
+                                   pv_mmu_ops.make_pte,
+                                   val);
 
         return (pte_t) { .pte = ret };
 }
@@ -1075,29 +1171,12 @@ static inline pteval_t pte_val(pte_t pte)
         pteval_t ret;
 
         if (sizeof(pteval_t) > sizeof(long))
-                ret = PVOP_CALL2(pteval_t, pv_mmu_ops.pte_val,
-                                 pte.pte, (u64)pte.pte >> 32);
-        else
-                ret = PVOP_CALL1(pteval_t, pv_mmu_ops.pte_val,
-                                 pte.pte);
-
-        return ret;
-}
-
-static inline pteval_t pte_flags(pte_t pte)
-{
-        pteval_t ret;
-
-        if (sizeof(pteval_t) > sizeof(long))
-                ret = PVOP_CALL2(pteval_t, pv_mmu_ops.pte_flags,
-                                 pte.pte, (u64)pte.pte >> 32);
+                ret = PVOP_CALLEE2(pteval_t, pv_mmu_ops.pte_val,
+                                   pte.pte, (u64)pte.pte >> 32);
         else
-                ret = PVOP_CALL1(pteval_t, pv_mmu_ops.pte_flags,
-                                 pte.pte);
+                ret = PVOP_CALLEE1(pteval_t, pv_mmu_ops.pte_val,
+                                   pte.pte);
 
-#ifdef CONFIG_PARAVIRT_DEBUG
-        BUG_ON(ret & PTE_PFN_MASK);
-#endif
         return ret;
 }
 
@@ -1106,11 +1185,11 @@ static inline pgd_t __pgd(pgdval_t val)
         pgdval_t ret;
 
         if (sizeof(pgdval_t) > sizeof(long))
-                ret = PVOP_CALL2(pgdval_t, pv_mmu_ops.make_pgd,
-                                 val, (u64)val >> 32);
+                ret = PVOP_CALLEE2(pgdval_t, pv_mmu_ops.make_pgd,
+                                   val, (u64)val >> 32);
         else
-                ret = PVOP_CALL1(pgdval_t, pv_mmu_ops.make_pgd,
-                                 val);
+                ret = PVOP_CALLEE1(pgdval_t, pv_mmu_ops.make_pgd,
+                                   val);
 
         return (pgd_t) { ret };
 }
@@ -1120,11 +1199,11 @@ static inline pgdval_t pgd_val(pgd_t pgd)
         pgdval_t ret;
 
         if (sizeof(pgdval_t) > sizeof(long))
-                ret =  PVOP_CALL2(pgdval_t, pv_mmu_ops.pgd_val,
-                                  pgd.pgd, (u64)pgd.pgd >> 32);
+                ret =  PVOP_CALLEE2(pgdval_t, pv_mmu_ops.pgd_val,
+                                    pgd.pgd, (u64)pgd.pgd >> 32);
         else
-                ret =  PVOP_CALL1(pgdval_t, pv_mmu_ops.pgd_val,
-                                  pgd.pgd);
+                ret =  PVOP_CALLEE1(pgdval_t, pv_mmu_ops.pgd_val,
+                                    pgd.pgd);
 
         return ret;
 }
@@ -1188,11 +1267,11 @@ static inline pmd_t __pmd(pmdval_t val)
         pmdval_t ret;
 
         if (sizeof(pmdval_t) > sizeof(long))
-                ret = PVOP_CALL2(pmdval_t, pv_mmu_ops.make_pmd,
-                                 val, (u64)val >> 32);
+                ret = PVOP_CALLEE2(pmdval_t, pv_mmu_ops.make_pmd,
+                                   val, (u64)val >> 32);
         else
-                ret = PVOP_CALL1(pmdval_t, pv_mmu_ops.make_pmd,
-                                 val);
+                ret = PVOP_CALLEE1(pmdval_t, pv_mmu_ops.make_pmd,
+                                   val);
 
         return (pmd_t) { ret };
 }
@@ -1202,11 +1281,11 @@ static inline pmdval_t pmd_val(pmd_t pmd)
         pmdval_t ret;
 
         if (sizeof(pmdval_t) > sizeof(long))
-                ret =  PVOP_CALL2(pmdval_t, pv_mmu_ops.pmd_val,
-                                  pmd.pmd, (u64)pmd.pmd >> 32);
+                ret =  PVOP_CALLEE2(pmdval_t, pv_mmu_ops.pmd_val,
+                                    pmd.pmd, (u64)pmd.pmd >> 32);
         else
-                ret =  PVOP_CALL1(pmdval_t, pv_mmu_ops.pmd_val,
-                                  pmd.pmd);
+                ret =  PVOP_CALLEE1(pmdval_t, pv_mmu_ops.pmd_val,
+                                    pmd.pmd);
 
         return ret;
 }
@@ -1228,11 +1307,11 @@ static inline pud_t __pud(pudval_t val)
         pudval_t ret;
 
         if (sizeof(pudval_t) > sizeof(long))
-                ret = PVOP_CALL2(pudval_t, pv_mmu_ops.make_pud,
-                                 val, (u64)val >> 32);
+                ret = PVOP_CALLEE2(pudval_t, pv_mmu_ops.make_pud,
+                                   val, (u64)val >> 32);
         else
-                ret = PVOP_CALL1(pudval_t, pv_mmu_ops.make_pud,
-                                 val);
+                ret = PVOP_CALLEE1(pudval_t, pv_mmu_ops.make_pud,
+                                   val);
 
         return (pud_t) { ret };
 }
@@ -1242,11 +1321,11 @@ static inline pudval_t pud_val(pud_t pud)
         pudval_t ret;
 
         if (sizeof(pudval_t) > sizeof(long))
-                ret =  PVOP_CALL2(pudval_t, pv_mmu_ops.pud_val,
-                                  pud.pud, (u64)pud.pud >> 32);
+                ret =  PVOP_CALLEE2(pudval_t, pv_mmu_ops.pud_val,
+                                    pud.pud, (u64)pud.pud >> 32);
         else
-                ret =  PVOP_CALL1(pudval_t, pv_mmu_ops.pud_val,
-                                  pud.pud);
+                ret =  PVOP_CALLEE1(pudval_t, pv_mmu_ops.pud_val,
+                                    pud.pud);
 
         return ret;
 }
@@ -1352,14 +1431,7 @@ static inline void arch_leave_lazy_cpu_mode(void)
         PVOP_VCALL0(pv_cpu_ops.lazy_mode.leave);
 }
 
-static inline void arch_flush_lazy_cpu_mode(void)
-{
-        if (unlikely(paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU)) {
-                arch_leave_lazy_cpu_mode();
-                arch_enter_lazy_cpu_mode();
-        }
-}
-
+void arch_flush_lazy_cpu_mode(void);
 
 #define  __HAVE_ARCH_ENTER_LAZY_MMU_MODE
 static inline void arch_enter_lazy_mmu_mode(void)
@@ -1372,13 +1444,7 @@ static inline void arch_leave_lazy_mmu_mode(void)
         PVOP_VCALL0(pv_mmu_ops.lazy_mode.leave);
 }
 
-static inline void arch_flush_lazy_mmu_mode(void)
-{
-        if (unlikely(paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU)) {
-                arch_leave_lazy_mmu_mode();
-                arch_enter_lazy_mmu_mode();
-        }
-}
+void arch_flush_lazy_mmu_mode(void);
 
 static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
                                 unsigned long phys, pgprot_t flags)
@@ -1387,9 +1453,10 @@ static inline void __set_fixmap(unsigned /* enum fixed_addresses */ idx,
 }
 
 void _paravirt_nop(void);
-#define paravirt_nop    ((void *)_paravirt_nop)
+u32 _paravirt_ident_32(u32);
+u64 _paravirt_ident_64(u64);
 
-void paravirt_use_bytelocks(void);
+#define paravirt_nop    ((void *)_paravirt_nop)
 
 #ifdef CONFIG_SMP
 
@@ -1402,6 +1469,7 @@ static inline int __raw_spin_is_contended(struct raw_spinlock *lock)
 {
         return PVOP_CALL1(int, pv_lock_ops.spin_is_contended, lock);
 }
+#define __raw_spin_is_contended __raw_spin_is_contended
 
 static __always_inline void __raw_spin_lock(struct raw_spinlock *lock)
 {
@@ -1438,12 +1506,37 @@ extern struct paravirt_patch_site __parainstructions[],
         __parainstructions_end[];
 
 #ifdef CONFIG_X86_32
-#define PV_SAVE_REGS "pushl %%ecx; pushl %%edx;"
-#define PV_RESTORE_REGS "popl %%edx; popl %%ecx"
+#define PV_SAVE_REGS "pushl %ecx; pushl %edx;"
+#define PV_RESTORE_REGS "popl %edx; popl %ecx;"
+
+/* save and restore all caller-save registers, except return value */
+#define PV_SAVE_ALL_CALLER_REGS         "pushl %ecx;"
+#define PV_RESTORE_ALL_CALLER_REGS      "popl  %ecx;"
+
 #define PV_FLAGS_ARG "0"
 #define PV_EXTRA_CLOBBERS
 #define PV_VEXTRA_CLOBBERS
 #else
+/* save and restore all caller-save registers, except return value */
+#define PV_SAVE_ALL_CALLER_REGS                                         \
+        "push %rcx;"                                                    \
+        "push %rdx;"                                                    \
+        "push %rsi;"                                                    \
+        "push %rdi;"                                                    \
+        "push %r8;"                                                     \
+        "push %r9;"                                                     \
+        "push %r10;"                                                    \
+        "push %r11;"
+#define PV_RESTORE_ALL_CALLER_REGS                                      \
+        "pop %r11;"                                                     \
+        "pop %r10;"                                                     \
+        "pop %r9;"                                                      \
+        "pop %r8;"                                                      \
+        "pop %rdi;"                                                     \
+        "pop %rsi;"                                                     \
+        "pop %rdx;"                                                     \
+        "pop %rcx;"
+
 /* We save some registers, but all of them, that's too much. We clobber all
  * caller saved registers but the argument parameter */
 #define PV_SAVE_REGS "pushq %%rdi;"
@@ -1453,52 +1546,76 @@ extern struct paravirt_patch_site __parainstructions[],
 #define PV_FLAGS_ARG "D"
 #endif
 
+/*
+ * Generate a thunk around a function which saves all caller-save
+ * registers except for the return value.  This allows C functions to
+ * be called from assembler code where fewer than normal registers are
+ * available.  It may also help code generation around calls from C
+ * code if the common case doesn't use many registers.
+ *
+ * When a callee is wrapped in a thunk, the caller can assume that all
+ * arg regs and all scratch registers are preserved across the
+ * call. The return value in rax/eax will not be saved, even for void
+ * functions.
+ */
+#define PV_CALLEE_SAVE_REGS_THUNK(func)                                 \
+        extern typeof(func) __raw_callee_save_##func;                   \
+        static void *__##func##__ __used = func;                        \
+                                                                        \
+        asm(".pushsection .text;"                                       \
+            "__raw_callee_save_" #func ": "                             \
+            PV_SAVE_ALL_CALLER_REGS                                     \
+            "call " #func ";"                                           \
+            PV_RESTORE_ALL_CALLER_REGS                                  \
+            "ret;"                                                      \
+            ".popsection")
+
+/* Get a reference to a callee-save function */
+#define PV_CALLEE_SAVE(func)                                            \
+        ((struct paravirt_callee_save) { __raw_callee_save_##func })
+
+/* Promise that "func" already uses the right calling convention */
+#define __PV_IS_CALLEE_SAVE(func)                       \
+        ((struct paravirt_callee_save) { func })
+
 static inline unsigned long __raw_local_save_flags(void)
 {
         unsigned long f;
 
-        asm volatile(paravirt_alt(PV_SAVE_REGS
-                                  PARAVIRT_CALL
-                                  PV_RESTORE_REGS)
+        asm volatile(paravirt_alt(PARAVIRT_CALL)
                      : "=a"(f)
                      : paravirt_type(pv_irq_ops.save_fl),
                        paravirt_clobber(CLBR_EAX)
-                     : "memory", "cc" PV_VEXTRA_CLOBBERS);
+                     : "memory", "cc");
         return f;
 }
 
 static inline void raw_local_irq_restore(unsigned long f)
 {
-        asm volatile(paravirt_alt(PV_SAVE_REGS
-                                  PARAVIRT_CALL
-                                  PV_RESTORE_REGS)
+        asm volatile(paravirt_alt(PARAVIRT_CALL)
                      : "=a"(f)
                      : PV_FLAGS_ARG(f),
                        paravirt_type(pv_irq_ops.restore_fl),
                        paravirt_clobber(CLBR_EAX)
-                     : "memory", "cc" PV_EXTRA_CLOBBERS);
+                     : "memory", "cc");
 }
 
 static inline void raw_local_irq_disable(void)
 {
-        asm volatile(paravirt_alt(PV_SAVE_REGS
-                                  PARAVIRT_CALL
-                                  PV_RESTORE_REGS)
+        asm volatile(paravirt_alt(PARAVIRT_CALL)
                      :
                      : paravirt_type(pv_irq_ops.irq_disable),
                        paravirt_clobber(CLBR_EAX)
-                     : "memory", "eax", "cc" PV_EXTRA_CLOBBERS);
+                     : "memory", "eax", "cc");
 }
 
 static inline void raw_local_irq_enable(void)
 {
-        asm volatile(paravirt_alt(PV_SAVE_REGS
-                                  PARAVIRT_CALL
-                                  PV_RESTORE_REGS)
+        asm volatile(paravirt_alt(PARAVIRT_CALL)
                      :
                      : paravirt_type(pv_irq_ops.irq_enable),
                        paravirt_clobber(CLBR_EAX)
-                     : "memory", "eax", "cc" PV_EXTRA_CLOBBERS);
+                     : "memory", "eax", "cc");
 }
 
 static inline unsigned long __raw_local_irq_save(void)
@@ -1541,33 +1658,49 @@ static inline unsigned long __raw_local_irq_save(void)
         .popsection
 
 
+#define COND_PUSH(set, mask, reg)                       \
+        .if ((~(set)) & mask); push %reg; .endif
+#define COND_POP(set, mask, reg)                        \
+        .if ((~(set)) & mask); pop %reg; .endif
+
 #ifdef CONFIG_X86_64
-#define PV_SAVE_REGS                            \
-        push %rax;                              \
-        push %rcx;                              \
-        push %rdx;                              \
-        push %rsi;                              \
-        push %rdi;                              \
-        push %r8;                               \
-        push %r9;                               \
-        push %r10;                              \
-        push %r11
-#define PV_RESTORE_REGS                         \
-        pop %r11;                               \
-        pop %r10;                               \
-        pop %r9;                                \
-        pop %r8;                                \
-        pop %rdi;                               \
-        pop %rsi;                               \
-        pop %rdx;                               \
-        pop %rcx;                               \
-        pop %rax
+
+#define PV_SAVE_REGS(set)                       \
+        COND_PUSH(set, CLBR_RAX, rax);          \
+        COND_PUSH(set, CLBR_RCX, rcx);          \
+        COND_PUSH(set, CLBR_RDX, rdx);          \
+        COND_PUSH(set, CLBR_RSI, rsi);          \
+        COND_PUSH(set, CLBR_RDI, rdi);          \
+        COND_PUSH(set, CLBR_R8, r8);            \
+        COND_PUSH(set, CLBR_R9, r9);            \
+        COND_PUSH(set, CLBR_R10, r10);          \
+        COND_PUSH(set, CLBR_R11, r11)
+#define PV_RESTORE_REGS(set)                    \
+        COND_POP(set, CLBR_R11, r11);           \
+        COND_POP(set, CLBR_R10, r10);           \
+        COND_POP(set, CLBR_R9, r9);             \
+        COND_POP(set, CLBR_R8, r8);             \
+        COND_POP(set, CLBR_RDI, rdi);           \
+        COND_POP(set, CLBR_RSI, rsi);           \
+        COND_POP(set, CLBR_RDX, rdx);           \
+        COND_POP(set, CLBR_RCX, rcx);           \
+        COND_POP(set, CLBR_RAX, rax)
+
 #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 8)
 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .quad, 8)
 #define PARA_INDIRECT(addr)     *addr(%rip)
 #else
-#define PV_SAVE_REGS   pushl %eax; pushl %edi; pushl %ecx; pushl %edx
-#define PV_RESTORE_REGS popl %edx; popl %ecx; popl %edi; popl %eax
+#define PV_SAVE_REGS(set)                       \
+        COND_PUSH(set, CLBR_EAX, eax);          \
+        COND_PUSH(set, CLBR_EDI, edi);          \
+        COND_PUSH(set, CLBR_ECX, ecx);          \
+        COND_PUSH(set, CLBR_EDX, edx)
+#define PV_RESTORE_REGS(set)                    \
+        COND_POP(set, CLBR_EDX, edx);           \
+        COND_POP(set, CLBR_ECX, ecx);           \
+        COND_POP(set, CLBR_EDI, edi);           \
+        COND_POP(set, CLBR_EAX, eax)
+
 #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
 #define PARA_INDIRECT(addr)     *%cs:addr
@@ -1579,15 +1712,15 @@ static inline unsigned long __raw_local_irq_save(void)
 
 #define DISABLE_INTERRUPTS(clobbers)                                    \
         PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_disable), clobbers, \
-                  PV_SAVE_REGS;                                         \
+                  PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE);            \
                   call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_disable);    \
-                  PV_RESTORE_REGS;)                     \
+                  PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
 
 #define ENABLE_INTERRUPTS(clobbers)                                     \
         PARA_SITE(PARA_PATCH(pv_irq_ops, PV_IRQ_irq_enable), clobbers,  \
-                  PV_SAVE_REGS;                                         \
+                  PV_SAVE_REGS(clobbers | CLBR_CALLEE_SAVE);            \
                   call PARA_INDIRECT(pv_irq_ops+PV_IRQ_irq_enable);     \
-                  PV_RESTORE_REGS;)
+                  PV_RESTORE_REGS(clobbers | CLBR_CALLEE_SAVE);)
 
 #define USERGS_SYSRET32                                                 \
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_usergs_sysret32),       \
@@ -1617,11 +1750,15 @@ static inline unsigned long __raw_local_irq_save(void)
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_swapgs), CLBR_NONE,     \
                   swapgs)
 
+/*
+ * Note: swapgs is very special, and in practise is either going to be
+ * implemented with a single "swapgs" instruction or something very
+ * special.  Either way, we don't need to save any registers for
+ * it.
+ */
 #define SWAPGS                                                          \
         PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_swapgs), CLBR_NONE,     \
-                  PV_SAVE_REGS;                                         \
-                  call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs);         \
-                  PV_RESTORE_REGS                                       \
+                  call PARA_INDIRECT(pv_cpu_ops+PV_CPU_swapgs)          \
                  )
 
 #define GET_CR2_INTO_RCX                                \
diff --git a/arch/x86/include/asm/pat.h b/arch/x86/include/asm/pat.h
index b8493b3b989..9709fdff661 100644
--- a/arch/x86/include/asm/pat.h
+++ b/arch/x86/include/asm/pat.h
@@ -5,10 +5,8 @@
 
 #ifdef CONFIG_X86_PAT
 extern int pat_enabled;
-extern void validate_pat_support(struct cpuinfo_x86 *c);
 #else
 static const int pat_enabled;
-static inline void validate_pat_support(struct cpuinfo_x86 *c) { }
 #endif
 
 extern void pat_init(void);
@@ -17,6 +15,4 @@ extern int reserve_memtype(u64 start, u64 end,
                 unsigned long req_type, unsigned long *ret_type);
 extern int free_memtype(u64 start, u64 end);
 
-extern void pat_disable(char *reason);
-
 #endif /* _ASM_X86_PAT_H */
diff --git a/arch/x86/include/asm/mach-default/pci-functions.h b/arch/x86/include/asm/pci-functions.h
index ed0bab42735..ed0bab42735 100644
--- a/arch/x86/include/asm/mach-default/pci-functions.h
+++ b/arch/x86/include/asm/pci-functions.h
diff --git a/arch/x86/include/asm/pda.h b/arch/x86/include/asm/pda.h
deleted file mode 100644
index 2fbfff88df3..00000000000
--- a/arch/x86/include/asm/pda.h
+++ /dev/null
@@ -1,137 +0,0 @@
-#ifndef _ASM_X86_PDA_H
-#define _ASM_X86_PDA_H
-
-#ifndef __ASSEMBLY__
-#include <linux/stddef.h>
-#include <linux/types.h>
-#include <linux/cache.h>
-#include <asm/page.h>
-
-/* Per processor datastructure. %gs points to it while the kernel runs */
-struct x8664_pda {
-        struct task_struct *pcurrent;   /* 0  Current process */
-        unsigned long data_offset;      /* 8 Per cpu data offset from linker
-                                           address */
-        unsigned long kernelstack;      /* 16 top of kernel stack for current */
-        unsigned long oldrsp;           /* 24 user rsp for system call */
-        int irqcount;                   /* 32 Irq nesting counter. Starts -1 */
-        unsigned int cpunumber;         /* 36 Logical CPU number */
-#ifdef CONFIG_CC_STACKPROTECTOR
-        unsigned long stack_canary;     /* 40 stack canary value */
-                                        /* gcc-ABI: this canary MUST be at
-                                           offset 40!!! */
-#endif
-        char *irqstackptr;
-        short nodenumber;               /* number of current node (32k max) */
-        short in_bootmem;               /* pda lives in bootmem */
-        unsigned int __softirq_pending;
-        unsigned int __nmi_count;       /* number of NMI on this CPUs */
-        short mmu_state;
-        short isidle;
-        struct mm_struct *active_mm;
-        unsigned apic_timer_irqs;
-        unsigned irq0_irqs;
-        unsigned irq_resched_count;
-        unsigned irq_call_count;
-        unsigned irq_tlb_count;
-        unsigned irq_thermal_count;
-        unsigned irq_threshold_count;
-        unsigned irq_spurious_count;
-} ____cacheline_aligned_in_smp;
-
-extern struct x8664_pda **_cpu_pda;
-extern void pda_init(int);
-
-#define cpu_pda(i) (_cpu_pda[i])
-
-/*
- * There is no fast way to get the base address of the PDA, all the accesses
- * have to mention %fs/%gs.  So it needs to be done this Torvaldian way.
- */
-extern void __bad_pda_field(void) __attribute__((noreturn));
-
-/*
- * proxy_pda doesn't actually exist, but tell gcc it is accessed for
- * all PDA accesses so it gets read/write dependencies right.
- */
-extern struct x8664_pda _proxy_pda;
-
-#define pda_offset(field) offsetof(struct x8664_pda, field)
-
-#define pda_to_op(op, field, val)                                       \
-do {                                                                    \
-        typedef typeof(_proxy_pda.field) T__;                           \
-        if (0) { T__ tmp__; tmp__ = (val); }    /* type checking */     \
-        switch (sizeof(_proxy_pda.field)) {                             \
-        case 2:                                                         \
-                asm(op "w %1,%%gs:%c2" :                                \
-                    "+m" (_proxy_pda.field) :                           \
-                    "ri" ((T__)val),                                    \
-                    "i"(pda_offset(field)));                            \
-                break;                                                  \
-        case 4:                                                         \
-                asm(op "l %1,%%gs:%c2" :                                \
-                    "+m" (_proxy_pda.field) :                           \
-                    "ri" ((T__)val),                                    \
-                    "i" (pda_offset(field)));                           \
-                break;                                                  \
-        case 8:                                                         \
-                asm(op "q %1,%%gs:%c2":                                 \
-                    "+m" (_proxy_pda.field) :                           \
-                    "ri" ((T__)val),                                    \
-                    "i"(pda_offset(field)));                            \
-                break;                                                  \
-        default:                                                        \
-                __bad_pda_field();                                      \
-        }                                                               \
-} while (0)
-
-#define pda_from_op(op, field)                  \
-({                                              \
-        typeof(_proxy_pda.field) ret__;         \
-        switch (sizeof(_proxy_pda.field)) {     \
-        case 2:                                 \
-                asm(op "w %%gs:%c1,%0" :        \
-                    "=r" (ret__) :              \
-                    "i" (pda_offset(field)),    \
-                    "m" (_proxy_pda.field));    \
-                break;                          \
-        case 4:                                 \
-                asm(op "l %%gs:%c1,%0":         \
-                    "=r" (ret__):               \
-                    "i" (pda_offset(field)),    \
-                    "m" (_proxy_pda.field));    \
-                break;                          \
-        case 8:                                 \
-                asm(op "q %%gs:%c1,%0":         \
-                    "=r" (ret__) :              \
-                    "i" (pda_offset(field)),    \
-                    "m" (_proxy_pda.field));    \
-                break;                          \
-        default:                                \
-                __bad_pda_field();              \
-        }                                       \
-        ret__;                                  \
-})
-
-#define read_pda(field)         pda_from_op("mov", field)
-#define write_pda(field, val)   pda_to_op("mov", field, val)
-#define add_pda(field, val)     pda_to_op("add", field, val)
-#define sub_pda(field, val)     pda_to_op("sub", field, val)
-#define or_pda(field, val)      pda_to_op("or", field, val)
-
-/* This is not atomic against other CPUs -- CPU preemption needs to be off */
-#define test_and_clear_bit_pda(bit, field)                              \
-({                                                                      \
-        int old__;                                                      \
-        asm volatile("btr %2,%%gs:%c3\n\tsbbl %0,%0"                    \
-                     : "=r" (old__), "+m" (_proxy_pda.field)            \
-                     : "dIr" (bit), "i" (pda_offset(field)) : "memory");\
-        old__;                                                          \
-})
-
-#endif
-
-#define PDA_STACKOFFSET (5*8)
-
-#endif /* _ASM_X86_PDA_H */
diff --git a/arch/x86/include/asm/percpu.h b/arch/x86/include/asm/percpu.h
index ece72053ba6..aee103b26d0 100644
--- a/arch/x86/include/asm/percpu.h
+++ b/arch/x86/include/asm/percpu.h
@@ -2,53 +2,12 @@
 #define _ASM_X86_PERCPU_H
 
 #ifdef CONFIG_X86_64
-#include <linux/compiler.h>
-
-/* Same as asm-generic/percpu.h, except that we store the per cpu offset
-   in the PDA. Longer term the PDA and every per cpu variable
-   should be just put into a single section and referenced directly
-   from %gs */
-
-#ifdef CONFIG_SMP
-#include <asm/pda.h>
-
-#define __per_cpu_offset(cpu) (cpu_pda(cpu)->data_offset)
-#define __my_cpu_offset read_pda(data_offset)
-
-#define per_cpu_offset(x) (__per_cpu_offset(x))
-
+#define __percpu_seg            gs
+#define __percpu_mov_op         movq
+#else
+#define __percpu_seg            fs
+#define __percpu_mov_op         movl
 #endif
-#include <asm-generic/percpu.h>
-
-DECLARE_PER_CPU(struct x8664_pda, pda);
-
-/*
- * These are supposed to be implemented as a single instruction which
- * operates on the per-cpu data base segment.  x86-64 doesn't have
- * that yet, so this is a fairly inefficient workaround for the
- * meantime.  The single instruction is atomic with respect to
- * preemption and interrupts, so we need to explicitly disable
- * interrupts here to achieve the same effect.  However, because it
- * can be used from within interrupt-disable/enable, we can't actually
- * disable interrupts; disabling preemption is enough.
- */
-#define x86_read_percpu(var)                                            \
-        ({                                                              \
-                typeof(per_cpu_var(var)) __tmp;                         \
-                preempt_disable();                                      \
-                __tmp = __get_cpu_var(var);                             \
-                preempt_enable();                                       \
-                __tmp;                                                  \
-        })
-
-#define x86_write_percpu(var, val)                                      \
-        do {                                                            \
-                preempt_disable();                                      \
-                __get_cpu_var(var) = (val);                             \
-                preempt_enable();                                       \
-        } while(0)
-
-#else /* CONFIG_X86_64 */
 
 #ifdef __ASSEMBLY__
 
@@ -65,47 +24,48 @@ DECLARE_PER_CPU(struct x8664_pda, pda);
  *    PER_CPU(cpu_gdt_descr, %ebx)
  */
 #ifdef CONFIG_SMP
-#define PER_CPU(var, reg)                               \
-        movl %fs:per_cpu__##this_cpu_off, reg;          \
+#define PER_CPU(var, reg)                                               \
+        __percpu_mov_op %__percpu_seg:per_cpu__this_cpu_off, reg;       \
         lea per_cpu__##var(reg), reg
-#define PER_CPU_VAR(var)        %fs:per_cpu__##var
+#define PER_CPU_VAR(var)        %__percpu_seg:per_cpu__##var
 #else /* ! SMP */
-#define PER_CPU(var, reg)                       \
-        movl $per_cpu__##var, reg
+#define PER_CPU(var, reg)                                               \
+        __percpu_mov_op $per_cpu__##var, reg
 #define PER_CPU_VAR(var)        per_cpu__##var
 #endif  /* SMP */
 
+#ifdef CONFIG_X86_64_SMP
+#define INIT_PER_CPU_VAR(var)  init_per_cpu__##var
+#else
+#define INIT_PER_CPU_VAR(var)  per_cpu__##var
+#endif
+
 #else /* ...!ASSEMBLY */
 
+#include <linux/stringify.h>
+
+#ifdef CONFIG_SMP
+#define __percpu_arg(x)         "%%"__stringify(__percpu_seg)":%P" #x
+#define __my_cpu_offset         percpu_read(this_cpu_off)
+#else
+#define __percpu_arg(x)         "%" #x
+#endif
+
 /*
- * PER_CPU finds an address of a per-cpu variable.
+ * Initialized pointers to per-cpu variables needed for the boot
+ * processor need to use these macros to get the proper address
+ * offset from __per_cpu_load on SMP.
  *
- * Args:
- *    var - variable name
- *    cpu - 32bit register containing the current CPU number
- *
- * The resulting address is stored in the "cpu" argument.
- *
- * Example:
- *    PER_CPU(cpu_gdt_descr, %ebx)
+ * There also must be an entry in vmlinux_64.lds.S
  */
-#ifdef CONFIG_SMP
-
-#define __my_cpu_offset x86_read_percpu(this_cpu_off)
-
-/* fs segment starts at (positive) offset == __per_cpu_offset[cpu] */
-#define __percpu_seg "%%fs:"
-
-#else  /* !SMP */
-
-#define __percpu_seg ""
-
-#endif  /* SMP */
-
-#include <asm-generic/percpu.h>
+#define DECLARE_INIT_PER_CPU(var) \
+       extern typeof(per_cpu_var(var)) init_per_cpu_var(var)
 
-/* We can use this directly for local CPU (faster). */
-DECLARE_PER_CPU(unsigned long, this_cpu_off);
+#ifdef CONFIG_X86_64_SMP
+#define init_per_cpu_var(var)  init_per_cpu__##var
+#else
+#define init_per_cpu_var(var)  per_cpu_var(var)
+#endif
 
 /* For arch-specific code, we can use direct single-insn ops (they
  * don't give an lvalue though). */
@@ -120,20 +80,25 @@ do {							\
         }                                               \
         switch (sizeof(var)) {                          \
         case 1:                                         \
-                asm(op "b %1,"__percpu_seg"%0"          \
+                asm(op "b %1,"__percpu_arg(0)           \
                     : "+m" (var)                        \
                     : "ri" ((T__)val));                 \
                 break;                                  \
         case 2:                                         \
-                asm(op "w %1,"__percpu_seg"%0"          \
+                asm(op "w %1,"__percpu_arg(0)           \
                     : "+m" (var)                        \
                     : "ri" ((T__)val));                 \
                 break;                                  \
         case 4:                                         \
-                asm(op "l %1,"__percpu_seg"%0"          \
+                asm(op "l %1,"__percpu_arg(0)           \
                     : "+m" (var)                        \
                     : "ri" ((T__)val));                 \
                 break;                                  \
+        case 8:                                         \
+                asm(op "q %1,"__percpu_arg(0)           \
+                    : "+m" (var)                        \
+                    : "re" ((T__)val));                 \
+                break;                                  \
         default: __bad_percpu_size();                   \
         }                                               \
 } while (0)
@@ -143,17 +108,22 @@ do {							\
         typeof(var) ret__;                              \
         switch (sizeof(var)) {                          \
         case 1:                                         \
-                asm(op "b "__percpu_seg"%1,%0"          \
+                asm(op "b "__percpu_arg(1)",%0"         \
                     : "=r" (ret__)                      \
                     : "m" (var));                       \
                 break;                                  \
         case 2:                                         \
-                asm(op "w "__percpu_seg"%1,%0"          \
+                asm(op "w "__percpu_arg(1)",%0"         \
                     : "=r" (ret__)                      \
                     : "m" (var));                       \
                 break;                                  \
         case 4:                                         \
-                asm(op "l "__percpu_seg"%1,%0"          \
+                asm(op "l "__percpu_arg(1)",%0"         \
+                    : "=r" (ret__)                      \
+                    : "m" (var));                       \
+                break;                                  \
+        case 8:                                         \
+                asm(op "q "__percpu_arg(1)",%0"         \
                     : "=r" (ret__)                      \
                     : "m" (var));                       \
                 break;                                  \
@@ -162,13 +132,30 @@ do {							\
         ret__;                                          \
 })
 
-#define x86_read_percpu(var) percpu_from_op("mov", per_cpu__##var)
-#define x86_write_percpu(var, val) percpu_to_op("mov", per_cpu__##var, val)
-#define x86_add_percpu(var, val) percpu_to_op("add", per_cpu__##var, val)
-#define x86_sub_percpu(var, val) percpu_to_op("sub", per_cpu__##var, val)
-#define x86_or_percpu(var, val) percpu_to_op("or", per_cpu__##var, val)
+#define percpu_read(var)        percpu_from_op("mov", per_cpu__##var)
+#define percpu_write(var, val)  percpu_to_op("mov", per_cpu__##var, val)
+#define percpu_add(var, val)    percpu_to_op("add", per_cpu__##var, val)
+#define percpu_sub(var, val)    percpu_to_op("sub", per_cpu__##var, val)
+#define percpu_and(var, val)    percpu_to_op("and", per_cpu__##var, val)
+#define percpu_or(var, val)     percpu_to_op("or", per_cpu__##var, val)
+#define percpu_xor(var, val)    percpu_to_op("xor", per_cpu__##var, val)
+
+/* This is not atomic against other CPUs -- CPU preemption needs to be off */
+#define x86_test_and_clear_bit_percpu(bit, var)                         \
+({                                                                      \
+        int old__;                                                      \
+        asm volatile("btr %2,"__percpu_arg(1)"\n\tsbbl %0,%0"           \
+                     : "=r" (old__), "+m" (per_cpu__##var)              \
+                     : "dIr" (bit));                                    \
+        old__;                                                          \
+})
+
+#include <asm-generic/percpu.h>
+
+/* We can use this directly for local CPU (faster). */
+DECLARE_PER_CPU(unsigned long, this_cpu_off);
+
 #endif /* !__ASSEMBLY__ */
-#endif /* !CONFIG_X86_64 */
 
 #ifdef CONFIG_SMP
 
@@ -195,9 +182,9 @@ do {							\
 #define early_per_cpu_ptr(_name) (_name##_early_ptr)
 #define early_per_cpu_map(_name, _idx) (_name##_early_map[_idx])
 #define early_per_cpu(_name, _cpu)                              \
-        (early_per_cpu_ptr(_name) ?                             \
-                early_per_cpu_ptr(_name)[_cpu] :                \
-                per_cpu(_name, _cpu))
+        *(early_per_cpu_ptr(_name) ?                            \
+                &early_per_cpu_ptr(_name)[_cpu] :               \
+                &per_cpu(_name, _cpu))
 
 #else   /* !CONFIG_SMP */
 #define DEFINE_EARLY_PER_CPU(_type, _name, _initvalue)          \
diff --git a/arch/x86/include/asm/pgtable-2level.h b/arch/x86/include/asm/pgtable-2level.h
index e0d199fe1d8..c1774ac9da7 100644
--- a/arch/x86/include/asm/pgtable-2level.h
+++ b/arch/x86/include/asm/pgtable-2level.h
@@ -53,8 +53,6 @@ static inline pte_t native_ptep_get_and_clear(pte_t *xp)
 #define native_ptep_get_and_clear(xp) native_local_ptep_get_and_clear(xp)
 #endif
 
-#define pte_none(x)             (!(x).pte_low)
-
 /*
  * Bits _PAGE_BIT_PRESENT, _PAGE_BIT_FILE and _PAGE_BIT_PROTNONE are taken,
  * split up the 29 bits of offset into this range:
diff --git a/arch/x86/include/asm/pgtable-2level-defs.h b/arch/x86/include/asm/pgtable-2level_types.h
index d77db8990ea..09ae67efceb 100644
--- a/arch/x86/include/asm/pgtable-2level-defs.h
+++ b/arch/x86/include/asm/pgtable-2level_types.h
@@ -1,6 +1,21 @@
 #ifndef _ASM_X86_PGTABLE_2LEVEL_DEFS_H
 #define _ASM_X86_PGTABLE_2LEVEL_DEFS_H
 
+#ifndef __ASSEMBLY__
+#include <linux/types.h>
+
+typedef unsigned long   pteval_t;
+typedef unsigned long   pmdval_t;
+typedef unsigned long   pudval_t;
+typedef unsigned long   pgdval_t;
+typedef unsigned long   pgprotval_t;
+
+typedef union {
+        pteval_t pte;
+        pteval_t pte_low;
+} pte_t;
+#endif  /* !__ASSEMBLY__ */
+
 #define SHARED_KERNEL_PMD       0
 
 /*
diff --git a/arch/x86/include/asm/pgtable-3level.h b/arch/x86/include/asm/pgtable-3level.h
index 447da43cddb..3f13cdf6115 100644
--- a/arch/x86/include/asm/pgtable-3level.h
+++ b/arch/x86/include/asm/pgtable-3level.h
@@ -18,21 +18,6 @@
         printk("%s:%d: bad pgd %p(%016Lx).\n",                          \
                __FILE__, __LINE__, &(e), pgd_val(e))
 
-static inline int pud_none(pud_t pud)
-{
-        return pud_val(pud) == 0;
-}
-
-static inline int pud_bad(pud_t pud)
-{
-        return (pud_val(pud) & ~(PTE_PFN_MASK | _KERNPG_TABLE | _PAGE_USER)) != 0;
-}
-
-static inline int pud_present(pud_t pud)
-{
-        return pud_val(pud) & _PAGE_PRESENT;
-}
-
 /* Rules for using set_pte: the pte being assigned *must* be
  * either not present or in a state where the hardware will
  * not attempt to update the pte.  In places where this is
@@ -120,15 +105,6 @@ static inline void pud_clear(pud_t *pudp)
                 write_cr3(pgd);
 }
 
-#define pud_page(pud) pfn_to_page(pud_val(pud) >> PAGE_SHIFT)
-
-#define pud_page_vaddr(pud) ((unsigned long) __va(pud_val(pud) & PTE_PFN_MASK))
-
-
-/* Find an entry in the second-level page table.. */
-#define pmd_offset(pud, address) ((pmd_t *)pud_page_vaddr(*(pud)) +     \
-                                  pmd_index(address))
-
 #ifdef CONFIG_SMP
 static inline pte_t native_ptep_get_and_clear(pte_t *ptep)
 {
@@ -145,17 +121,6 @@ static inline pte_t native_ptep_get_and_clear(pte_t *ptep)
 #define native_ptep_get_and_clear(xp) native_local_ptep_get_and_clear(xp)
 #endif
 
-#define __HAVE_ARCH_PTE_SAME
-static inline int pte_same(pte_t a, pte_t b)
-{
-        return a.pte_low == b.pte_low && a.pte_high == b.pte_high;
-}
-
-static inline int pte_none(pte_t pte)
-{
-        return !pte.pte_low && !pte.pte_high;
-}
-
 /*
  * Bits 0, 6 and 7 are taken in the low part of the pte,
  * put the 32 bits of offset into the high part.
diff --git a/arch/x86/include/asm/pgtable-3level-defs.h b/arch/x86/include/asm/pgtable-3level_types.h
index 62561367653..bcc89625ebe 100644
--- a/arch/x86/include/asm/pgtable-3level-defs.h
+++ b/arch/x86/include/asm/pgtable-3level_types.h
@@ -1,6 +1,23 @@
 #ifndef _ASM_X86_PGTABLE_3LEVEL_DEFS_H
 #define _ASM_X86_PGTABLE_3LEVEL_DEFS_H
 
+#ifndef __ASSEMBLY__
+#include <linux/types.h>
+
+typedef u64     pteval_t;
+typedef u64     pmdval_t;
+typedef u64     pudval_t;
+typedef u64     pgdval_t;
+typedef u64     pgprotval_t;
+
+typedef union {
+        struct {
+                unsigned long pte_low, pte_high;
+        };
+        pteval_t pte;
+} pte_t;
+#endif  /* !__ASSEMBLY__ */
+
 #ifdef CONFIG_PARAVIRT
 #define SHARED_KERNEL_PMD       (pv_info.shared_kernel_pmd)
 #else
@@ -25,4 +42,5 @@
  */
 #define PTRS_PER_PTE    512
 
+
 #endif /* _ASM_X86_PGTABLE_3LEVEL_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable.h b/arch/x86/include/asm/pgtable.h
index 06bbcbd66e9..1c097a3a666 100644
--- a/arch/x86/include/asm/pgtable.h
+++ b/arch/x86/include/asm/pgtable.h
@@ -1,164 +1,9 @@
 #ifndef _ASM_X86_PGTABLE_H
 #define _ASM_X86_PGTABLE_H
 
-#define FIRST_USER_ADDRESS      0
-
-#define _PAGE_BIT_PRESENT       0       /* is present */
-#define _PAGE_BIT_RW            1       /* writeable */
-#define _PAGE_BIT_USER          2       /* userspace addressable */
-#define _PAGE_BIT_PWT           3       /* page write through */
-#define _PAGE_BIT_PCD           4       /* page cache disabled */
-#define _PAGE_BIT_ACCESSED      5       /* was accessed (raised by CPU) */
-#define _PAGE_BIT_DIRTY         6       /* was written to (raised by CPU) */
-#define _PAGE_BIT_PSE           7       /* 4 MB (or 2MB) page */
-#define _PAGE_BIT_PAT           7       /* on 4KB pages */
-#define _PAGE_BIT_GLOBAL        8       /* Global TLB entry PPro+ */
-#define _PAGE_BIT_UNUSED1       9       /* available for programmer */
-#define _PAGE_BIT_IOMAP         10      /* flag used to indicate IO mapping */
-#define _PAGE_BIT_UNUSED3       11
-#define _PAGE_BIT_PAT_LARGE     12      /* On 2MB or 1GB pages */
-#define _PAGE_BIT_SPECIAL       _PAGE_BIT_UNUSED1
-#define _PAGE_BIT_CPA_TEST      _PAGE_BIT_UNUSED1
-#define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
-
-/* If _PAGE_BIT_PRESENT is clear, we use these: */
-/* - if the user mapped it with PROT_NONE; pte_present gives true */
-#define _PAGE_BIT_PROTNONE      _PAGE_BIT_GLOBAL
-/* - set: nonlinear file mapping, saved PTE; unset:swap */
-#define _PAGE_BIT_FILE          _PAGE_BIT_DIRTY
-
-#define _PAGE_PRESENT   (_AT(pteval_t, 1) << _PAGE_BIT_PRESENT)
-#define _PAGE_RW        (_AT(pteval_t, 1) << _PAGE_BIT_RW)
-#define _PAGE_USER      (_AT(pteval_t, 1) << _PAGE_BIT_USER)
-#define _PAGE_PWT       (_AT(pteval_t, 1) << _PAGE_BIT_PWT)
-#define _PAGE_PCD       (_AT(pteval_t, 1) << _PAGE_BIT_PCD)
-#define _PAGE_ACCESSED  (_AT(pteval_t, 1) << _PAGE_BIT_ACCESSED)
-#define _PAGE_DIRTY     (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
-#define _PAGE_PSE       (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
-#define _PAGE_GLOBAL    (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
-#define _PAGE_UNUSED1   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
-#define _PAGE_IOMAP     (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
-#define _PAGE_UNUSED3   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED3)
-#define _PAGE_PAT       (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
-#define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
-#define _PAGE_SPECIAL   (_AT(pteval_t, 1) << _PAGE_BIT_SPECIAL)
-#define _PAGE_CPA_TEST  (_AT(pteval_t, 1) << _PAGE_BIT_CPA_TEST)
-#define __HAVE_ARCH_PTE_SPECIAL
-
-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-#define _PAGE_NX        (_AT(pteval_t, 1) << _PAGE_BIT_NX)
-#else
-#define _PAGE_NX        (_AT(pteval_t, 0))
-#endif
+#include <asm/page.h>
 
-#define _PAGE_FILE      (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
-#define _PAGE_PROTNONE  (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE)
-
-#define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |        \
-                         _PAGE_ACCESSED | _PAGE_DIRTY)
-#define _KERNPG_TABLE   (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED |    \
-                         _PAGE_DIRTY)
-
-/* Set of bits not changed in pte_modify */
-#define _PAGE_CHG_MASK  (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT |         \
-                         _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY)
-
-#define _PAGE_CACHE_MASK        (_PAGE_PCD | _PAGE_PWT)
-#define _PAGE_CACHE_WB          (0)
-#define _PAGE_CACHE_WC          (_PAGE_PWT)
-#define _PAGE_CACHE_UC_MINUS    (_PAGE_PCD)
-#define _PAGE_CACHE_UC          (_PAGE_PCD | _PAGE_PWT)
-
-#define PAGE_NONE       __pgprot(_PAGE_PROTNONE | _PAGE_ACCESSED)
-#define PAGE_SHARED     __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_USER | \
-                                 _PAGE_ACCESSED | _PAGE_NX)
-
-#define PAGE_SHARED_EXEC        __pgprot(_PAGE_PRESENT | _PAGE_RW |     \
-                                         _PAGE_USER | _PAGE_ACCESSED)
-#define PAGE_COPY_NOEXEC        __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
-                                         _PAGE_ACCESSED | _PAGE_NX)
-#define PAGE_COPY_EXEC          __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
-                                         _PAGE_ACCESSED)
-#define PAGE_COPY               PAGE_COPY_NOEXEC
-#define PAGE_READONLY           __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
-                                         _PAGE_ACCESSED | _PAGE_NX)
-#define PAGE_READONLY_EXEC      __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
-                                         _PAGE_ACCESSED)
-
-#define __PAGE_KERNEL_EXEC                                              \
-        (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
-#define __PAGE_KERNEL           (__PAGE_KERNEL_EXEC | _PAGE_NX)
-
-#define __PAGE_KERNEL_RO                (__PAGE_KERNEL & ~_PAGE_RW)
-#define __PAGE_KERNEL_RX                (__PAGE_KERNEL_EXEC & ~_PAGE_RW)
-#define __PAGE_KERNEL_EXEC_NOCACHE      (__PAGE_KERNEL_EXEC | _PAGE_PCD | _PAGE_PWT)
-#define __PAGE_KERNEL_WC                (__PAGE_KERNEL | _PAGE_CACHE_WC)
-#define __PAGE_KERNEL_NOCACHE           (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
-#define __PAGE_KERNEL_UC_MINUS          (__PAGE_KERNEL | _PAGE_PCD)
-#define __PAGE_KERNEL_VSYSCALL          (__PAGE_KERNEL_RX | _PAGE_USER)
-#define __PAGE_KERNEL_VSYSCALL_NOCACHE  (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
-#define __PAGE_KERNEL_LARGE             (__PAGE_KERNEL | _PAGE_PSE)
-#define __PAGE_KERNEL_LARGE_NOCACHE     (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
-#define __PAGE_KERNEL_LARGE_EXEC        (__PAGE_KERNEL_EXEC | _PAGE_PSE)
-
-#define __PAGE_KERNEL_IO                (__PAGE_KERNEL | _PAGE_IOMAP)
-#define __PAGE_KERNEL_IO_NOCACHE        (__PAGE_KERNEL_NOCACHE | _PAGE_IOMAP)
-#define __PAGE_KERNEL_IO_UC_MINUS       (__PAGE_KERNEL_UC_MINUS | _PAGE_IOMAP)
-#define __PAGE_KERNEL_IO_WC             (__PAGE_KERNEL_WC | _PAGE_IOMAP)
-
-#define PAGE_KERNEL                     __pgprot(__PAGE_KERNEL)
-#define PAGE_KERNEL_RO                  __pgprot(__PAGE_KERNEL_RO)
-#define PAGE_KERNEL_EXEC                __pgprot(__PAGE_KERNEL_EXEC)
-#define PAGE_KERNEL_RX                  __pgprot(__PAGE_KERNEL_RX)
-#define PAGE_KERNEL_WC                  __pgprot(__PAGE_KERNEL_WC)
-#define PAGE_KERNEL_NOCACHE             __pgprot(__PAGE_KERNEL_NOCACHE)
-#define PAGE_KERNEL_UC_MINUS            __pgprot(__PAGE_KERNEL_UC_MINUS)
-#define PAGE_KERNEL_EXEC_NOCACHE        __pgprot(__PAGE_KERNEL_EXEC_NOCACHE)
-#define PAGE_KERNEL_LARGE               __pgprot(__PAGE_KERNEL_LARGE)
-#define PAGE_KERNEL_LARGE_NOCACHE       __pgprot(__PAGE_KERNEL_LARGE_NOCACHE)
-#define PAGE_KERNEL_LARGE_EXEC          __pgprot(__PAGE_KERNEL_LARGE_EXEC)
-#define PAGE_KERNEL_VSYSCALL            __pgprot(__PAGE_KERNEL_VSYSCALL)
-#define PAGE_KERNEL_VSYSCALL_NOCACHE    __pgprot(__PAGE_KERNEL_VSYSCALL_NOCACHE)
-
-#define PAGE_KERNEL_IO                  __pgprot(__PAGE_KERNEL_IO)
-#define PAGE_KERNEL_IO_NOCACHE          __pgprot(__PAGE_KERNEL_IO_NOCACHE)
-#define PAGE_KERNEL_IO_UC_MINUS         __pgprot(__PAGE_KERNEL_IO_UC_MINUS)
-#define PAGE_KERNEL_IO_WC               __pgprot(__PAGE_KERNEL_IO_WC)
-
-/*         xwr */
-#define __P000  PAGE_NONE
-#define __P001  PAGE_READONLY
-#define __P010  PAGE_COPY
-#define __P011  PAGE_COPY
-#define __P100  PAGE_READONLY_EXEC
-#define __P101  PAGE_READONLY_EXEC
-#define __P110  PAGE_COPY_EXEC
-#define __P111  PAGE_COPY_EXEC
-
-#define __S000  PAGE_NONE
-#define __S001  PAGE_READONLY
-#define __S010  PAGE_SHARED
-#define __S011  PAGE_SHARED
-#define __S100  PAGE_READONLY_EXEC
-#define __S101  PAGE_READONLY_EXEC
-#define __S110  PAGE_SHARED_EXEC
-#define __S111  PAGE_SHARED_EXEC
-
-/*
- * early identity mapping  pte attrib macros.
- */
-#ifdef CONFIG_X86_64
-#define __PAGE_KERNEL_IDENT_LARGE_EXEC  __PAGE_KERNEL_LARGE_EXEC
-#else
-/*
- * For PDE_IDENT_ATTR include USER bit. As the PDE and PTE protection
- * bits are combined, this will alow user to access the high address mapped
- * VDSO in the presence of CONFIG_COMPAT_VDSO
- */
-#define PTE_IDENT_ATTR   0x003          /* PRESENT+RW */
-#define PDE_IDENT_ATTR   0x067          /* PRESENT+RW+USER+DIRTY+ACCESSED */
-#define PGD_IDENT_ATTR   0x001          /* PRESENT (no other attributes) */
-#endif
+#include <asm/pgtable_types.h>
 
 /*
  * Macro to mark a page protection value as UC-
@@ -170,9 +15,6 @@
 
 #ifndef __ASSEMBLY__
 
-#define pgprot_writecombine     pgprot_writecombine
-extern pgprot_t pgprot_writecombine(pgprot_t prot);
-
 /*
  * ZERO_PAGE is a global shared page that is always zero: used
  * for zero-mapped memory areas etc..
@@ -183,6 +25,66 @@ extern unsigned long empty_zero_page[PAGE_SIZE / sizeof(unsigned long)];
 extern spinlock_t pgd_lock;
 extern struct list_head pgd_list;
 
+#ifdef CONFIG_PARAVIRT
+#include <asm/paravirt.h>
+#else  /* !CONFIG_PARAVIRT */
+#define set_pte(ptep, pte)              native_set_pte(ptep, pte)
+#define set_pte_at(mm, addr, ptep, pte) native_set_pte_at(mm, addr, ptep, pte)
+
+#define set_pte_present(mm, addr, ptep, pte)                            \
+        native_set_pte_present(mm, addr, ptep, pte)
+#define set_pte_atomic(ptep, pte)                                       \
+        native_set_pte_atomic(ptep, pte)
+
+#define set_pmd(pmdp, pmd)              native_set_pmd(pmdp, pmd)
+
+#ifndef __PAGETABLE_PUD_FOLDED
+#define set_pgd(pgdp, pgd)              native_set_pgd(pgdp, pgd)
+#define pgd_clear(pgd)                  native_pgd_clear(pgd)
+#endif
+
+#ifndef set_pud
+# define set_pud(pudp, pud)             native_set_pud(pudp, pud)
+#endif
+
+#ifndef __PAGETABLE_PMD_FOLDED
+#define pud_clear(pud)                  native_pud_clear(pud)
+#endif
+
+#define pte_clear(mm, addr, ptep)       native_pte_clear(mm, addr, ptep)
+#define pmd_clear(pmd)                  native_pmd_clear(pmd)
+
+#define pte_update(mm, addr, ptep)              do { } while (0)
+#define pte_update_defer(mm, addr, ptep)        do { } while (0)
+
+static inline void __init paravirt_pagetable_setup_start(pgd_t *base)
+{
+        native_pagetable_setup_start(base);
+}
+
+static inline void __init paravirt_pagetable_setup_done(pgd_t *base)
+{
+        native_pagetable_setup_done(base);
+}
+
+#define pgd_val(x)      native_pgd_val(x)
+#define __pgd(x)        native_make_pgd(x)
+
+#ifndef __PAGETABLE_PUD_FOLDED
+#define pud_val(x)      native_pud_val(x)
+#define __pud(x)        native_make_pud(x)
+#endif
+
+#ifndef __PAGETABLE_PMD_FOLDED
+#define pmd_val(x)      native_pmd_val(x)
+#define __pmd(x)        native_make_pmd(x)
+#endif
+
+#define pte_val(x)      native_pte_val(x)
+#define __pte(x)        native_make_pte(x)
+
+#endif  /* CONFIG_PARAVIRT */
+
 /*
  * The following only work if pte_present() is true.
  * Undefined behaviour if not..
@@ -236,82 +138,108 @@ static inline unsigned long pte_pfn(pte_t pte)
 
 static inline int pmd_large(pmd_t pte)
 {
-        return (pmd_val(pte) & (_PAGE_PSE | _PAGE_PRESENT)) ==
+        return (pmd_flags(pte) & (_PAGE_PSE | _PAGE_PRESENT)) ==
                 (_PAGE_PSE | _PAGE_PRESENT);
 }
 
+static inline pte_t pte_set_flags(pte_t pte, pteval_t set)
+{
+        pteval_t v = native_pte_val(pte);
+
+        return native_make_pte(v | set);
+}
+
+static inline pte_t pte_clear_flags(pte_t pte, pteval_t clear)
+{
+        pteval_t v = native_pte_val(pte);
+
+        return native_make_pte(v & ~clear);
+}
+
 static inline pte_t pte_mkclean(pte_t pte)
 {
-        return __pte(pte_val(pte) & ~_PAGE_DIRTY);
+        return pte_clear_flags(pte, _PAGE_DIRTY);
 }
 
 static inline pte_t pte_mkold(pte_t pte)
 {
-        return __pte(pte_val(pte) & ~_PAGE_ACCESSED);
+        return pte_clear_flags(pte, _PAGE_ACCESSED);
 }
 
 static inline pte_t pte_wrprotect(pte_t pte)
 {
-        return __pte(pte_val(pte) & ~_PAGE_RW);
+        return pte_clear_flags(pte, _PAGE_RW);
 }
 
 static inline pte_t pte_mkexec(pte_t pte)
 {
-        return __pte(pte_val(pte) & ~_PAGE_NX);
+        return pte_clear_flags(pte, _PAGE_NX);
 }
 
 static inline pte_t pte_mkdirty(pte_t pte)
 {
-        return __pte(pte_val(pte) | _PAGE_DIRTY);
+        return pte_set_flags(pte, _PAGE_DIRTY);
 }
 
 static inline pte_t pte_mkyoung(pte_t pte)
 {
-        return __pte(pte_val(pte) | _PAGE_ACCESSED);
+        return pte_set_flags(pte, _PAGE_ACCESSED);
 }
 
 static inline pte_t pte_mkwrite(pte_t pte)
 {
-        return __pte(pte_val(pte) | _PAGE_RW);
+        return pte_set_flags(pte, _PAGE_RW);
 }
 
 static inline pte_t pte_mkhuge(pte_t pte)
 {
-        return __pte(pte_val(pte) | _PAGE_PSE);
+        return pte_set_flags(pte, _PAGE_PSE);
 }
 
 static inline pte_t pte_clrhuge(pte_t pte)
 {
-        return __pte(pte_val(pte) & ~_PAGE_PSE);
+        return pte_clear_flags(pte, _PAGE_PSE);
 }
 
 static inline pte_t pte_mkglobal(pte_t pte)
 {
-        return __pte(pte_val(pte) | _PAGE_GLOBAL);
+        return pte_set_flags(pte, _PAGE_GLOBAL);
 }
 
 static inline pte_t pte_clrglobal(pte_t pte)
 {
-        return __pte(pte_val(pte) & ~_PAGE_GLOBAL);
+        return pte_clear_flags(pte, _PAGE_GLOBAL);
 }
 
 static inline pte_t pte_mkspecial(pte_t pte)
 {
-        return __pte(pte_val(pte) | _PAGE_SPECIAL);
+        return pte_set_flags(pte, _PAGE_SPECIAL);
 }
 
-extern pteval_t __supported_pte_mask;
+/*
+ * Mask out unsupported bits in a present pgprot.  Non-present pgprots
+ * can use those bits for other purposes, so leave them be.
+ */
+static inline pgprotval_t massage_pgprot(pgprot_t pgprot)
+{
+        pgprotval_t protval = pgprot_val(pgprot);
+
+        if (protval & _PAGE_PRESENT)
+                protval &= __supported_pte_mask;
+
+        return protval;
+}
 
 static inline pte_t pfn_pte(unsigned long page_nr, pgprot_t pgprot)
 {
-        return __pte((((phys_addr_t)page_nr << PAGE_SHIFT) |
-                      pgprot_val(pgprot)) & __supported_pte_mask);
+        return __pte(((phys_addr_t)page_nr << PAGE_SHIFT) |
+                     massage_pgprot(pgprot));
 }
 
 static inline pmd_t pfn_pmd(unsigned long page_nr, pgprot_t pgprot)
 {
-        return __pmd((((phys_addr_t)page_nr << PAGE_SHIFT) |
-                      pgprot_val(pgprot)) & __supported_pte_mask);
+        return __pmd(((phys_addr_t)page_nr << PAGE_SHIFT) |
+                     massage_pgprot(pgprot));
 }
 
 static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
@@ -323,7 +251,7 @@ static inline pte_t pte_modify(pte_t pte, pgprot_t newprot)
          * the newprot (if present):
          */
         val &= _PAGE_CHG_MASK;
-        val |= pgprot_val(newprot) & (~_PAGE_CHG_MASK) & __supported_pte_mask;
+        val |= massage_pgprot(newprot) & ~_PAGE_CHG_MASK;
 
         return __pte(val);
 }
@@ -339,7 +267,7 @@ static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
 
 #define pte_pgprot(x) __pgprot(pte_flags(x) & PTE_FLAGS_MASK)
 
-#define canon_pgprot(p) __pgprot(pgprot_val(p) & __supported_pte_mask)
+#define canon_pgprot(p) __pgprot(massage_pgprot(p))
 
 static inline int is_new_memtype_allowed(unsigned long flags,
                                                 unsigned long new_flags)
@@ -360,82 +288,195 @@ static inline int is_new_memtype_allowed(unsigned long flags,
         return 1;
 }
 
-#ifndef __ASSEMBLY__
-/* Indicate that x86 has its own track and untrack pfn vma functions */
-#define __HAVE_PFNMAP_TRACKING
-
-#define __HAVE_PHYS_MEM_ACCESS_PROT
-struct file;
-pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
-                              unsigned long size, pgprot_t vma_prot);
-int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
-                              unsigned long size, pgprot_t *vma_prot);
-#endif
-
-/* Install a pte for a particular vaddr in kernel space. */
-void set_pte_vaddr(unsigned long vaddr, pte_t pte);
+#endif  /* __ASSEMBLY__ */
 
 #ifdef CONFIG_X86_32
-extern void native_pagetable_setup_start(pgd_t *base);
-extern void native_pagetable_setup_done(pgd_t *base);
+# include "pgtable_32.h"
 #else
-static inline void native_pagetable_setup_start(pgd_t *base) {}
-static inline void native_pagetable_setup_done(pgd_t *base) {}
+# include "pgtable_64.h"
 #endif
 
-struct seq_file;
-extern void arch_report_meminfo(struct seq_file *m);
+#ifndef __ASSEMBLY__
+#include <linux/mm_types.h>
 
-#ifdef CONFIG_PARAVIRT
-#include <asm/paravirt.h>
-#else  /* !CONFIG_PARAVIRT */
-#define set_pte(ptep, pte)              native_set_pte(ptep, pte)
-#define set_pte_at(mm, addr, ptep, pte) native_set_pte_at(mm, addr, ptep, pte)
+static inline int pte_none(pte_t pte)
+{
+        return !pte.pte;
+}
 
-#define set_pte_present(mm, addr, ptep, pte)                            \
-        native_set_pte_present(mm, addr, ptep, pte)
-#define set_pte_atomic(ptep, pte)                                       \
-        native_set_pte_atomic(ptep, pte)
+#define __HAVE_ARCH_PTE_SAME
+static inline int pte_same(pte_t a, pte_t b)
+{
+        return a.pte == b.pte;
+}
 
-#define set_pmd(pmdp, pmd)              native_set_pmd(pmdp, pmd)
+static inline int pte_present(pte_t a)
+{
+        return pte_flags(a) & (_PAGE_PRESENT | _PAGE_PROTNONE);
+}
 
-#ifndef __PAGETABLE_PUD_FOLDED
-#define set_pgd(pgdp, pgd)              native_set_pgd(pgdp, pgd)
-#define pgd_clear(pgd)                  native_pgd_clear(pgd)
-#endif
+static inline int pmd_present(pmd_t pmd)
+{
+        return pmd_flags(pmd) & _PAGE_PRESENT;
+}
 
-#ifndef set_pud
-# define set_pud(pudp, pud)             native_set_pud(pudp, pud)
-#endif
+static inline int pmd_none(pmd_t pmd)
+{
+        /* Only check low word on 32-bit platforms, since it might be
+           out of sync with upper half. */
+        return (unsigned long)native_pmd_val(pmd) == 0;
+}
 
-#ifndef __PAGETABLE_PMD_FOLDED
-#define pud_clear(pud)                  native_pud_clear(pud)
-#endif
+static inline unsigned long pmd_page_vaddr(pmd_t pmd)
+{
+        return (unsigned long)__va(pmd_val(pmd) & PTE_PFN_MASK);
+}
 
-#define pte_clear(mm, addr, ptep)       native_pte_clear(mm, addr, ptep)
-#define pmd_clear(pmd)                  native_pmd_clear(pmd)
+/*
+ * Currently stuck as a macro due to indirect forward reference to
+ * linux/mmzone.h's __section_mem_map_addr() definition:
+ */
+#define pmd_page(pmd)   pfn_to_page(pmd_val(pmd) >> PAGE_SHIFT)
 
-#define pte_update(mm, addr, ptep)              do { } while (0)
-#define pte_update_defer(mm, addr, ptep)        do { } while (0)
+/*
+ * the pmd page can be thought of an array like this: pmd_t[PTRS_PER_PMD]
+ *
+ * this macro returns the index of the entry in the pmd page which would
+ * control the given virtual address
+ */
+static inline unsigned pmd_index(unsigned long address)
+{
+        return (address >> PMD_SHIFT) & (PTRS_PER_PMD - 1);
+}
 
-static inline void __init paravirt_pagetable_setup_start(pgd_t *base)
+/*
+ * Conversion functions: convert a page and protection to a page entry,
+ * and a page entry and page directory to the page they refer to.
+ *
+ * (Currently stuck as a macro because of indirect forward reference
+ * to linux/mm.h:page_to_nid())
+ */
+#define mk_pte(page, pgprot)   pfn_pte(page_to_pfn(page), (pgprot))
+
+/*
+ * the pte page can be thought of an array like this: pte_t[PTRS_PER_PTE]
+ *
+ * this function returns the index of the entry in the pte page which would
+ * control the given virtual address
+ */
+static inline unsigned pte_index(unsigned long address)
 {
-        native_pagetable_setup_start(base);
+        return (address >> PAGE_SHIFT) & (PTRS_PER_PTE - 1);
 }
 
-static inline void __init paravirt_pagetable_setup_done(pgd_t *base)
+static inline pte_t *pte_offset_kernel(pmd_t *pmd, unsigned long address)
 {
-        native_pagetable_setup_done(base);
+        return (pte_t *)pmd_page_vaddr(*pmd) + pte_index(address);
 }
-#endif  /* CONFIG_PARAVIRT */
 
-#endif  /* __ASSEMBLY__ */
+static inline int pmd_bad(pmd_t pmd)
+{
+        return (pmd_flags(pmd) & ~_PAGE_USER) != _KERNPG_TABLE;
+}
 
-#ifdef CONFIG_X86_32
-# include "pgtable_32.h"
+static inline unsigned long pages_to_mb(unsigned long npg)
+{
+        return npg >> (20 - PAGE_SHIFT);
+}
+
+#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
+        remap_pfn_range(vma, vaddr, pfn, size, prot)
+
+#if PAGETABLE_LEVELS > 2
+static inline int pud_none(pud_t pud)
+{
+        return native_pud_val(pud) == 0;
+}
+
+static inline int pud_present(pud_t pud)
+{
+        return pud_flags(pud) & _PAGE_PRESENT;
+}
+
+static inline unsigned long pud_page_vaddr(pud_t pud)
+{
+        return (unsigned long)__va((unsigned long)pud_val(pud) & PTE_PFN_MASK);
+}
+
+/*
+ * Currently stuck as a macro due to indirect forward reference to
+ * linux/mmzone.h's __section_mem_map_addr() definition:
+ */
+#define pud_page(pud)           pfn_to_page(pud_val(pud) >> PAGE_SHIFT)
+
+/* Find an entry in the second-level page table.. */
+static inline pmd_t *pmd_offset(pud_t *pud, unsigned long address)
+{
+        return (pmd_t *)pud_page_vaddr(*pud) + pmd_index(address);
+}
+
+static inline unsigned long pmd_pfn(pmd_t pmd)
+{
+        return (pmd_val(pmd) & PTE_PFN_MASK) >> PAGE_SHIFT;
+}
+
+static inline int pud_large(pud_t pud)
+{
+        return (pud_val(pud) & (_PAGE_PSE | _PAGE_PRESENT)) ==
+                (_PAGE_PSE | _PAGE_PRESENT);
+}
+
+static inline int pud_bad(pud_t pud)
+{
+        return (pud_flags(pud) & ~(_KERNPG_TABLE | _PAGE_USER)) != 0;
+}
 #else
-# include "pgtable_64.h"
-#endif
+static inline int pud_large(pud_t pud)
+{
+        return 0;
+}
+#endif  /* PAGETABLE_LEVELS > 2 */
+
+#if PAGETABLE_LEVELS > 3
+static inline int pgd_present(pgd_t pgd)
+{
+        return pgd_flags(pgd) & _PAGE_PRESENT;
+}
+
+static inline unsigned long pgd_page_vaddr(pgd_t pgd)
+{
+        return (unsigned long)__va((unsigned long)pgd_val(pgd) & PTE_PFN_MASK);
+}
+
+/*
+ * Currently stuck as a macro due to indirect forward reference to
+ * linux/mmzone.h's __section_mem_map_addr() definition:
+ */
+#define pgd_page(pgd)           pfn_to_page(pgd_val(pgd) >> PAGE_SHIFT)
+
+/* to find an entry in a page-table-directory. */
+static inline unsigned pud_index(unsigned long address)
+{
+        return (address >> PUD_SHIFT) & (PTRS_PER_PUD - 1);
+}
+
+static inline pud_t *pud_offset(pgd_t *pgd, unsigned long address)
+{
+        return (pud_t *)pgd_page_vaddr(*pgd) + pud_index(address);
+}
+
+static inline int pgd_bad(pgd_t pgd)
+{
+        return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
+}
+
+static inline int pgd_none(pgd_t pgd)
+{
+        return !native_pgd_val(pgd);
+}
+#endif  /* PAGETABLE_LEVELS > 3 */
+
+#endif  /* __ASSEMBLY__ */
 
 /*
  * the pgd page can be thought of an array like this: pgd_t[PTRS_PER_PGD]
@@ -462,28 +503,6 @@ static inline void __init paravirt_pagetable_setup_done(pgd_t *base)
 
 #ifndef __ASSEMBLY__
 
-enum {
-        PG_LEVEL_NONE,
-        PG_LEVEL_4K,
-        PG_LEVEL_2M,
-        PG_LEVEL_1G,
-        PG_LEVEL_NUM
-};
-
-#ifdef CONFIG_PROC_FS
-extern void update_page_count(int level, unsigned long pages);
-#else
-static inline void update_page_count(int level, unsigned long pages) { }
-#endif
-
-/*
- * Helper function that returns the kernel pagetable entry controlling
- * the virtual address 'address'. NULL means no pagetable entry present.
- * NOTE: the return type is pte_t but if the pmd is PSE then we return it
- * as a pte too.
- */
-extern pte_t *lookup_address(unsigned long address, unsigned int *level);
-
 /* local pte updates need not use xchg for locking */
 static inline pte_t native_local_ptep_get_and_clear(pte_t *ptep)
 {
diff --git a/arch/x86/include/asm/pgtable_32.h b/arch/x86/include/asm/pgtable_32.h
index 72b020deb46..97612fc7632 100644
--- a/arch/x86/include/asm/pgtable_32.h
+++ b/arch/x86/include/asm/pgtable_32.h
@@ -1,6 +1,7 @@
 #ifndef _ASM_X86_PGTABLE_32_H
 #define _ASM_X86_PGTABLE_32_H
 
+#include <asm/pgtable_32_types.h>
 
 /*
  * The Linux memory management assumes a three-level page table setup. On
@@ -33,47 +34,6 @@ void paging_init(void);
 
 extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
 
-/*
- * The Linux x86 paging architecture is 'compile-time dual-mode', it
- * implements both the traditional 2-level x86 page tables and the
- * newer 3-level PAE-mode page tables.
- */
-#ifdef CONFIG_X86_PAE
-# include <asm/pgtable-3level-defs.h>
-# define PMD_SIZE       (1UL << PMD_SHIFT)
-# define PMD_MASK       (~(PMD_SIZE - 1))
-#else
-# include <asm/pgtable-2level-defs.h>
-#endif
-
-#define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
-#define PGDIR_MASK      (~(PGDIR_SIZE - 1))
-
-/* Just any arbitrary offset to the start of the vmalloc VM area: the
- * current 8MB value just means that there will be a 8MB "hole" after the
- * physical memory until the kernel virtual memory starts.  That means that
- * any out-of-bounds memory accesses will hopefully be caught.
- * The vmalloc() routines leaves a hole of 4kB between each vmalloced
- * area for the same reason. ;)
- */
-#define VMALLOC_OFFSET  (8 * 1024 * 1024)
-#define VMALLOC_START   ((unsigned long)high_memory + VMALLOC_OFFSET)
-#ifdef CONFIG_X86_PAE
-#define LAST_PKMAP 512
-#else
-#define LAST_PKMAP 1024
-#endif
-
-#define PKMAP_BASE ((FIXADDR_BOOT_START - PAGE_SIZE * (LAST_PKMAP + 1)) \
-                    & PMD_MASK)
-
-#ifdef CONFIG_HIGHMEM
-# define VMALLOC_END    (PKMAP_BASE - 2 * PAGE_SIZE)
-#else
-# define VMALLOC_END    (FIXADDR_START - 2 * PAGE_SIZE)
-#endif
-
-#define MAXMEM  (VMALLOC_END - PAGE_OFFSET - __VMALLOC_RESERVE)
 
 /*
  * Define this if things work differently on an i386 and an i486:
@@ -85,55 +45,12 @@ extern void set_pmd_pfn(unsigned long, unsigned long, pgprot_t);
 /* The boot page tables (all created as a single array) */
 extern unsigned long pg0[];
 
-#define pte_present(x)  ((x).pte_low & (_PAGE_PRESENT | _PAGE_PROTNONE))
-
-/* To avoid harmful races, pmd_none(x) should check only the lower when PAE */
-#define pmd_none(x)     (!(unsigned long)pmd_val((x)))
-#define pmd_present(x)  (pmd_val((x)) & _PAGE_PRESENT)
-#define pmd_bad(x) ((pmd_val(x) & (PTE_FLAGS_MASK & ~_PAGE_USER)) != _KERNPG_TABLE)
-
-#define pages_to_mb(x) ((x) >> (20-PAGE_SHIFT))
-
 #ifdef CONFIG_X86_PAE
 # include <asm/pgtable-3level.h>
 #else
 # include <asm/pgtable-2level.h>
 #endif
 
-/*
- * Conversion functions: convert a page and protection to a page entry,
- * and a page entry and page directory to the page they refer to.
- */
-#define mk_pte(page, pgprot)    pfn_pte(page_to_pfn(page), (pgprot))
-
-
-static inline int pud_large(pud_t pud) { return 0; }
-
-/*
- * the pmd page can be thought of an array like this: pmd_t[PTRS_PER_PMD]
- *
- * this macro returns the index of the entry in the pmd page which would
- * control the given virtual address
- */
-#define pmd_index(address)                              \
-        (((address) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
-
-/*
- * the pte page can be thought of an array like this: pte_t[PTRS_PER_PTE]
- *
- * this macro returns the index of the entry in the pte page which would
- * control the given virtual address
- */
-#define pte_index(address)                                      \
-        (((address) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
-#define pte_offset_kernel(dir, address)                         \
-        ((pte_t *)pmd_page_vaddr(*(dir)) +  pte_index((address)))
-
-#define pmd_page(pmd) (pfn_to_page(pmd_val((pmd)) >> PAGE_SHIFT))
-
-#define pmd_page_vaddr(pmd)                                     \
-        ((unsigned long)__va(pmd_val((pmd)) & PTE_PFN_MASK))
-
 #if defined(CONFIG_HIGHPTE)
 #define pte_offset_map(dir, address)                                    \
         ((pte_t *)kmap_atomic_pte(pmd_page(*(dir)), KM_PTE0) +          \
@@ -176,7 +93,4 @@ do {						\
 #define kern_addr_valid(kaddr)  (0)
 #endif
 
-#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
-        remap_pfn_range(vma, vaddr, pfn, size, prot)
-
 #endif /* _ASM_X86_PGTABLE_32_H */
diff --git a/arch/x86/include/asm/pgtable_32_types.h b/arch/x86/include/asm/pgtable_32_types.h
new file mode 100644
index 00000000000..bd8df3b2fe0
--- /dev/null
+++ b/arch/x86/include/asm/pgtable_32_types.h
@@ -0,0 +1,46 @@
+#ifndef _ASM_X86_PGTABLE_32_DEFS_H
+#define _ASM_X86_PGTABLE_32_DEFS_H
+
+/*
+ * The Linux x86 paging architecture is 'compile-time dual-mode', it
+ * implements both the traditional 2-level x86 page tables and the
+ * newer 3-level PAE-mode page tables.
+ */
+#ifdef CONFIG_X86_PAE
+# include <asm/pgtable-3level_types.h>
+# define PMD_SIZE       (1UL << PMD_SHIFT)
+# define PMD_MASK       (~(PMD_SIZE - 1))
+#else
+# include <asm/pgtable-2level_types.h>
+#endif
+
+#define PGDIR_SIZE      (1UL << PGDIR_SHIFT)
+#define PGDIR_MASK      (~(PGDIR_SIZE - 1))
+
+/* Just any arbitrary offset to the start of the vmalloc VM area: the
+ * current 8MB value just means that there will be a 8MB "hole" after the
+ * physical memory until the kernel virtual memory starts.  That means that
+ * any out-of-bounds memory accesses will hopefully be caught.
+ * The vmalloc() routines leaves a hole of 4kB between each vmalloced
+ * area for the same reason. ;)
+ */
+#define VMALLOC_OFFSET  (8 * 1024 * 1024)
+#define VMALLOC_START   ((unsigned long)high_memory + VMALLOC_OFFSET)
+#ifdef CONFIG_X86_PAE
+#define LAST_PKMAP 512
+#else
+#define LAST_PKMAP 1024
+#endif
+
+#define PKMAP_BASE ((FIXADDR_BOOT_START - PAGE_SIZE * (LAST_PKMAP + 1)) \
+                    & PMD_MASK)
+
+#ifdef CONFIG_HIGHMEM
+# define VMALLOC_END    (PKMAP_BASE - 2 * PAGE_SIZE)
+#else
+# define VMALLOC_END    (FIXADDR_START - 2 * PAGE_SIZE)
+#endif
+
+#define MAXMEM  (VMALLOC_END - PAGE_OFFSET - __VMALLOC_RESERVE)
+
+#endif /* _ASM_X86_PGTABLE_32_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable_64.h b/arch/x86/include/asm/pgtable_64.h
index ba09289acca..6b87bc6d501 100644
--- a/arch/x86/include/asm/pgtable_64.h
+++ b/arch/x86/include/asm/pgtable_64.h
@@ -2,6 +2,8 @@
 #define _ASM_X86_PGTABLE_64_H
 
 #include <linux/const.h>
+#include <asm/pgtable_64_types.h>
+
 #ifndef __ASSEMBLY__
 
 /*
@@ -11,7 +13,6 @@
 #include <asm/processor.h>
 #include <linux/bitops.h>
 #include <linux/threads.h>
-#include <asm/pda.h>
 
 extern pud_t level3_kernel_pgt[512];
 extern pud_t level3_ident_pgt[512];
@@ -26,32 +27,6 @@ extern void paging_init(void);
 
 #endif /* !__ASSEMBLY__ */
 
-#define SHARED_KERNEL_PMD       0
-
-/*
- * PGDIR_SHIFT determines what a top-level page table entry can map
- */
-#define PGDIR_SHIFT     39
-#define PTRS_PER_PGD    512
-
-/*
- * 3rd level page
- */
-#define PUD_SHIFT       30
-#define PTRS_PER_PUD    512
-
-/*
- * PMD_SHIFT determines the size of the area a middle-level
- * page table can map
- */
-#define PMD_SHIFT       21
-#define PTRS_PER_PMD    512
-
-/*
- * entries per page directory level
- */
-#define PTRS_PER_PTE    512
-
 #ifndef __ASSEMBLY__
 
 #define pte_ERROR(e)                                    \
@@ -67,9 +42,6 @@ extern void paging_init(void);
         printk("%s:%d: bad pgd %p(%016lx).\n",          \
                __FILE__, __LINE__, &(e), pgd_val(e))
 
-#define pgd_none(x)     (!pgd_val(x))
-#define pud_none(x)     (!pud_val(x))
-
 struct mm_struct;
 
 void set_pte_vaddr_pud(pud_t *pud_page, unsigned long vaddr, pte_t new_pte);
@@ -134,48 +106,6 @@ static inline void native_pgd_clear(pgd_t *pgd)
         native_set_pgd(pgd, native_make_pgd(0));
 }
 
-#define pte_same(a, b)          ((a).pte == (b).pte)
-
-#endif /* !__ASSEMBLY__ */
-
-#define PMD_SIZE        (_AC(1, UL) << PMD_SHIFT)
-#define PMD_MASK        (~(PMD_SIZE - 1))
-#define PUD_SIZE        (_AC(1, UL) << PUD_SHIFT)
-#define PUD_MASK        (~(PUD_SIZE - 1))
-#define PGDIR_SIZE      (_AC(1, UL) << PGDIR_SHIFT)
-#define PGDIR_MASK      (~(PGDIR_SIZE - 1))
-
-
-#define MAXMEM           _AC(__AC(1, UL) << MAX_PHYSMEM_BITS, UL)
-#define VMALLOC_START    _AC(0xffffc20000000000, UL)
-#define VMALLOC_END      _AC(0xffffe1ffffffffff, UL)
-#define VMEMMAP_START    _AC(0xffffe20000000000, UL)
-#define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
-#define MODULES_END      _AC(0xffffffffff000000, UL)
-#define MODULES_LEN   (MODULES_END - MODULES_VADDR)
-
-#ifndef __ASSEMBLY__
-
-static inline int pgd_bad(pgd_t pgd)
-{
-        return (pgd_val(pgd) & ~(PTE_PFN_MASK | _PAGE_USER)) != _KERNPG_TABLE;
-}
-
-static inline int pud_bad(pud_t pud)
-{
-        return (pud_val(pud) & ~(PTE_PFN_MASK | _PAGE_USER)) != _KERNPG_TABLE;
-}
-
-static inline int pmd_bad(pmd_t pmd)
-{
-        return (pmd_val(pmd) & ~(PTE_PFN_MASK | _PAGE_USER)) != _KERNPG_TABLE;
-}
-
-#define pte_none(x)     (!pte_val((x)))
-#define pte_present(x)  (pte_val((x)) & (_PAGE_PRESENT | _PAGE_PROTNONE))
-
-#define pages_to_mb(x)  ((x) >> (20 - PAGE_SHIFT))   /* FIXME: is this right? */
-
 /*
  * Conversion functions: convert a page and protection to a page entry,
  * and a page entry and page directory to the page they refer to.
@@ -184,41 +114,12 @@ static inline int pmd_bad(pmd_t pmd)
 /*
  * Level 4 access.
  */
-#define pgd_page_vaddr(pgd)                                             \
-        ((unsigned long)__va((unsigned long)pgd_val((pgd)) & PTE_PFN_MASK))
-#define pgd_page(pgd)           (pfn_to_page(pgd_val((pgd)) >> PAGE_SHIFT))
-#define pgd_present(pgd) (pgd_val(pgd) & _PAGE_PRESENT)
 static inline int pgd_large(pgd_t pgd) { return 0; }
 #define mk_kernel_pgd(address) __pgd((address) | _KERNPG_TABLE)
 
 /* PUD - Level3 access */
-/* to find an entry in a page-table-directory. */
-#define pud_page_vaddr(pud)                                             \
-        ((unsigned long)__va(pud_val((pud)) & PHYSICAL_PAGE_MASK))
-#define pud_page(pud)   (pfn_to_page(pud_val((pud)) >> PAGE_SHIFT))
-#define pud_index(address) (((address) >> PUD_SHIFT) & (PTRS_PER_PUD - 1))
-#define pud_offset(pgd, address)                                        \
-        ((pud_t *)pgd_page_vaddr(*(pgd)) + pud_index((address)))
-#define pud_present(pud) (pud_val((pud)) & _PAGE_PRESENT)
-
-static inline int pud_large(pud_t pte)
-{
-        return (pud_val(pte) & (_PAGE_PSE | _PAGE_PRESENT)) ==
-                (_PAGE_PSE | _PAGE_PRESENT);
-}
 
 /* PMD  - Level 2 access */
-#define pmd_page_vaddr(pmd) ((unsigned long) __va(pmd_val((pmd)) & PTE_PFN_MASK))
-#define pmd_page(pmd)           (pfn_to_page(pmd_val((pmd)) >> PAGE_SHIFT))
-
-#define pmd_index(address) (((address) >> PMD_SHIFT) & (PTRS_PER_PMD - 1))
-#define pmd_offset(dir, address) ((pmd_t *)pud_page_vaddr(*(dir)) + \
-                                  pmd_index(address))
-#define pmd_none(x)     (!pmd_val((x)))
-#define pmd_present(x)  (pmd_val((x)) & _PAGE_PRESENT)
-#define pfn_pmd(nr, prot) (__pmd(((nr) << PAGE_SHIFT) | pgprot_val((prot))))
-#define pmd_pfn(x)  ((pmd_val((x)) & __PHYSICAL_MASK) >> PAGE_SHIFT)
-
 #define pte_to_pgoff(pte) ((pte_val((pte)) & PHYSICAL_PAGE_MASK) >> PAGE_SHIFT)
 #define pgoff_to_pte(off) ((pte_t) { .pte = ((off) << PAGE_SHIFT) |     \
                                             _PAGE_FILE })
@@ -226,13 +127,6 @@ static inline int pud_large(pud_t pte)
 
 /* PTE - Level 1 access. */
 
-/* page, protection -> pte */
-#define mk_pte(page, pgprot)    pfn_pte(page_to_pfn((page)), (pgprot))
-
-#define pte_index(address) (((address) >> PAGE_SHIFT) & (PTRS_PER_PTE - 1))
-#define pte_offset_kernel(dir, address) ((pte_t *) pmd_page_vaddr(*(dir)) + \
-                                         pte_index((address)))
-
 /* x86-64 always has all page tables mapped. */
 #define pte_offset_map(dir, address) pte_offset_kernel((dir), (address))
 #define pte_offset_map_nested(dir, address) pte_offset_kernel((dir), (address))
@@ -266,9 +160,6 @@ extern int direct_gbpages;
 extern int kern_addr_valid(unsigned long addr);
 extern void cleanup_highmap(void);
 
-#define io_remap_pfn_range(vma, vaddr, pfn, size, prot) \
-        remap_pfn_range(vma, vaddr, pfn, size, prot)
-
 #define HAVE_ARCH_UNMAPPED_AREA
 #define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
 
diff --git a/arch/x86/include/asm/pgtable_64_types.h b/arch/x86/include/asm/pgtable_64_types.h
new file mode 100644
index 00000000000..2f59135c6f2
--- /dev/null
+++ b/arch/x86/include/asm/pgtable_64_types.h
@@ -0,0 +1,62 @@
+#ifndef _ASM_X86_PGTABLE_64_DEFS_H
+#define _ASM_X86_PGTABLE_64_DEFS_H
+
+#ifndef __ASSEMBLY__
+#include <linux/types.h>
+
+/*
+ * These are used to make use of C type-checking..
+ */
+typedef unsigned long   pteval_t;
+typedef unsigned long   pmdval_t;
+typedef unsigned long   pudval_t;
+typedef unsigned long   pgdval_t;
+typedef unsigned long   pgprotval_t;
+
+typedef struct { pteval_t pte; } pte_t;
+
+#endif  /* !__ASSEMBLY__ */
+
+#define SHARED_KERNEL_PMD       0
+
+/*
+ * PGDIR_SHIFT determines what a top-level page table entry can map
+ */
+#define PGDIR_SHIFT     39
+#define PTRS_PER_PGD    512
+
+/*
+ * 3rd level page
+ */
+#define PUD_SHIFT       30
+#define PTRS_PER_PUD    512
+
+/*
+ * PMD_SHIFT determines the size of the area a middle-level
+ * page table can map
+ */
+#define PMD_SHIFT       21
+#define PTRS_PER_PMD    512
+
+/*
+ * entries per page directory level
+ */
+#define PTRS_PER_PTE    512
+
+#define PMD_SIZE        (_AC(1, UL) << PMD_SHIFT)
+#define PMD_MASK        (~(PMD_SIZE - 1))
+#define PUD_SIZE        (_AC(1, UL) << PUD_SHIFT)
+#define PUD_MASK        (~(PUD_SIZE - 1))
+#define PGDIR_SIZE      (_AC(1, UL) << PGDIR_SHIFT)
+#define PGDIR_MASK      (~(PGDIR_SIZE - 1))
+
+
+#define MAXMEM           _AC(__AC(1, UL) << MAX_PHYSMEM_BITS, UL)
+#define VMALLOC_START    _AC(0xffffc20000000000, UL)
+#define VMALLOC_END      _AC(0xffffe1ffffffffff, UL)
+#define VMEMMAP_START    _AC(0xffffe20000000000, UL)
+#define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
+#define MODULES_END      _AC(0xffffffffff000000, UL)
+#define MODULES_LEN   (MODULES_END - MODULES_VADDR)
+
+#endif /* _ASM_X86_PGTABLE_64_DEFS_H */
diff --git a/arch/x86/include/asm/pgtable_types.h b/arch/x86/include/asm/pgtable_types.h
new file mode 100644
index 00000000000..9dafe87be2d
--- /dev/null
+++ b/arch/x86/include/asm/pgtable_types.h
@@ -0,0 +1,322 @@
+#ifndef _ASM_X86_PGTABLE_DEFS_H
+#define _ASM_X86_PGTABLE_DEFS_H
+
+#include <linux/const.h>
+#include <asm/page_types.h>
+
+#define FIRST_USER_ADDRESS      0
+
+#define _PAGE_BIT_PRESENT       0       /* is present */
+#define _PAGE_BIT_RW            1       /* writeable */
+#define _PAGE_BIT_USER          2       /* userspace addressable */
+#define _PAGE_BIT_PWT           3       /* page write through */
+#define _PAGE_BIT_PCD           4       /* page cache disabled */
+#define _PAGE_BIT_ACCESSED      5       /* was accessed (raised by CPU) */
+#define _PAGE_BIT_DIRTY         6       /* was written to (raised by CPU) */
+#define _PAGE_BIT_PSE           7       /* 4 MB (or 2MB) page */
+#define _PAGE_BIT_PAT           7       /* on 4KB pages */
+#define _PAGE_BIT_GLOBAL        8       /* Global TLB entry PPro+ */
+#define _PAGE_BIT_UNUSED1       9       /* available for programmer */
+#define _PAGE_BIT_IOMAP         10      /* flag used to indicate IO mapping */
+#define _PAGE_BIT_UNUSED3       11
+#define _PAGE_BIT_PAT_LARGE     12      /* On 2MB or 1GB pages */
+#define _PAGE_BIT_SPECIAL       _PAGE_BIT_UNUSED1
+#define _PAGE_BIT_CPA_TEST      _PAGE_BIT_UNUSED1
+#define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
+
+/* If _PAGE_BIT_PRESENT is clear, we use these: */
+/* - if the user mapped it with PROT_NONE; pte_present gives true */
+#define _PAGE_BIT_PROTNONE      _PAGE_BIT_GLOBAL
+/* - set: nonlinear file mapping, saved PTE; unset:swap */
+#define _PAGE_BIT_FILE          _PAGE_BIT_DIRTY
+
+#define _PAGE_PRESENT   (_AT(pteval_t, 1) << _PAGE_BIT_PRESENT)
+#define _PAGE_RW        (_AT(pteval_t, 1) << _PAGE_BIT_RW)
+#define _PAGE_USER      (_AT(pteval_t, 1) << _PAGE_BIT_USER)
+#define _PAGE_PWT       (_AT(pteval_t, 1) << _PAGE_BIT_PWT)
+#define _PAGE_PCD       (_AT(pteval_t, 1) << _PAGE_BIT_PCD)
+#define _PAGE_ACCESSED  (_AT(pteval_t, 1) << _PAGE_BIT_ACCESSED)
+#define _PAGE_DIRTY     (_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
+#define _PAGE_PSE       (_AT(pteval_t, 1) << _PAGE_BIT_PSE)
+#define _PAGE_GLOBAL    (_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
+#define _PAGE_UNUSED1   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
+#define _PAGE_IOMAP     (_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
+#define _PAGE_UNUSED3   (_AT(pteval_t, 1) << _PAGE_BIT_UNUSED3)
+#define _PAGE_PAT       (_AT(pteval_t, 1) << _PAGE_BIT_PAT)
+#define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
+#define _PAGE_SPECIAL   (_AT(pteval_t, 1) << _PAGE_BIT_SPECIAL)
+#define _PAGE_CPA_TEST  (_AT(pteval_t, 1) << _PAGE_BIT_CPA_TEST)
+#define __HAVE_ARCH_PTE_SPECIAL
+
+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+#define _PAGE_NX        (_AT(pteval_t, 1) << _PAGE_BIT_NX)
+#else
+#define _PAGE_NX        (_AT(pteval_t, 0))
+#endif
+
+#define _PAGE_FILE      (_AT(pteval_t, 1) << _PAGE_BIT_FILE)
+#define _PAGE_PROTNONE  (_AT(pteval_t, 1) << _PAGE_BIT_PROTNONE)
+
+#define _PAGE_TABLE     (_PAGE_PRESENT | _PAGE_RW | _PAGE_USER |        \
+                         _PAGE_ACCESSED | _PAGE_DIRTY)
+#define _KERNPG_TABLE   (_PAGE_PRESENT | _PAGE_RW | _PAGE_ACCESSED |    \
+                         _PAGE_DIRTY)
+
+/* Set of bits not changed in pte_modify */
+#define _PAGE_CHG_MASK  (PTE_PFN_MASK | _PAGE_PCD | _PAGE_PWT |         \
+                         _PAGE_SPECIAL | _PAGE_ACCESSED | _PAGE_DIRTY)
+
+#define _PAGE_CACHE_MASK        (_PAGE_PCD | _PAGE_PWT)
+#define _PAGE_CACHE_WB          (0)
+#define _PAGE_CACHE_WC          (_PAGE_PWT)
+#define _PAGE_CACHE_UC_MINUS    (_PAGE_PCD)
+#define _PAGE_CACHE_UC          (_PAGE_PCD | _PAGE_PWT)
+
+#define PAGE_NONE       __pgprot(_PAGE_PROTNONE | _PAGE_ACCESSED)
+#define PAGE_SHARED     __pgprot(_PAGE_PRESENT | _PAGE_RW | _PAGE_USER | \
+                                 _PAGE_ACCESSED | _PAGE_NX)
+
+#define PAGE_SHARED_EXEC        __pgprot(_PAGE_PRESENT | _PAGE_RW |     \
+                                         _PAGE_USER | _PAGE_ACCESSED)
+#define PAGE_COPY_NOEXEC        __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
+                                         _PAGE_ACCESSED | _PAGE_NX)
+#define PAGE_COPY_EXEC          __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
+                                         _PAGE_ACCESSED)
+#define PAGE_COPY               PAGE_COPY_NOEXEC
+#define PAGE_READONLY           __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
+                                         _PAGE_ACCESSED | _PAGE_NX)
+#define PAGE_READONLY_EXEC      __pgprot(_PAGE_PRESENT | _PAGE_USER |   \
+                                         _PAGE_ACCESSED)
+
+#define __PAGE_KERNEL_EXEC                                              \
+        (_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
+#define __PAGE_KERNEL           (__PAGE_KERNEL_EXEC | _PAGE_NX)
+
+#define __PAGE_KERNEL_RO                (__PAGE_KERNEL & ~_PAGE_RW)
+#define __PAGE_KERNEL_RX                (__PAGE_KERNEL_EXEC & ~_PAGE_RW)
+#define __PAGE_KERNEL_EXEC_NOCACHE      (__PAGE_KERNEL_EXEC | _PAGE_PCD | _PAGE_PWT)
+#define __PAGE_KERNEL_WC                (__PAGE_KERNEL | _PAGE_CACHE_WC)
+#define __PAGE_KERNEL_NOCACHE           (__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
+#define __PAGE_KERNEL_UC_MINUS          (__PAGE_KERNEL | _PAGE_PCD)
+#define __PAGE_KERNEL_VSYSCALL          (__PAGE_KERNEL_RX | _PAGE_USER)
+#define __PAGE_KERNEL_VSYSCALL_NOCACHE  (__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
+#define __PAGE_KERNEL_LARGE             (__PAGE_KERNEL | _PAGE_PSE)
+#define __PAGE_KERNEL_LARGE_NOCACHE     (__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
+#define __PAGE_KERNEL_LARGE_EXEC        (__PAGE_KERNEL_EXEC | _PAGE_PSE)
+
+#define __PAGE_KERNEL_IO                (__PAGE_KERNEL | _PAGE_IOMAP)
+#define __PAGE_KERNEL_IO_NOCACHE        (__PAGE_KERNEL_NOCACHE | _PAGE_IOMAP)
+#define __PAGE_KERNEL_IO_UC_MINUS       (__PAGE_KERNEL_UC_MINUS | _PAGE_IOMAP)
+#define __PAGE_KERNEL_IO_WC             (__PAGE_KERNEL_WC | _PAGE_IOMAP)
+
+#define PAGE_KERNEL                     __pgprot(__PAGE_KERNEL)
+#define PAGE_KERNEL_RO                  __pgprot(__PAGE_KERNEL_RO)
+#define PAGE_KERNEL_EXEC                __pgprot(__PAGE_KERNEL_EXEC)
+#define PAGE_KERNEL_RX                  __pgprot(__PAGE_KERNEL_RX)
+#define PAGE_KERNEL_WC                  __pgprot(__PAGE_KERNEL_WC)
+#define PAGE_KERNEL_NOCACHE             __pgprot(__PAGE_KERNEL_NOCACHE)
+#define PAGE_KERNEL_UC_MINUS            __pgprot(__PAGE_KERNEL_UC_MINUS)
+#define PAGE_KERNEL_EXEC_NOCACHE        __pgprot(__PAGE_KERNEL_EXEC_NOCACHE)
+#define PAGE_KERNEL_LARGE               __pgprot(__PAGE_KERNEL_LARGE)
+#define PAGE_KERNEL_LARGE_NOCACHE       __pgprot(__PAGE_KERNEL_LARGE_NOCACHE)
+#define PAGE_KERNEL_LARGE_EXEC          __pgprot(__PAGE_KERNEL_LARGE_EXEC)
+#define PAGE_KERNEL_VSYSCALL            __pgprot(__PAGE_KERNEL_VSYSCALL)
+#define PAGE_KERNEL_VSYSCALL_NOCACHE    __pgprot(__PAGE_KERNEL_VSYSCALL_NOCACHE)
+
+#define PAGE_KERNEL_IO                  __pgprot(__PAGE_KERNEL_IO)
+#define PAGE_KERNEL_IO_NOCACHE          __pgprot(__PAGE_KERNEL_IO_NOCACHE)
+#define PAGE_KERNEL_IO_UC_MINUS         __pgprot(__PAGE_KERNEL_IO_UC_MINUS)
+#define PAGE_KERNEL_IO_WC               __pgprot(__PAGE_KERNEL_IO_WC)
+
+/*         xwr */
+#define __P000  PAGE_NONE
+#define __P001  PAGE_READONLY
+#define __P010  PAGE_COPY
+#define __P011  PAGE_COPY
+#define __P100  PAGE_READONLY_EXEC
+#define __P101  PAGE_READONLY_EXEC
+#define __P110  PAGE_COPY_EXEC
+#define __P111  PAGE_COPY_EXEC
+
+#define __S000  PAGE_NONE
+#define __S001  PAGE_READONLY
+#define __S010  PAGE_SHARED
+#define __S011  PAGE_SHARED
+#define __S100  PAGE_READONLY_EXEC
+#define __S101  PAGE_READONLY_EXEC
+#define __S110  PAGE_SHARED_EXEC
+#define __S111  PAGE_SHARED_EXEC
+
+/*
+ * early identity mapping  pte attrib macros.
+ */
+#ifdef CONFIG_X86_64
+#define __PAGE_KERNEL_IDENT_LARGE_EXEC  __PAGE_KERNEL_LARGE_EXEC
+#else
+/*
+ * For PDE_IDENT_ATTR include USER bit. As the PDE and PTE protection
+ * bits are combined, this will alow user to access the high address mapped
+ * VDSO in the presence of CONFIG_COMPAT_VDSO
+ */
+#define PTE_IDENT_ATTR   0x003          /* PRESENT+RW */
+#define PDE_IDENT_ATTR   0x067          /* PRESENT+RW+USER+DIRTY+ACCESSED */
+#define PGD_IDENT_ATTR   0x001          /* PRESENT (no other attributes) */
+#endif
+
+#ifdef CONFIG_X86_32
+# include "pgtable_32_types.h"
+#else
+# include "pgtable_64_types.h"
+#endif
+
+#ifndef __ASSEMBLY__
+
+#include <linux/types.h>
+
+typedef struct pgprot { pgprotval_t pgprot; } pgprot_t;
+
+typedef struct { pgdval_t pgd; } pgd_t;
+
+static inline pgd_t native_make_pgd(pgdval_t val)
+{
+        return (pgd_t) { val };
+}
+
+static inline pgdval_t native_pgd_val(pgd_t pgd)
+{
+        return pgd.pgd;
+}
+
+static inline pgdval_t pgd_flags(pgd_t pgd)
+{
+        return native_pgd_val(pgd) & PTE_FLAGS_MASK;
+}
+
+#if PAGETABLE_LEVELS > 3
+typedef struct { pudval_t pud; } pud_t;
+
+static inline pud_t native_make_pud(pmdval_t val)
+{
+        return (pud_t) { val };
+}
+
+static inline pudval_t native_pud_val(pud_t pud)
+{
+        return pud.pud;
+}
+#else
+#include <asm-generic/pgtable-nopud.h>
+
+static inline pudval_t native_pud_val(pud_t pud)
+{
+        return native_pgd_val(pud.pgd);
+}
+#endif
+
+#if PAGETABLE_LEVELS > 2
+typedef struct { pmdval_t pmd; } pmd_t;
+
+static inline pmd_t native_make_pmd(pmdval_t val)
+{
+        return (pmd_t) { val };
+}
+
+static inline pmdval_t native_pmd_val(pmd_t pmd)
+{
+        return pmd.pmd;
+}
+#else
+#include <asm-generic/pgtable-nopmd.h>
+
+static inline pmdval_t native_pmd_val(pmd_t pmd)
+{
+        return native_pgd_val(pmd.pud.pgd);
+}
+#endif
+
+static inline pudval_t pud_flags(pud_t pud)
+{
+        return native_pud_val(pud) & PTE_FLAGS_MASK;
+}
+
+static inline pmdval_t pmd_flags(pmd_t pmd)
+{
+        return native_pmd_val(pmd) & PTE_FLAGS_MASK;
+}
+
+static inline pte_t native_make_pte(pteval_t val)
+{
+        return (pte_t) { .pte = val };
+}
+
+static inline pteval_t native_pte_val(pte_t pte)
+{
+        return pte.pte;
+}
+
+static inline pteval_t pte_flags(pte_t pte)
+{
+        return native_pte_val(pte) & PTE_FLAGS_MASK;
+}
+
+#define pgprot_val(x)   ((x).pgprot)
+#define __pgprot(x)     ((pgprot_t) { (x) } )
+
+
+typedef struct page *pgtable_t;
+
+extern pteval_t __supported_pte_mask;
+extern int nx_enabled;
+
+#define pgprot_writecombine     pgprot_writecombine
+extern pgprot_t pgprot_writecombine(pgprot_t prot);
+
+/* Indicate that x86 has its own track and untrack pfn vma functions */
+#define __HAVE_PFNMAP_TRACKING
+
+#define __HAVE_PHYS_MEM_ACCESS_PROT
+struct file;
+pgprot_t phys_mem_access_prot(struct file *file, unsigned long pfn,
+                              unsigned long size, pgprot_t vma_prot);
+int phys_mem_access_prot_allowed(struct file *file, unsigned long pfn,
+                              unsigned long size, pgprot_t *vma_prot);
+
+/* Install a pte for a particular vaddr in kernel space. */
+void set_pte_vaddr(unsigned long vaddr, pte_t pte);
+
+#ifdef CONFIG_X86_32
+extern void native_pagetable_setup_start(pgd_t *base);
+extern void native_pagetable_setup_done(pgd_t *base);
+#else
+static inline void native_pagetable_setup_start(pgd_t *base) {}
+static inline void native_pagetable_setup_done(pgd_t *base) {}
+#endif
+
+struct seq_file;
+extern void arch_report_meminfo(struct seq_file *m);
+
+enum {
+        PG_LEVEL_NONE,
+        PG_LEVEL_4K,
+        PG_LEVEL_2M,
+        PG_LEVEL_1G,
+        PG_LEVEL_NUM
+};
+
+#ifdef CONFIG_PROC_FS
+extern void update_page_count(int level, unsigned long pages);
+#else
+static inline void update_page_count(int level, unsigned long pages) { }
+#endif
+
+/*
+ * Helper function that returns the kernel pagetable entry controlling
+ * the virtual address 'address'. NULL means no pagetable entry present.
+ * NOTE: the return type is pte_t but if the pmd is PSE then we return it
+ * as a pte too.
+ */
+extern pte_t *lookup_address(unsigned long address, unsigned int *level);
+
+#endif  /* !__ASSEMBLY__ */
+
+#endif /* _ASM_X86_PGTABLE_DEFS_H */
diff --git a/arch/x86/include/asm/processor.h b/arch/x86/include/asm/processor.h
index 091cd8855f2..dabab1a19dd 100644
--- a/arch/x86/include/asm/processor.h
+++ b/arch/x86/include/asm/processor.h
@@ -16,6 +16,7 @@ struct mm_struct;
 #include <asm/cpufeature.h>
 #include <asm/system.h>
 #include <asm/page.h>
+#include <asm/pgtable_types.h>
 #include <asm/percpu.h>
 #include <asm/msr.h>
 #include <asm/desc_defs.h>
@@ -73,7 +74,7 @@ struct cpuinfo_x86 {
         char                    pad0;
 #else
         /* Number of 4K pages in DTLB/ITLB combined(in pages): */
-        int                      x86_tlbsize;
+        int                     x86_tlbsize;
         __u8                    x86_virt_bits;
         __u8                    x86_phys_bits;
 #endif
@@ -353,7 +354,7 @@ struct i387_soft_struct {
         u8                      no_update;
         u8                      rm;
         u8                      alimit;
-        struct info             *info;
+        struct math_emu_info    *info;
         u32                     entry_eip;
 };
 
@@ -378,7 +379,29 @@ union thread_xstate {
 
 #ifdef CONFIG_X86_64
 DECLARE_PER_CPU(struct orig_ist, orig_ist);
+
+union irq_stack_union {
+        char irq_stack[IRQ_STACK_SIZE];
+        /*
+         * GCC hardcodes the stack canary as %gs:40.  Since the
+         * irq_stack is the object at %gs:0, we reserve the bottom
+         * 48 bytes of the irq stack for the canary.
+         */
+        struct {
+                char gs_base[40];
+                unsigned long stack_canary;
+        };
+};
+
+DECLARE_PER_CPU(union irq_stack_union, irq_stack_union);
+DECLARE_INIT_PER_CPU(irq_stack_union);
+
+DECLARE_PER_CPU(char *, irq_stack_ptr);
+#else   /* X86_64 */
+#ifdef CONFIG_CC_STACKPROTECTOR
+DECLARE_PER_CPU(unsigned long, stack_canary);
 #endif
+#endif  /* X86_64 */
 
 extern void print_cpu_info(struct cpuinfo_x86 *);
 extern unsigned int xstate_size;
@@ -752,9 +775,9 @@ extern int sysenter_setup(void);
 extern struct desc_ptr          early_gdt_descr;
 
 extern void cpu_set_gdt(int);
-extern void switch_to_new_gdt(void);
+extern void switch_to_new_gdt(int);
+extern void load_percpu_segment(int);
 extern void cpu_init(void);
-extern void init_gdt(int cpu);
 
 static inline unsigned long get_debugctlmsr(void)
 {
diff --git a/arch/x86/include/asm/proto.h b/arch/x86/include/asm/proto.h
index d6a22f92ba7..49fb3ecf3bb 100644
--- a/arch/x86/include/asm/proto.h
+++ b/arch/x86/include/asm/proto.h
@@ -18,11 +18,7 @@ extern void syscall32_cpu_init(void);
 
 extern void check_efer(void);
 
-#ifdef CONFIG_X86_BIOS_REBOOT
 extern int reboot_force;
-#else
-static const int reboot_force = 0;
-#endif
 
 long do_arch_prctl(struct task_struct *task, int code, unsigned long addr);
 
diff --git a/arch/x86/include/asm/ptrace.h b/arch/x86/include/asm/ptrace.h
index 6d34d954c22..e304b66abee 100644
--- a/arch/x86/include/asm/ptrace.h
+++ b/arch/x86/include/asm/ptrace.h
@@ -28,7 +28,7 @@ struct pt_regs {
         int  xds;
         int  xes;
         int  xfs;
-        /* int  gs; */
+        int  xgs;
         long orig_eax;
         long eip;
         int  xcs;
@@ -50,7 +50,7 @@ struct pt_regs {
         unsigned long ds;
         unsigned long es;
         unsigned long fs;
-        /* int  gs; */
+        unsigned long gs;
         unsigned long orig_ax;
         unsigned long ip;
         unsigned long cs;
diff --git a/arch/x86/include/asm/mach-rdc321x/rdc321x_defs.h b/arch/x86/include/asm/rdc321x_defs.h
index c8e9c8bed3d..c8e9c8bed3d 100644
--- a/arch/x86/include/asm/mach-rdc321x/rdc321x_defs.h
+++ b/arch/x86/include/asm/rdc321x_defs.h
diff --git a/arch/x86/include/asm/segment.h b/arch/x86/include/asm/segment.h
index 1dc1b51ac62..14e0ed86a6f 100644
--- a/arch/x86/include/asm/segment.h
+++ b/arch/x86/include/asm/segment.h
@@ -61,7 +61,7 @@
  *
  *  26 - ESPFIX small SS
  *  27 - per-cpu                        [ offset to per-cpu data area ]
- *  28 - unused
+ *  28 - stack_canary-20                [ for stack protector ]
  *  29 - unused
  *  30 - unused
  *  31 - TSS for double fault handler
@@ -95,6 +95,13 @@
 #define __KERNEL_PERCPU 0
 #endif
 
+#define GDT_ENTRY_STACK_CANARY          (GDT_ENTRY_KERNEL_BASE + 16)
+#ifdef CONFIG_CC_STACKPROTECTOR
+#define __KERNEL_STACK_CANARY           (GDT_ENTRY_STACK_CANARY * 8)
+#else
+#define __KERNEL_STACK_CANARY           0
+#endif
+
 #define GDT_ENTRY_DOUBLEFAULT_TSS       31
 
 /*
diff --git a/arch/x86/include/asm/setup.h b/arch/x86/include/asm/setup.h
index 5a3a1371575..c230189462a 100644
--- a/arch/x86/include/asm/setup.h
+++ b/arch/x86/include/asm/setup.h
@@ -1,6 +1,8 @@
 #ifndef _ASM_X86_SETUP_H
 #define _ASM_X86_SETUP_H
 
+#ifdef __KERNEL__
+
 #define COMMAND_LINE_SIZE 2048
 
 #ifndef __ASSEMBLY__
@@ -26,15 +28,13 @@ struct x86_quirks {
         void (*mpc_oem_bus_info)(struct mpc_bus *m, char *name);
         void (*mpc_oem_pci_bus)(struct mpc_bus *m);
         void (*smp_read_mpc_oem)(struct mpc_oemtable *oemtable,
-                                    unsigned short oemsize);
+                                unsigned short oemsize);
         int (*setup_ioapic_ids)(void);
         int (*update_genapic)(void);
 };
 
 #endif /* __ASSEMBLY__ */
 
-#ifdef __KERNEL__
-
 #ifdef __i386__
 
 #include <linux/pfn.h>
@@ -99,7 +99,6 @@ extern unsigned long init_pg_tables_start;
 extern unsigned long init_pg_tables_end;
 
 #else
-void __init x86_64_init_pda(void);
 void __init x86_64_start_kernel(char *real_mode);
 void __init x86_64_start_reservations(char *real_mode_data);
 
diff --git a/arch/x86/include/asm/mach-default/setup_arch.h b/arch/x86/include/asm/setup_arch.h
index 38846208b54..38846208b54 100644
--- a/arch/x86/include/asm/mach-default/setup_arch.h
+++ b/arch/x86/include/asm/setup_arch.h
diff --git a/arch/x86/include/asm/smp.h b/arch/x86/include/asm/smp.h
index 19953df61c5..47d0e21f2b9 100644
--- a/arch/x86/include/asm/smp.h
+++ b/arch/x86/include/asm/smp.h
@@ -15,34 +15,8 @@
 #  include <asm/io_apic.h>
 # endif
 #endif
-#include <asm/pda.h>
 #include <asm/thread_info.h>
-
-#ifdef CONFIG_X86_64
-
-extern cpumask_var_t cpu_callin_mask;
-extern cpumask_var_t cpu_callout_mask;
-extern cpumask_var_t cpu_initialized_mask;
-extern cpumask_var_t cpu_sibling_setup_mask;
-
-#else /* CONFIG_X86_32 */
-
-extern cpumask_t cpu_callin_map;
-extern cpumask_t cpu_callout_map;
-extern cpumask_t cpu_initialized;
-extern cpumask_t cpu_sibling_setup_map;
-
-#define cpu_callin_mask         ((struct cpumask *)&cpu_callin_map)
-#define cpu_callout_mask        ((struct cpumask *)&cpu_callout_map)
-#define cpu_initialized_mask    ((struct cpumask *)&cpu_initialized)
-#define cpu_sibling_setup_mask  ((struct cpumask *)&cpu_sibling_setup_map)
-
-#endif /* CONFIG_X86_32 */
-
-extern void (*mtrr_hook)(void);
-extern void zap_low_mappings(void);
-
-extern int __cpuinit get_local_pda(int cpu);
+#include <asm/cpumask.h>
 
 extern int smp_num_siblings;
 extern unsigned int num_processors;
@@ -50,9 +24,7 @@ extern unsigned int num_processors;
 DECLARE_PER_CPU(cpumask_t, cpu_sibling_map);
 DECLARE_PER_CPU(cpumask_t, cpu_core_map);
 DECLARE_PER_CPU(u16, cpu_llc_id);
-#ifdef CONFIG_X86_32
 DECLARE_PER_CPU(int, cpu_number);
-#endif
 
 static inline struct cpumask *cpu_sibling_mask(int cpu)
 {
@@ -167,8 +139,6 @@ void play_dead_common(void);
 void native_send_call_func_ipi(const struct cpumask *mask);
 void native_send_call_func_single_ipi(int cpu);
 
-extern void prefill_possible_map(void);
-
 void smp_store_cpu_info(int id);
 #define cpu_physical_id(cpu)    per_cpu(x86_cpu_to_apicid, cpu)
 
@@ -177,10 +147,6 @@ static inline int num_booting_cpus(void)
 {
         return cpumask_weight(cpu_callout_mask);
 }
-#else
-static inline void prefill_possible_map(void)
-{
-}
 #endif /* CONFIG_SMP */
 
 extern unsigned disabled_cpus __cpuinitdata;
@@ -191,11 +157,11 @@ extern unsigned disabled_cpus __cpuinitdata;
  * from the initial startup. We map APIC_BASE very early in page_setup(),
  * so this is correct in the x86 case.
  */
-#define raw_smp_processor_id() (x86_read_percpu(cpu_number))
+#define raw_smp_processor_id() (percpu_read(cpu_number))
 extern int safe_smp_processor_id(void);
 
 #elif defined(CONFIG_X86_64_SMP)
-#define raw_smp_processor_id()  read_pda(cpunumber)
+#define raw_smp_processor_id() (percpu_read(cpu_number))
 
 #define stack_smp_processor_id()                                        \
 ({                                                              \
@@ -205,10 +171,6 @@ extern int safe_smp_processor_id(void);
 })
 #define safe_smp_processor_id()         smp_processor_id()
 
-#else /* !CONFIG_X86_32_SMP && !CONFIG_X86_64_SMP */
-#define cpu_physical_id(cpu)            boot_cpu_physical_apicid
-#define safe_smp_processor_id()         0
-#define stack_smp_processor_id()        0
 #endif
 
 #ifdef CONFIG_X86_LOCAL_APIC
@@ -220,28 +182,9 @@ static inline int logical_smp_processor_id(void)
         return GET_APIC_LOGICAL_ID(*(u32 *)(APIC_BASE + APIC_LDR));
 }
 
-#include <mach_apicdef.h>
-static inline unsigned int read_apic_id(void)
-{
-        unsigned int reg;
-
-        reg = *(u32 *)(APIC_BASE + APIC_ID);
-
-        return GET_APIC_ID(reg);
-}
 #endif
 
-
-# if defined(APIC_DEFINITION) || defined(CONFIG_X86_64)
 extern int hard_smp_processor_id(void);
-# else
-#include <mach_apicdef.h>
-static inline int hard_smp_processor_id(void)
-{
-        /* we don't want to mark this access volatile - bad code generation */
-        return read_apic_id();
-}
-# endif /* APIC_DEFINITION */
 
 #else /* CONFIG_X86_LOCAL_APIC */
 
@@ -251,11 +194,5 @@ static inline int hard_smp_processor_id(void)
 
 #endif /* CONFIG_X86_LOCAL_APIC */
 
-#ifdef CONFIG_X86_HAS_BOOT_CPU_ID
-extern unsigned char boot_cpu_id;
-#else
-#define boot_cpu_id     0
-#endif
-
 #endif /* __ASSEMBLY__ */
 #endif /* _ASM_X86_SMP_H */
diff --git a/arch/x86/include/asm/mach-default/smpboot_hooks.h b/arch/x86/include/asm/smpboot_hooks.h
index 23bf52103b8..1def6011490 100644
--- a/arch/x86/include/asm/mach-default/smpboot_hooks.h
+++ b/arch/x86/include/asm/smpboot_hooks.h
@@ -13,10 +13,10 @@ static inline void smpboot_setup_warm_reset_vector(unsigned long start_eip)
         CMOS_WRITE(0xa, 0xf);
         local_flush_tlb();
         pr_debug("1.\n");
-        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_HIGH)) =
+        *((volatile unsigned short *)phys_to_virt(apic->trampoline_phys_high)) =
                                                                  start_eip >> 4;
         pr_debug("2.\n");
-        *((volatile unsigned short *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) =
+        *((volatile unsigned short *)phys_to_virt(apic->trampoline_phys_low)) =
                                                          start_eip & 0xf;
         pr_debug("3.\n");
 }
@@ -34,7 +34,7 @@ static inline void smpboot_restore_warm_reset_vector(void)
          */
         CMOS_WRITE(0, 0xf);
 
-        *((volatile long *)phys_to_virt(TRAMPOLINE_PHYS_LOW)) = 0;
+        *((volatile long *)phys_to_virt(apic->trampoline_phys_low)) = 0;
 }
 
 static inline void __init smpboot_setup_io_apic(void)
diff --git a/arch/x86/include/asm/spinlock.h b/arch/x86/include/asm/spinlock.h
index d17c91981da..3a569665668 100644
--- a/arch/x86/include/asm/spinlock.h
+++ b/arch/x86/include/asm/spinlock.h
@@ -172,70 +172,8 @@ static inline int __ticket_spin_is_contended(raw_spinlock_t *lock)
         return (((tmp >> TICKET_SHIFT) - tmp) & ((1 << TICKET_SHIFT) - 1)) > 1;
 }
 
-#ifdef CONFIG_PARAVIRT
-/*
- * Define virtualization-friendly old-style lock byte lock, for use in
- * pv_lock_ops if desired.
- *
- * This differs from the pre-2.6.24 spinlock by always using xchgb
- * rather than decb to take the lock; this allows it to use a
- * zero-initialized lock structure.  It also maintains a 1-byte
- * contention counter, so that we can implement
- * __byte_spin_is_contended.
- */
-struct __byte_spinlock {
-        s8 lock;
-        s8 spinners;
-};
-
-static inline int __byte_spin_is_locked(raw_spinlock_t *lock)
-{
-        struct __byte_spinlock *bl = (struct __byte_spinlock *)lock;
-        return bl->lock != 0;
-}
-
-static inline int __byte_spin_is_contended(raw_spinlock_t *lock)
-{
-        struct __byte_spinlock *bl = (struct __byte_spinlock *)lock;
-        return bl->spinners != 0;
-}
-
-static inline void __byte_spin_lock(raw_spinlock_t *lock)
-{
-        struct __byte_spinlock *bl = (struct __byte_spinlock *)lock;
-        s8 val = 1;
-
-        asm("1: xchgb %1, %0\n"
-            "   test %1,%1\n"
-            "   jz 3f\n"
-            "   " LOCK_PREFIX "incb %2\n"
-            "2: rep;nop\n"
-            "   cmpb $1, %0\n"
-            "   je 2b\n"
-            "   " LOCK_PREFIX "decb %2\n"
-            "   jmp 1b\n"
-            "3:"
-            : "+m" (bl->lock), "+q" (val), "+m" (bl->spinners): : "memory");
-}
-
-static inline int __byte_spin_trylock(raw_spinlock_t *lock)
-{
-        struct __byte_spinlock *bl = (struct __byte_spinlock *)lock;
-        u8 old = 1;
-
-        asm("xchgb %1,%0"
-            : "+m" (bl->lock), "+q" (old) : : "memory");
+#ifndef CONFIG_PARAVIRT
 
-        return old == 0;
-}
-
-static inline void __byte_spin_unlock(raw_spinlock_t *lock)
-{
-        struct __byte_spinlock *bl = (struct __byte_spinlock *)lock;
-        smp_wmb();
-        bl->lock = 0;
-}
-#else  /* !CONFIG_PARAVIRT */
 static inline int __raw_spin_is_locked(raw_spinlock_t *lock)
 {
         return __ticket_spin_is_locked(lock);
@@ -245,6 +183,7 @@ static inline int __raw_spin_is_contended(raw_spinlock_t *lock)
 {
         return __ticket_spin_is_contended(lock);
 }
+#define __raw_spin_is_contended __raw_spin_is_contended
 
 static __always_inline void __raw_spin_lock(raw_spinlock_t *lock)
 {
@@ -267,7 +206,7 @@ static __always_inline void __raw_spin_lock_flags(raw_spinlock_t *lock,
         __raw_spin_lock(lock);
 }
 
-#endif  /* CONFIG_PARAVIRT */
+#endif
 
 static inline void __raw_spin_unlock_wait(raw_spinlock_t *lock)
 {
@@ -329,8 +268,7 @@ static inline int __raw_read_trylock(raw_rwlock_t *lock)
 {
         atomic_t *count = (atomic_t *)lock;
 
-        atomic_dec(count);
-        if (atomic_read(count) >= 0)
+        if (atomic_dec_return(count) >= 0)
                 return 1;
         atomic_inc(count);
         return 0;
diff --git a/arch/x86/include/asm/stackprotector.h b/arch/x86/include/asm/stackprotector.h
new file mode 100644
index 00000000000..c2d742c6e15
--- /dev/null
+++ b/arch/x86/include/asm/stackprotector.h
@@ -0,0 +1,124 @@
+/*
+ * GCC stack protector support.
+ *
+ * Stack protector works by putting predefined pattern at the start of
+ * the stack frame and verifying that it hasn't been overwritten when
+ * returning from the function.  The pattern is called stack canary
+ * and unfortunately gcc requires it to be at a fixed offset from %gs.
+ * On x86_64, the offset is 40 bytes and on x86_32 20 bytes.  x86_64
+ * and x86_32 use segment registers differently and thus handles this
+ * requirement differently.
+ *
+ * On x86_64, %gs is shared by percpu area and stack canary.  All
+ * percpu symbols are zero based and %gs points to the base of percpu
+ * area.  The first occupant of the percpu area is always
+ * irq_stack_union which contains stack_canary at offset 40.  Userland
+ * %gs is always saved and restored on kernel entry and exit using
+ * swapgs, so stack protector doesn't add any complexity there.
+ *
+ * On x86_32, it's slightly more complicated.  As in x86_64, %gs is
+ * used for userland TLS.  Unfortunately, some processors are much
+ * slower at loading segment registers with different value when
+ * entering and leaving the kernel, so the kernel uses %fs for percpu
+ * area and manages %gs lazily so that %gs is switched only when
+ * necessary, usually during task switch.
+ *
+ * As gcc requires the stack canary at %gs:20, %gs can't be managed
+ * lazily if stack protector is enabled, so the kernel saves and
+ * restores userland %gs on kernel entry and exit.  This behavior is
+ * controlled by CONFIG_X86_32_LAZY_GS and accessors are defined in
+ * system.h to hide the details.
+ */
+
+#ifndef _ASM_STACKPROTECTOR_H
+#define _ASM_STACKPROTECTOR_H 1
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+
+#include <asm/tsc.h>
+#include <asm/processor.h>
+#include <asm/percpu.h>
+#include <asm/system.h>
+#include <asm/desc.h>
+#include <linux/random.h>
+
+/*
+ * 24 byte read-only segment initializer for stack canary.  Linker
+ * can't handle the address bit shifting.  Address will be set in
+ * head_32 for boot CPU and setup_per_cpu_areas() for others.
+ */
+#define GDT_STACK_CANARY_INIT                                           \
+        [GDT_ENTRY_STACK_CANARY] = { { { 0x00000018, 0x00409000 } } },
+
+/*
+ * Initialize the stackprotector canary value.
+ *
+ * NOTE: this must only be called from functions that never return,
+ * and it must always be inlined.
+ */
+static __always_inline void boot_init_stack_canary(void)
+{
+        u64 canary;
+        u64 tsc;
+
+#ifdef CONFIG_X86_64
+        BUILD_BUG_ON(offsetof(union irq_stack_union, stack_canary) != 40);
+#endif
+        /*
+         * We both use the random pool and the current TSC as a source
+         * of randomness. The TSC only matters for very early init,
+         * there it already has some randomness on most systems. Later
+         * on during the bootup the random pool has true entropy too.
+         */
+        get_random_bytes(&canary, sizeof(canary));
+        tsc = __native_read_tsc();
+        canary += tsc + (tsc << 32UL);
+
+        current->stack_canary = canary;
+#ifdef CONFIG_X86_64
+        percpu_write(irq_stack_union.stack_canary, canary);
+#else
+        percpu_write(stack_canary, canary);
+#endif
+}
+
+static inline void setup_stack_canary_segment(int cpu)
+{
+#ifdef CONFIG_X86_32
+        unsigned long canary = (unsigned long)&per_cpu(stack_canary, cpu) - 20;
+        struct desc_struct *gdt_table = get_cpu_gdt_table(cpu);
+        struct desc_struct desc;
+
+        desc = gdt_table[GDT_ENTRY_STACK_CANARY];
+        desc.base0 = canary & 0xffff;
+        desc.base1 = (canary >> 16) & 0xff;
+        desc.base2 = (canary >> 24) & 0xff;
+        write_gdt_entry(gdt_table, GDT_ENTRY_STACK_CANARY, &desc, DESCTYPE_S);
+#endif
+}
+
+static inline void load_stack_canary_segment(void)
+{
+#ifdef CONFIG_X86_32
+        asm("mov %0, %%gs" : : "r" (__KERNEL_STACK_CANARY) : "memory");
+#endif
+}
+
+#else   /* CC_STACKPROTECTOR */
+
+#define GDT_STACK_CANARY_INIT
+
+/* dummy boot_init_stack_canary() is defined in linux/stackprotector.h */
+
+static inline void setup_stack_canary_segment(int cpu)
+{ }
+
+static inline void load_stack_canary_segment(void)
+{
+#ifdef CONFIG_X86_32
+        asm volatile ("mov %0, %%gs" : : "r" (0));
+#endif
+}
+
+#endif  /* CC_STACKPROTECTOR */
+#endif  /* _ASM_STACKPROTECTOR_H */
diff --git a/arch/x86/include/asm/summit/apic.h b/arch/x86/include/asm/summit/apic.h
deleted file mode 100644
index 93d2c8667cf..00000000000
--- a/arch/x86/include/asm/summit/apic.h
+++ /dev/null
@@ -1,202 +0,0 @@
-#ifndef __ASM_SUMMIT_APIC_H
-#define __ASM_SUMMIT_APIC_H
-
-#include <asm/smp.h>
-#include <linux/gfp.h>
-
-#define esr_disable (1)
-#define NO_BALANCE_IRQ (0)
-
-/* In clustered mode, the high nibble of APIC ID is a cluster number.
- * The low nibble is a 4-bit bitmap. */
-#define XAPIC_DEST_CPUS_SHIFT   4
-#define XAPIC_DEST_CPUS_MASK    ((1u << XAPIC_DEST_CPUS_SHIFT) - 1)
-#define XAPIC_DEST_CLUSTER_MASK (XAPIC_DEST_CPUS_MASK << XAPIC_DEST_CPUS_SHIFT)
-
-#define APIC_DFR_VALUE  (APIC_DFR_CLUSTER)
-
-static inline const cpumask_t *target_cpus(void)
-{
-        /* CPU_MASK_ALL (0xff) has undefined behaviour with
-         * dest_LowestPrio mode logical clustered apic interrupt routing
-         * Just start on cpu 0.  IRQ balancing will spread load
-         */
-        return &cpumask_of_cpu(0);
-}
-
-#define INT_DELIVERY_MODE (dest_LowestPrio)
-#define INT_DEST_MODE 1     /* logical delivery broadcast to all procs */
-
-static inline unsigned long check_apicid_used(physid_mask_t bitmap, int apicid)
-{
-        return 0;
-}
-
-/* we don't use the phys_cpu_present_map to indicate apicid presence */
-static inline unsigned long check_apicid_present(int bit)
-{
-        return 1;
-}
-
-#define apicid_cluster(apicid) ((apicid) & XAPIC_DEST_CLUSTER_MASK)
-
-extern u8 cpu_2_logical_apicid[];
-
-static inline void init_apic_ldr(void)
-{
-        unsigned long val, id;
-        int count = 0;
-        u8 my_id = (u8)hard_smp_processor_id();
-        u8 my_cluster = (u8)apicid_cluster(my_id);
-#ifdef CONFIG_SMP
-        u8 lid;
-        int i;
-
-        /* Create logical APIC IDs by counting CPUs already in cluster. */
-        for (count = 0, i = nr_cpu_ids; --i >= 0; ) {
-                lid = cpu_2_logical_apicid[i];
-                if (lid != BAD_APICID && apicid_cluster(lid) == my_cluster)
-                        ++count;
-        }
-#endif
-        /* We only have a 4 wide bitmap in cluster mode.  If a deranged
-         * BIOS puts 5 CPUs in one APIC cluster, we're hosed. */
-        BUG_ON(count >= XAPIC_DEST_CPUS_SHIFT);
-        id = my_cluster | (1UL << count);
-        apic_write(APIC_DFR, APIC_DFR_VALUE);
-        val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
-        val |= SET_APIC_LOGICAL_ID(id);
-        apic_write(APIC_LDR, val);
-}
-
-static inline int multi_timer_check(int apic, int irq)
-{
-        return 0;
-}
-
-static inline int apic_id_registered(void)
-{
-        return 1;
-}
-
-static inline void setup_apic_routing(void)
-{
-        printk("Enabling APIC mode:  Summit.  Using %d I/O APICs\n",
-                                                nr_ioapics);
-}
-
-static inline int apicid_to_node(int logical_apicid)
-{
-#ifdef CONFIG_SMP
-        return apicid_2_node[hard_smp_processor_id()];
-#else
-        return 0;
-#endif
-}
-
-/* Mapping from cpu number to logical apicid */
-static inline int cpu_to_logical_apicid(int cpu)
-{
-#ifdef CONFIG_SMP
-        if (cpu >= nr_cpu_ids)
-                return BAD_APICID;
-        return (int)cpu_2_logical_apicid[cpu];
-#else
-        return logical_smp_processor_id();
-#endif
-}
-
-static inline int cpu_present_to_apicid(int mps_cpu)
-{
-        if (mps_cpu < nr_cpu_ids)
-                return (int)per_cpu(x86_bios_cpu_apicid, mps_cpu);
-        else
-                return BAD_APICID;
-}
-
-static inline physid_mask_t ioapic_phys_id_map(physid_mask_t phys_id_map)
-{
-        /* For clustered we don't have a good way to do this yet - hack */
-        return physids_promote(0x0F);
-}
-
-static inline physid_mask_t apicid_to_cpu_present(int apicid)
-{
-        return physid_mask_of_physid(0);
-}
-
-static inline void setup_portio_remap(void)
-{
-}
-
-static inline int check_phys_apicid_present(int boot_cpu_physical_apicid)
-{
-        return 1;
-}
-
-static inline void enable_apic_mode(void)
-{
-}
-
-static inline unsigned int cpu_mask_to_apicid(const cpumask_t *cpumask)
-{
-        int num_bits_set;
-        int cpus_found = 0;
-        int cpu;
-        int apicid;
-
-        num_bits_set = cpus_weight(*cpumask);
-        /* Return id to all */
-        if (num_bits_set >= nr_cpu_ids)
-                return (int) 0xFF;
-        /*
-         * The cpus in the mask must all be on the apic cluster.  If are not
-         * on the same apicid cluster return default value of TARGET_CPUS.
-         */
-        cpu = first_cpu(*cpumask);
-        apicid = cpu_to_logical_apicid(cpu);
-        while (cpus_found < num_bits_set) {
-                if (cpu_isset(cpu, *cpumask)) {
-                        int new_apicid = cpu_to_logical_apicid(cpu);
-                        if (apicid_cluster(apicid) !=
-                                        apicid_cluster(new_apicid)){
-                                printk ("%s: Not a valid mask!\n", __func__);
-                                return 0xFF;
-                        }
-                        apicid = apicid | new_apicid;
-                        cpus_found++;
-                }
-                cpu++;
-        }
-        return apicid;
-}
-
-static inline unsigned int cpu_mask_to_apicid_and(const struct cpumask *inmask,
-                                                  const struct cpumask *andmask)
-{
-        int apicid = cpu_to_logical_apicid(0);
-        cpumask_var_t cpumask;
-
-        if (!alloc_cpumask_var(&cpumask, GFP_ATOMIC))
-                return apicid;
-
-        cpumask_and(cpumask, inmask, andmask);
-        cpumask_and(cpumask, cpumask, cpu_online_mask);
-        apicid = cpu_mask_to_apicid(cpumask);
-
-        free_cpumask_var(cpumask);
-        return apicid;
-}
-
-/* cpuid returns the value latched in the HW at reset, not the APIC ID
- * register's value.  For any box whose BIOS changes APIC IDs, like
- * clustered APIC systems, we must use hard_smp_processor_id.
- *
- * See Intel's IA-32 SW Dev's Manual Vol2 under CPUID.
- */
-static inline u32 phys_pkg_id(u32 cpuid_apic, int index_msb)
-{
-        return hard_smp_processor_id() >> index_msb;
-}
-
-#endif /* __ASM_SUMMIT_APIC_H */
diff --git a/arch/x86/include/asm/summit/apicdef.h b/arch/x86/include/asm/summit/apicdef.h
deleted file mode 100644
index f3fbca1f61c..00000000000
--- a/arch/x86/include/asm/summit/apicdef.h
+++ /dev/null
@@ -1,13 +0,0 @@
-#ifndef __ASM_SUMMIT_APICDEF_H
-#define __ASM_SUMMIT_APICDEF_H
-
-#define         APIC_ID_MASK            (0xFF<<24)
-
-static inline unsigned get_apic_id(unsigned long x)
-{
-        return (x>>24)&0xFF;
-}
-
-#define         GET_APIC_ID(x)  get_apic_id(x)
-
-#endif
diff --git a/arch/x86/include/asm/summit/ipi.h b/arch/x86/include/asm/summit/ipi.h
deleted file mode 100644
index a8a2c24f50c..00000000000
--- a/arch/x86/include/asm/summit/ipi.h
+++ /dev/null
@@ -1,26 +0,0 @@
-#ifndef __ASM_SUMMIT_IPI_H
-#define __ASM_SUMMIT_IPI_H
-
-void send_IPI_mask_sequence(const cpumask_t *mask, int vector);
-void send_IPI_mask_allbutself(const cpumask_t *mask, int vector);
-
-static inline void send_IPI_mask(const cpumask_t *mask, int vector)
-{
-        send_IPI_mask_sequence(mask, vector);
-}
-
-static inline void send_IPI_allbutself(int vector)
-{
-        cpumask_t mask = cpu_online_map;
-        cpu_clear(smp_processor_id(), mask);
-
-        if (!cpus_empty(mask))
-                send_IPI_mask(&mask, vector);
-}
-
-static inline void send_IPI_all(int vector)
-{
-        send_IPI_mask(&cpu_online_map, vector);
-}
-
-#endif /* __ASM_SUMMIT_IPI_H */
diff --git a/arch/x86/include/asm/summit/mpparse.h b/arch/x86/include/asm/summit/mpparse.h
deleted file mode 100644
index 380e86c0236..00000000000
--- a/arch/x86/include/asm/summit/mpparse.h
+++ /dev/null
@@ -1,109 +0,0 @@
-#ifndef __ASM_SUMMIT_MPPARSE_H
-#define __ASM_SUMMIT_MPPARSE_H
-
-#include <asm/tsc.h>
-
-extern int use_cyclone;
-
-#ifdef CONFIG_X86_SUMMIT_NUMA
-extern void setup_summit(void);
-#else
-#define setup_summit()  {}
-#endif
-
-static inline int mps_oem_check(struct mpc_table *mpc, char *oem,
-                char *productid)
-{
-        if (!strncmp(oem, "IBM ENSW", 8) &&
-                        (!strncmp(productid, "VIGIL SMP", 9)
-                         || !strncmp(productid, "EXA", 3)
-                         || !strncmp(productid, "RUTHLESS SMP", 12))){
-                mark_tsc_unstable("Summit based system");
-                use_cyclone = 1; /*enable cyclone-timer*/
-                setup_summit();
-                return 1;
-        }
-        return 0;
-}
-
-/* Hook from generic ACPI tables.c */
-static inline int acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-        if (!strncmp(oem_id, "IBM", 3) &&
-            (!strncmp(oem_table_id, "SERVIGIL", 8)
-             || !strncmp(oem_table_id, "EXA", 3))){
-                mark_tsc_unstable("Summit based system");
-                use_cyclone = 1; /*enable cyclone-timer*/
-                setup_summit();
-                return 1;
-        }
-        return 0;
-}
-
-struct rio_table_hdr {
-        unsigned char version;      /* Version number of this data structure           */
-                                    /* Version 3 adds chassis_num & WP_index           */
-        unsigned char num_scal_dev; /* # of Scalability devices (Twisters for Vigil)   */
-        unsigned char num_rio_dev;  /* # of RIO I/O devices (Cyclones and Winnipegs)   */
-} __attribute__((packed));
-
-struct scal_detail {
-        unsigned char node_id;      /* Scalability Node ID                             */
-        unsigned long CBAR;         /* Address of 1MB register space                   */
-        unsigned char port0node;    /* Node ID port connected to: 0xFF=None            */
-        unsigned char port0port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
-        unsigned char port1node;    /* Node ID port connected to: 0xFF = None          */
-        unsigned char port1port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
-        unsigned char port2node;    /* Node ID port connected to: 0xFF = None          */
-        unsigned char port2port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
-        unsigned char chassis_num;  /* 1 based Chassis number (1 = boot node)          */
-} __attribute__((packed));
-
-struct rio_detail {
-        unsigned char node_id;      /* RIO Node ID                                     */
-        unsigned long BBAR;         /* Address of 1MB register space                   */
-        unsigned char type;         /* Type of device                                  */
-        unsigned char owner_id;     /* For WPEG: Node ID of Cyclone that owns this WPEG*/
-                                    /* For CYC:  Node ID of Twister that owns this CYC */
-        unsigned char port0node;    /* Node ID port connected to: 0xFF=None            */
-        unsigned char port0port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
-        unsigned char port1node;    /* Node ID port connected to: 0xFF=None            */
-        unsigned char port1port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
-        unsigned char first_slot;   /* For WPEG: Lowest slot number below this WPEG    */
-                                    /* For CYC:  0                                     */
-        unsigned char status;       /* For WPEG: Bit 0 = 1 : the XAPIC is used         */
-                                    /*                 = 0 : the XAPIC is not used, ie:*/
-                                    /*                     ints fwded to another XAPIC */
-                                    /*           Bits1:7 Reserved                      */
-                                    /* For CYC:  Bits0:7 Reserved                      */
-        unsigned char WP_index;     /* For WPEG: WPEG instance index - lower ones have */
-                                    /*           lower slot numbers/PCI bus numbers    */
-                                    /* For CYC:  No meaning                            */
-        unsigned char chassis_num;  /* 1 based Chassis number                          */
-                                    /* For LookOut WPEGs this field indicates the      */
-                                    /* Expansion Chassis #, enumerated from Boot       */
-                                    /* Node WPEG external port, then Boot Node CYC     */
-                                    /* external port, then Next Vigil chassis WPEG     */
-                                    /* external port, etc.                             */
-                                    /* Shared Lookouts have only 1 chassis number (the */
-                                    /* first one assigned)                             */
-} __attribute__((packed));
-
-
-typedef enum {
-        CompatTwister = 0,  /* Compatibility Twister               */
-        AltTwister    = 1,  /* Alternate Twister of internal 8-way */
-        CompatCyclone = 2,  /* Compatibility Cyclone               */
-        AltCyclone    = 3,  /* Alternate Cyclone of internal 8-way */
-        CompatWPEG    = 4,  /* Compatibility WPEG                  */
-        AltWPEG       = 5,  /* Second Planar WPEG                  */
-        LookOutAWPEG  = 6,  /* LookOut WPEG                        */
-        LookOutBWPEG  = 7,  /* LookOut WPEG                        */
-} node_type;
-
-static inline int is_WPEG(struct rio_detail *rio){
-        return (rio->type == CompatWPEG || rio->type == AltWPEG ||
-                rio->type == LookOutAWPEG || rio->type == LookOutBWPEG);
-}
-
-#endif /* __ASM_SUMMIT_MPPARSE_H */
diff --git a/arch/x86/include/asm/syscalls.h b/arch/x86/include/asm/syscalls.h
index e26d34b0bc7..258ef730aaa 100644
--- a/arch/x86/include/asm/syscalls.h
+++ b/arch/x86/include/asm/syscalls.h
@@ -29,21 +29,21 @@ asmlinkage int sys_get_thread_area(struct user_desc __user *);
 /* X86_32 only */
 #ifdef CONFIG_X86_32
 /* kernel/process_32.c */
-asmlinkage int sys_fork(struct pt_regs);
-asmlinkage int sys_clone(struct pt_regs);
-asmlinkage int sys_vfork(struct pt_regs);
-asmlinkage int sys_execve(struct pt_regs);
+int sys_fork(struct pt_regs *);
+int sys_clone(struct pt_regs *);
+int sys_vfork(struct pt_regs *);
+int sys_execve(struct pt_regs *);
 
 /* kernel/signal_32.c */
 asmlinkage int sys_sigsuspend(int, int, old_sigset_t);
 asmlinkage int sys_sigaction(int, const struct old_sigaction __user *,
                              struct old_sigaction __user *);
-asmlinkage int sys_sigaltstack(unsigned long);
-asmlinkage unsigned long sys_sigreturn(unsigned long);
-asmlinkage int sys_rt_sigreturn(unsigned long);
+int sys_sigaltstack(struct pt_regs *);
+unsigned long sys_sigreturn(struct pt_regs *);
+long sys_rt_sigreturn(struct pt_regs *);
 
 /* kernel/ioport.c */
-asmlinkage long sys_iopl(unsigned long);
+long sys_iopl(struct pt_regs *);
 
 /* kernel/sys_i386_32.c */
 asmlinkage long sys_mmap2(unsigned long, unsigned long, unsigned long,
@@ -59,8 +59,8 @@ struct oldold_utsname;
 asmlinkage int sys_olduname(struct oldold_utsname __user *);
 
 /* kernel/vm86_32.c */
-asmlinkage int sys_vm86old(struct pt_regs);
-asmlinkage int sys_vm86(struct pt_regs);
+int sys_vm86old(struct pt_regs *);
+int sys_vm86(struct pt_regs *);
 
 #else /* CONFIG_X86_32 */
 
diff --git a/arch/x86/include/asm/system.h b/arch/x86/include/asm/system.h
index 8e626ea33a1..c00bfdbdd45 100644
--- a/arch/x86/include/asm/system.h
+++ b/arch/x86/include/asm/system.h
@@ -23,6 +23,20 @@ struct task_struct *__switch_to(struct task_struct *prev,
 
 #ifdef CONFIG_X86_32
 
+#ifdef CONFIG_CC_STACKPROTECTOR
+#define __switch_canary                                                 \
+        "movl %P[task_canary](%[next]), %%ebx\n\t"                      \
+        "movl %%ebx, "__percpu_arg([stack_canary])"\n\t"
+#define __switch_canary_oparam                                          \
+        , [stack_canary] "=m" (per_cpu_var(stack_canary))
+#define __switch_canary_iparam                                          \
+        , [task_canary] "i" (offsetof(struct task_struct, stack_canary))
+#else   /* CC_STACKPROTECTOR */
+#define __switch_canary
+#define __switch_canary_oparam
+#define __switch_canary_iparam
+#endif  /* CC_STACKPROTECTOR */
+
 /*
  * Saving eflags is important. It switches not only IOPL between tasks,
  * it also protects other tasks from NT leaking through sysenter etc.
@@ -44,6 +58,7 @@ do {									\
                      "movl %[next_sp],%%esp\n\t"        /* restore ESP   */ \
                      "movl $1f,%[prev_ip]\n\t"  /* save    EIP   */     \
                      "pushl %[next_ip]\n\t"     /* restore EIP   */     \
+                     __switch_canary                                    \
                      "jmp __switch_to\n"        /* regparm call  */     \
                      "1:\t"                                             \
                      "popl %%ebp\n\t"           /* restore EBP   */     \
@@ -58,6 +73,8 @@ do {									\
                        "=b" (ebx), "=c" (ecx), "=d" (edx),              \
                        "=S" (esi), "=D" (edi)                           \
                                                                         \
+                       __switch_canary_oparam                           \
+                                                                        \
                        /* input parameters: */                          \
                      : [next_sp]  "m" (next->thread.sp),                \
                        [next_ip]  "m" (next->thread.ip),                \
@@ -66,6 +83,8 @@ do {									\
                        [prev]     "a" (prev),                           \
                        [next]     "d" (next)                            \
                                                                         \
+                       __switch_canary_iparam                           \
+                                                                        \
                      : /* reloaded segment registers */                 \
                         "memory");                                      \
 } while (0)
@@ -86,27 +105,44 @@ do {									\
         , "rcx", "rbx", "rdx", "r8", "r9", "r10", "r11", \
           "r12", "r13", "r14", "r15"
 
+#ifdef CONFIG_CC_STACKPROTECTOR
+#define __switch_canary                                                   \
+        "movq %P[task_canary](%%rsi),%%r8\n\t"                            \
+        "movq %%r8,"__percpu_arg([gs_canary])"\n\t"
+#define __switch_canary_oparam                                            \
+        , [gs_canary] "=m" (per_cpu_var(irq_stack_union.stack_canary))
+#define __switch_canary_iparam                                            \
+        , [task_canary] "i" (offsetof(struct task_struct, stack_canary))
+#else   /* CC_STACKPROTECTOR */
+#define __switch_canary
+#define __switch_canary_oparam
+#define __switch_canary_iparam
+#endif  /* CC_STACKPROTECTOR */
+
 /* Save restore flags to clear handle leaking NT */
 #define switch_to(prev, next, last) \
-        asm volatile(SAVE_CONTEXT                                                   \
+        asm volatile(SAVE_CONTEXT                                         \
              "movq %%rsp,%P[threadrsp](%[prev])\n\t" /* save RSP */       \
              "movq %P[threadrsp](%[next]),%%rsp\n\t" /* restore RSP */    \
              "call __switch_to\n\t"                                       \
              ".globl thread_return\n"                                     \
              "thread_return:\n\t"                                         \
-             "movq %%gs:%P[pda_pcurrent],%%rsi\n\t"                       \
+             "movq "__percpu_arg([current_task])",%%rsi\n\t"              \
+             __switch_canary                                              \
              "movq %P[thread_info](%%rsi),%%r8\n\t"                       \
-             LOCK_PREFIX "btr  %[tif_fork],%P[ti_flags](%%r8)\n\t"        \
              "movq %%rax,%%rdi\n\t"                                       \
-             "jc   ret_from_fork\n\t"                                     \
+             "testl  %[_tif_fork],%P[ti_flags](%%r8)\n\t"         \
+             "jnz   ret_from_fork\n\t"                                    \
              RESTORE_CONTEXT                                              \
              : "=a" (last)                                                \
+               __switch_canary_oparam                                     \
              : [next] "S" (next), [prev] "D" (prev),                      \
                [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
                [ti_flags] "i" (offsetof(struct thread_info, flags)),      \
-               [tif_fork] "i" (TIF_FORK),                                 \
+               [_tif_fork] "i" (_TIF_FORK),                               \
                [thread_info] "i" (offsetof(struct task_struct, stack)),   \
-               [pda_pcurrent] "i" (offsetof(struct x8664_pda, pcurrent))  \
+               [current_task] "m" (per_cpu_var(current_task))             \
+               __switch_canary_iparam                                     \
              : "memory", "cc" __EXTRA_CLOBBER)
 #endif
 
@@ -165,6 +201,25 @@ extern void native_load_gs_index(unsigned);
 #define savesegment(seg, value)                         \
         asm("mov %%" #seg ",%0":"=r" (value) : : "memory")
 
+/*
+ * x86_32 user gs accessors.
+ */
+#ifdef CONFIG_X86_32
+#ifdef CONFIG_X86_32_LAZY_GS
+#define get_user_gs(regs)       (u16)({unsigned long v; savesegment(gs, v); v;})
+#define set_user_gs(regs, v)    loadsegment(gs, (unsigned long)(v))
+#define task_user_gs(tsk)       ((tsk)->thread.gs)
+#define lazy_save_gs(v)         savesegment(gs, (v))
+#define lazy_load_gs(v)         loadsegment(gs, (v))
+#else   /* X86_32_LAZY_GS */
+#define get_user_gs(regs)       (u16)((regs)->gs)
+#define set_user_gs(regs, v)    do { (regs)->gs = (v); } while (0)
+#define task_user_gs(tsk)       (task_pt_regs(tsk)->gs)
+#define lazy_save_gs(v)         do { } while (0)
+#define lazy_load_gs(v)         do { } while (0)
+#endif  /* X86_32_LAZY_GS */
+#endif  /* X86_32 */
+
 static inline unsigned long get_limit(unsigned long segment)
 {
         unsigned long __limit;
diff --git a/arch/x86/include/asm/thread_info.h b/arch/x86/include/asm/thread_info.h
index 98789647baa..df9d5f78385 100644
--- a/arch/x86/include/asm/thread_info.h
+++ b/arch/x86/include/asm/thread_info.h
@@ -40,6 +40,7 @@ struct thread_info {
                                                 */
         __u8                    supervisor_stack[0];
 #endif
+        int                     uaccess_err;
 };
 
 #define INIT_THREAD_INFO(tsk)                   \
@@ -194,25 +195,21 @@ static inline struct thread_info *current_thread_info(void)
 
 #else /* X86_32 */
 
-#include <asm/pda.h>
+#include <asm/percpu.h>
+#define KERNEL_STACK_OFFSET (5*8)
 
 /*
  * macros/functions for gaining access to the thread information structure
  * preempt_count needs to be 1 initially, until the scheduler is functional.
  */
 #ifndef __ASSEMBLY__
-static inline struct thread_info *current_thread_info(void)
-{
-        struct thread_info *ti;
-        ti = (void *)(read_pda(kernelstack) + PDA_STACKOFFSET - THREAD_SIZE);
-        return ti;
-}
+DECLARE_PER_CPU(unsigned long, kernel_stack);
 
-/* do not use in interrupt context */
-static inline struct thread_info *stack_thread_info(void)
+static inline struct thread_info *current_thread_info(void)
 {
         struct thread_info *ti;
-        asm("andq %%rsp,%0; " : "=r" (ti) : "0" (~(THREAD_SIZE - 1)));
+        ti = (void *)(percpu_read(kernel_stack) +
+                      KERNEL_STACK_OFFSET - THREAD_SIZE);
         return ti;
 }
 
@@ -220,8 +217,8 @@ static inline struct thread_info *stack_thread_info(void)
 
 /* how to get the thread information struct from ASM */
 #define GET_THREAD_INFO(reg) \
-        movq %gs:pda_kernelstack,reg ; \
-        subq $(THREAD_SIZE-PDA_STACKOFFSET),reg
+        movq PER_CPU_VAR(kernel_stack),reg ; \
+        subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
 
 #endif
 
diff --git a/arch/x86/include/asm/tlbflush.h b/arch/x86/include/asm/tlbflush.h
index 0e7bbb54911..d3539f998f8 100644
--- a/arch/x86/include/asm/tlbflush.h
+++ b/arch/x86/include/asm/tlbflush.h
@@ -113,7 +113,7 @@ static inline void flush_tlb_range(struct vm_area_struct *vma,
                 __flush_tlb();
 }
 
-static inline void native_flush_tlb_others(const cpumask_t *cpumask,
+static inline void native_flush_tlb_others(const struct cpumask *cpumask,
                                            struct mm_struct *mm,
                                            unsigned long va)
 {
@@ -142,31 +142,28 @@ static inline void flush_tlb_range(struct vm_area_struct *vma,
         flush_tlb_mm(vma->vm_mm);
 }
 
-void native_flush_tlb_others(const cpumask_t *cpumask, struct mm_struct *mm,
-                             unsigned long va);
+void native_flush_tlb_others(const struct cpumask *cpumask,
+                             struct mm_struct *mm, unsigned long va);
 
 #define TLBSTATE_OK     1
 #define TLBSTATE_LAZY   2
 
-#ifdef CONFIG_X86_32
 struct tlb_state {
         struct mm_struct *active_mm;
         int state;
-        char __cacheline_padding[L1_CACHE_BYTES-8];
 };
 DECLARE_PER_CPU(struct tlb_state, cpu_tlbstate);
 
-void reset_lazy_tlbstate(void);
-#else
 static inline void reset_lazy_tlbstate(void)
 {
+        percpu_write(cpu_tlbstate.state, 0);
+        percpu_write(cpu_tlbstate.active_mm, &init_mm);
 }
-#endif
 
 #endif  /* SMP */
 
 #ifndef CONFIG_PARAVIRT
-#define flush_tlb_others(mask, mm, va)  native_flush_tlb_others(&mask, mm, va)
+#define flush_tlb_others(mask, mm, va)  native_flush_tlb_others(mask, mm, va)
 #endif
 
 static inline void flush_tlb_kernel_range(unsigned long start,
@@ -175,4 +172,6 @@ static inline void flush_tlb_kernel_range(unsigned long start,
         flush_tlb_all();
 }
 
+extern void zap_low_mappings(void);
+
 #endif /* _ASM_X86_TLBFLUSH_H */
diff --git a/arch/x86/include/asm/topology.h b/arch/x86/include/asm/topology.h
index 4e2f2e0aab2..77cfb2cfb38 100644
--- a/arch/x86/include/asm/topology.h
+++ b/arch/x86/include/asm/topology.h
@@ -74,6 +74,8 @@ static inline const struct cpumask *cpumask_of_node(int node)
         return &node_to_cpumask_map[node];
 }
 
+static inline void setup_node_to_cpumask_map(void) { }
+
 #else /* CONFIG_X86_64 */
 
 /* Mappings between node number and cpus on that node. */
@@ -83,7 +85,8 @@ extern cpumask_t *node_to_cpumask_map;
 DECLARE_EARLY_PER_CPU(int, x86_cpu_to_node_map);
 
 /* Returns the number of the current Node. */
-#define numa_node_id()          read_pda(nodenumber)
+DECLARE_PER_CPU(int, node_number);
+#define numa_node_id()          percpu_read(node_number)
 
 #ifdef CONFIG_DEBUG_PER_CPU_MAPS
 extern int cpu_to_node(int cpu);
@@ -102,10 +105,7 @@ static inline int cpu_to_node(int cpu)
 /* Same function but used if called before per_cpu areas are setup */
 static inline int early_cpu_to_node(int cpu)
 {
-        if (early_per_cpu_ptr(x86_cpu_to_node_map))
-                return early_per_cpu_ptr(x86_cpu_to_node_map)[cpu];
-
-        return per_cpu(x86_cpu_to_node_map, cpu);
+        return early_per_cpu(x86_cpu_to_node_map, cpu);
 }
 
 /* Returns a pointer to the cpumask of CPUs on Node 'node'. */
@@ -122,6 +122,8 @@ static inline cpumask_t node_to_cpumask(int node)
 
 #endif /* !CONFIG_DEBUG_PER_CPU_MAPS */
 
+extern void setup_node_to_cpumask_map(void);
+
 /*
  * Replace default node_to_cpumask_ptr with optimized version
  * Deprecated: use "const struct cpumask *mask = cpumask_of_node(node)"
@@ -192,9 +194,20 @@ extern int __node_distance(int, int);
 
 #else /* !CONFIG_NUMA */
 
-#define numa_node_id()          0
-#define cpu_to_node(cpu)        0
-#define early_cpu_to_node(cpu)  0
+static inline int numa_node_id(void)
+{
+        return 0;
+}
+
+static inline int cpu_to_node(int cpu)
+{
+        return 0;
+}
+
+static inline int early_cpu_to_node(int cpu)
+{
+        return 0;
+}
 
 static inline const cpumask_t *cpumask_of_node(int node)
 {
@@ -209,6 +222,8 @@ static inline int node_to_first_cpu(int node)
         return first_cpu(cpu_online_map);
 }
 
+static inline void setup_node_to_cpumask_map(void) { }
+
 /*
  * Replace default node_to_cpumask_ptr with optimized version
  * Deprecated: use "const struct cpumask *mask = cpumask_of_node(node)"
diff --git a/arch/x86/include/asm/trampoline.h b/arch/x86/include/asm/trampoline.h
index 780ba0ab94f..90f06c25221 100644
--- a/arch/x86/include/asm/trampoline.h
+++ b/arch/x86/include/asm/trampoline.h
@@ -13,6 +13,7 @@ extern unsigned char *trampoline_base;
 
 extern unsigned long init_rsp;
 extern unsigned long initial_code;
+extern unsigned long initial_gs;
 
 #define TRAMPOLINE_SIZE roundup(trampoline_end - trampoline_data, PAGE_SIZE)
 #define TRAMPOLINE_BASE 0x6000
diff --git a/arch/x86/include/asm/traps.h b/arch/x86/include/asm/traps.h
index 2ee0a3bceed..0d5342515b8 100644
--- a/arch/x86/include/asm/traps.h
+++ b/arch/x86/include/asm/traps.h
@@ -77,7 +77,7 @@ extern int panic_on_unrecovered_nmi;
 extern int kstack_depth_to_print;
 
 void math_error(void __user *);
-asmlinkage void math_emulate(long);
+void math_emulate(struct math_emu_info *);
 #ifdef CONFIG_X86_32
 unsigned long patch_espfix_desc(unsigned long, unsigned long);
 #else
diff --git a/arch/x86/include/asm/uaccess.h b/arch/x86/include/asm/uaccess.h
index 4340055b755..b685ece89d5 100644
--- a/arch/x86/include/asm/uaccess.h
+++ b/arch/x86/include/asm/uaccess.h
@@ -121,7 +121,7 @@ extern int __get_user_bad(void);
 
 #define __get_user_x(size, ret, x, ptr)               \
         asm volatile("call __get_user_" #size         \
-                     : "=a" (ret),"=d" (x)            \
+                     : "=a" (ret), "=d" (x)           \
                      : "0" (ptr))                     \
 
 /* Careful: we have to cast the result to the type of the pointer
@@ -181,12 +181,12 @@ extern int __get_user_bad(void);
 
 #define __put_user_x(size, x, ptr, __ret_pu)                    \
         asm volatile("call __put_user_" #size : "=a" (__ret_pu) \
-                     :"0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
+                     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
 
 
 
 #ifdef CONFIG_X86_32
-#define __put_user_u64(x, addr, err)                                    \
+#define __put_user_asm_u64(x, addr, err, errret)                        \
         asm volatile("1:        movl %%eax,0(%2)\n"                     \
                      "2:        movl %%edx,4(%2)\n"                     \
                      "3:\n"                                             \
@@ -197,14 +197,24 @@ extern int __get_user_bad(void);
                      _ASM_EXTABLE(1b, 4b)                               \
                      _ASM_EXTABLE(2b, 4b)                               \
                      : "=r" (err)                                       \
-                     : "A" (x), "r" (addr), "i" (-EFAULT), "0" (err))
+                     : "A" (x), "r" (addr), "i" (errret), "0" (err))
+
+#define __put_user_asm_ex_u64(x, addr)                                  \
+        asm volatile("1:        movl %%eax,0(%1)\n"                     \
+                     "2:        movl %%edx,4(%1)\n"                     \
+                     "3:\n"                                             \
+                     _ASM_EXTABLE(1b, 2b - 1b)                          \
+                     _ASM_EXTABLE(2b, 3b - 2b)                          \
+                     : : "A" (x), "r" (addr))
 
 #define __put_user_x8(x, ptr, __ret_pu)                         \
         asm volatile("call __put_user_8" : "=a" (__ret_pu)      \
                      : "A" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
 #else
-#define __put_user_u64(x, ptr, retval) \
-        __put_user_asm(x, ptr, retval, "q", "", "Zr", -EFAULT)
+#define __put_user_asm_u64(x, ptr, retval, errret) \
+        __put_user_asm(x, ptr, retval, "q", "", "Zr", errret)
+#define __put_user_asm_ex_u64(x, addr)  \
+        __put_user_asm_ex(x, addr, "q", "", "Zr")
 #define __put_user_x8(x, ptr, __ret_pu) __put_user_x(8, x, ptr, __ret_pu)
 #endif
 
@@ -276,10 +286,32 @@ do {									\
                 __put_user_asm(x, ptr, retval, "w", "w", "ir", errret); \
                 break;                                                  \
         case 4:                                                         \
-                __put_user_asm(x, ptr, retval, "l", "k",  "ir", errret);\
+                __put_user_asm(x, ptr, retval, "l", "k", "ir", errret); \
                 break;                                                  \
         case 8:                                                         \
-                __put_user_u64((__typeof__(*ptr))(x), ptr, retval);     \
+                __put_user_asm_u64((__typeof__(*ptr))(x), ptr, retval,  \
+                                   errret);                             \
+                break;                                                  \
+        default:                                                        \
+                __put_user_bad();                                       \
+        }                                                               \
+} while (0)
+
+#define __put_user_size_ex(x, ptr, size)                                \
+do {                                                                    \
+        __chk_user_ptr(ptr);                                            \
+        switch (size) {                                                 \
+        case 1:                                                         \
+                __put_user_asm_ex(x, ptr, "b", "b", "iq");              \
+                break;                                                  \
+        case 2:                                                         \
+                __put_user_asm_ex(x, ptr, "w", "w", "ir");              \
+                break;                                                  \
+        case 4:                                                         \
+                __put_user_asm_ex(x, ptr, "l", "k", "ir");              \
+                break;                                                  \
+        case 8:                                                         \
+                __put_user_asm_ex_u64((__typeof__(*ptr))(x), ptr);      \
                 break;                                                  \
         default:                                                        \
                 __put_user_bad();                                       \
@@ -311,9 +343,12 @@ do {									\
 
 #ifdef CONFIG_X86_32
 #define __get_user_asm_u64(x, ptr, retval, errret)      (x) = __get_user_bad()
+#define __get_user_asm_ex_u64(x, ptr)                   (x) = __get_user_bad()
 #else
 #define __get_user_asm_u64(x, ptr, retval, errret) \
          __get_user_asm(x, ptr, retval, "q", "", "=r", errret)
+#define __get_user_asm_ex_u64(x, ptr) \
+         __get_user_asm_ex(x, ptr, "q", "", "=r")
 #endif
 
 #define __get_user_size(x, ptr, size, retval, errret)                   \
@@ -350,6 +385,33 @@ do {									\
                      : "=r" (err), ltype(x)                             \
                      : "m" (__m(addr)), "i" (errret), "0" (err))
 
+#define __get_user_size_ex(x, ptr, size)                                \
+do {                                                                    \
+        __chk_user_ptr(ptr);                                            \
+        switch (size) {                                                 \
+        case 1:                                                         \
+                __get_user_asm_ex(x, ptr, "b", "b", "=q");              \
+                break;                                                  \
+        case 2:                                                         \
+                __get_user_asm_ex(x, ptr, "w", "w", "=r");              \
+                break;                                                  \
+        case 4:                                                         \
+                __get_user_asm_ex(x, ptr, "l", "k", "=r");              \
+                break;                                                  \
+        case 8:                                                         \
+                __get_user_asm_ex_u64(x, ptr);                          \
+                break;                                                  \
+        default:                                                        \
+                (x) = __get_user_bad();                                 \
+        }                                                               \
+} while (0)
+
+#define __get_user_asm_ex(x, addr, itype, rtype, ltype)                 \
+        asm volatile("1:        mov"itype" %1,%"rtype"0\n"              \
+                     "2:\n"                                             \
+                     _ASM_EXTABLE(1b, 2b - 1b)                          \
+                     : ltype(x) : "m" (__m(addr)))
+
 #define __put_user_nocheck(x, ptr, size)                        \
 ({                                                              \
         int __pu_err;                                           \
@@ -385,6 +447,26 @@ struct __large_struct { unsigned long buf[100]; };
                      _ASM_EXTABLE(1b, 3b)                               \
                      : "=r"(err)                                        \
                      : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
+
+#define __put_user_asm_ex(x, addr, itype, rtype, ltype)                 \
+        asm volatile("1:        mov"itype" %"rtype"0,%1\n"              \
+                     "2:\n"                                             \
+                     _ASM_EXTABLE(1b, 2b - 1b)                          \
+                     : : ltype(x), "m" (__m(addr)))
+
+/*
+ * uaccess_try and catch
+ */
+#define uaccess_try     do {                                            \
+        int prev_err = current_thread_info()->uaccess_err;              \
+        current_thread_info()->uaccess_err = 0;                         \
+        barrier();
+
+#define uaccess_catch(err)                                              \
+        (err) |= current_thread_info()->uaccess_err;                    \
+        current_thread_info()->uaccess_err = prev_err;                  \
+} while (0)
+
 /**
  * __get_user: - Get a simple variable from user space, with less checking.
  * @x:   Variable to store result.
@@ -408,6 +490,7 @@ struct __large_struct { unsigned long buf[100]; };
 
 #define __get_user(x, ptr)                                              \
         __get_user_nocheck((x), (ptr), sizeof(*(ptr)))
+
 /**
  * __put_user: - Write a simple value into user space, with less checking.
  * @x:   Value to copy to user space.
@@ -435,6 +518,45 @@ struct __large_struct { unsigned long buf[100]; };
 #define __put_user_unaligned __put_user
 
 /*
+ * {get|put}_user_try and catch
+ *
+ * get_user_try {
+ *      get_user_ex(...);
+ * } get_user_catch(err)
+ */
+#define get_user_try            uaccess_try
+#define get_user_catch(err)     uaccess_catch(err)
+
+#define get_user_ex(x, ptr)     do {                                    \
+        unsigned long __gue_val;                                        \
+        __get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));       \
+        (x) = (__force __typeof__(*(ptr)))__gue_val;                    \
+} while (0)
+
+#ifdef CONFIG_X86_WP_WORKS_OK
+
+#define put_user_try            uaccess_try
+#define put_user_catch(err)     uaccess_catch(err)
+
+#define put_user_ex(x, ptr)                                             \
+        __put_user_size_ex((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
+
+#else /* !CONFIG_X86_WP_WORKS_OK */
+
+#define put_user_try            do {            \
+        int __uaccess_err = 0;
+
+#define put_user_catch(err)                     \
+        (err) |= __uaccess_err;                 \
+} while (0)
+
+#define put_user_ex(x, ptr)     do {            \
+        __uaccess_err |= __put_user(x, ptr);    \
+} while (0)
+
+#endif /* CONFIG_X86_WP_WORKS_OK */
+
+/*
  * movsl can be slow when source and dest are not both 8-byte aligned
  */
 #ifdef CONFIG_X86_INTEL_USERCOPY
diff --git a/arch/x86/include/asm/uv/uv.h b/arch/x86/include/asm/uv/uv.h
new file mode 100644
index 00000000000..8242bf96581
--- /dev/null
+++ b/arch/x86/include/asm/uv/uv.h
@@ -0,0 +1,36 @@
+#ifndef _ASM_X86_UV_UV_H
+#define _ASM_X86_UV_UV_H
+
+enum uv_system_type {UV_NONE, UV_LEGACY_APIC, UV_X2APIC, UV_NON_UNIQUE_APIC};
+
+struct cpumask;
+struct mm_struct;
+
+#ifdef CONFIG_X86_UV
+
+extern enum uv_system_type get_uv_system_type(void);
+extern int is_uv_system(void);
+extern void uv_cpu_init(void);
+extern void uv_system_init(void);
+extern int uv_wakeup_secondary(int phys_apicid, unsigned int start_rip);
+extern const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+                                                 struct mm_struct *mm,
+                                                 unsigned long va,
+                                                 unsigned int cpu);
+
+#else   /* X86_UV */
+
+static inline enum uv_system_type get_uv_system_type(void) { return UV_NONE; }
+static inline int is_uv_system(void)    { return 0; }
+static inline void uv_cpu_init(void)    { }
+static inline void uv_system_init(void) { }
+static inline int uv_wakeup_secondary(int phys_apicid, unsigned int start_rip)
+{ return 1; }
+static inline const struct cpumask *
+uv_flush_tlb_others(const struct cpumask *cpumask, struct mm_struct *mm,
+                    unsigned long va, unsigned int cpu)
+{ return cpumask; }
+
+#endif  /* X86_UV */
+
+#endif  /* _ASM_X86_UV_UV_H */
diff --git a/arch/x86/include/asm/uv/uv_bau.h b/arch/x86/include/asm/uv/uv_bau.h
index 50423c7b56b..9b0e61bf7a8 100644
--- a/arch/x86/include/asm/uv/uv_bau.h
+++ b/arch/x86/include/asm/uv/uv_bau.h
@@ -325,7 +325,6 @@ static inline void bau_cpubits_clear(struct bau_local_cpumask *dstp, int nbits)
 #define cpubit_isset(cpu, bau_local_cpumask) \
         test_bit((cpu), (bau_local_cpumask).bits)
 
-extern int uv_flush_tlb_others(cpumask_t *, struct mm_struct *, unsigned long);
 extern void uv_bau_message_intr1(void);
 extern void uv_bau_timeout_intr1(void);
 
diff --git a/arch/x86/include/asm/voyager.h b/arch/x86/include/asm/voyager.h
index b3e64730762..c1635d43616 100644
--- a/arch/x86/include/asm/voyager.h
+++ b/arch/x86/include/asm/voyager.h
@@ -527,3 +527,45 @@ extern void voyager_smp_intr_init(void);
 #define VOYAGER_PSI_SUBREAD     2
 #define VOYAGER_PSI_SUBWRITE    3
 extern void voyager_cat_psi(__u8, __u16, __u8 *);
+
+/* These define the CPIs we use in linux */
+#define VIC_CPI_LEVEL0                  0
+#define VIC_CPI_LEVEL1                  1
+/* now the fake CPIs */
+#define VIC_TIMER_CPI                   2
+#define VIC_INVALIDATE_CPI              3
+#define VIC_RESCHEDULE_CPI              4
+#define VIC_ENABLE_IRQ_CPI              5
+#define VIC_CALL_FUNCTION_CPI           6
+#define VIC_CALL_FUNCTION_SINGLE_CPI    7
+
+/* Now the QIC CPIs:  Since we don't need the two initial levels,
+ * these are 2 less than the VIC CPIs */
+#define QIC_CPI_OFFSET                  1
+#define QIC_TIMER_CPI                   (VIC_TIMER_CPI - QIC_CPI_OFFSET)
+#define QIC_INVALIDATE_CPI              (VIC_INVALIDATE_CPI - QIC_CPI_OFFSET)
+#define QIC_RESCHEDULE_CPI              (VIC_RESCHEDULE_CPI - QIC_CPI_OFFSET)
+#define QIC_ENABLE_IRQ_CPI              (VIC_ENABLE_IRQ_CPI - QIC_CPI_OFFSET)
+#define QIC_CALL_FUNCTION_CPI           (VIC_CALL_FUNCTION_CPI - QIC_CPI_OFFSET)
+#define QIC_CALL_FUNCTION_SINGLE_CPI    (VIC_CALL_FUNCTION_SINGLE_CPI - QIC_CPI_OFFSET)
+
+#define VIC_START_FAKE_CPI              VIC_TIMER_CPI
+#define VIC_END_FAKE_CPI                VIC_CALL_FUNCTION_SINGLE_CPI
+
+/* this is the SYS_INT CPI. */
+#define VIC_SYS_INT                     8
+#define VIC_CMN_INT                     15
+
+/* This is the boot CPI for alternate processors.  It gets overwritten
+ * by the above once the system has activated all available processors */
+#define VIC_CPU_BOOT_CPI                VIC_CPI_LEVEL0
+#define VIC_CPU_BOOT_ERRATA_CPI         (VIC_CPI_LEVEL0 + 8)
+
+extern asmlinkage void vic_cpi_interrupt(void);
+extern asmlinkage void vic_sys_interrupt(void);
+extern asmlinkage void vic_cmn_interrupt(void);
+extern asmlinkage void qic_timer_interrupt(void);
+extern asmlinkage void qic_invalidate_interrupt(void);
+extern asmlinkage void qic_reschedule_interrupt(void);
+extern asmlinkage void qic_enable_irq_interrupt(void);
+extern asmlinkage void qic_call_function_interrupt(void);
diff --git a/arch/x86/include/asm/xen/events.h b/arch/x86/include/asm/xen/events.h
index 19144184983..1df35417c41 100644
--- a/arch/x86/include/asm/xen/events.h
+++ b/arch/x86/include/asm/xen/events.h
@@ -15,10 +15,4 @@ static inline int xen_irqs_disabled(struct pt_regs *regs)
         return raw_irqs_disabled_flags(regs->flags);
 }
 
-static inline void xen_do_IRQ(int irq, struct pt_regs *regs)
-{
-        regs->orig_ax = ~irq;
-        do_IRQ(regs);
-}
-
 #endif /* _ASM_X86_XEN_EVENTS_H */
diff --git a/arch/x86/include/asm/xen/page.h b/arch/x86/include/asm/xen/page.h
index 7ef617ef1df..4bd990ee43d 100644
--- a/arch/x86/include/asm/xen/page.h
+++ b/arch/x86/include/asm/xen/page.h
@@ -137,7 +137,7 @@ static inline pte_t mfn_pte(unsigned long page_nr, pgprot_t pgprot)
         pte_t pte;
 
         pte.pte = ((phys_addr_t)page_nr << PAGE_SHIFT) |
-                (pgprot_val(pgprot) & __supported_pte_mask);
+                        massage_pgprot(pgprot);
 
         return pte;
 }
diff --git a/arch/x86/kernel/Makefile b/arch/x86/kernel/Makefile
index d364df03c1d..24f357e7557 100644
--- a/arch/x86/kernel/Makefile
+++ b/arch/x86/kernel/Makefile
@@ -23,13 +23,14 @@ nostackp := $(call cc-option, -fno-stack-protector)
 CFLAGS_vsyscall_64.o    := $(PROFILING) -g0 $(nostackp)
 CFLAGS_hpet.o           := $(nostackp)
 CFLAGS_tsc.o            := $(nostackp)
+CFLAGS_paravirt.o       := $(nostackp)
 
 obj-y                   := process_$(BITS).o signal.o entry_$(BITS).o
 obj-y                   += traps.o irq.o irq_$(BITS).o dumpstack_$(BITS).o
 obj-y                   += time_$(BITS).o ioport.o ldt.o dumpstack.o
-obj-y                   += setup.o i8259.o irqinit_$(BITS).o setup_percpu.o
+obj-y                   += setup.o i8259.o irqinit_$(BITS).o
 obj-$(CONFIG_X86_VISWS) += visws_quirks.o
-obj-$(CONFIG_X86_32)    += probe_roms_32.o
+obj-$(CONFIG_X86_32)    += probe_32.o probe_roms_32.o
 obj-$(CONFIG_X86_32)    += sys_i386_32.o i386_ksyms_32.o
 obj-$(CONFIG_X86_64)    += sys_x86_64.o x8664_ksyms_64.o
 obj-$(CONFIG_X86_64)    += syscall_64.o vsyscall_64.o
@@ -49,20 +50,20 @@ obj-y				+= step.o
 obj-$(CONFIG_STACKTRACE)        += stacktrace.o
 obj-y                           += cpu/
 obj-y                           += acpi/
-obj-$(CONFIG_X86_BIOS_REBOOT)   += reboot.o
+obj-y                           += reboot.o
 obj-$(CONFIG_MCA)               += mca_32.o
 obj-$(CONFIG_X86_MSR)           += msr.o
 obj-$(CONFIG_X86_CPUID)         += cpuid.o
 obj-$(CONFIG_PCI)               += early-quirks.o
 apm-y                           := apm_32.o
 obj-$(CONFIG_APM)               += apm.o
-obj-$(CONFIG_X86_SMP)           += smp.o
-obj-$(CONFIG_X86_SMP)           += smpboot.o tsc_sync.o ipi.o tlb_$(BITS).o
-obj-$(CONFIG_X86_32_SMP)        += smpcommon.o
-obj-$(CONFIG_X86_64_SMP)        += tsc_sync.o smpcommon.o
+obj-$(CONFIG_SMP)               += smp.o
+obj-$(CONFIG_SMP)               += smpboot.o tsc_sync.o ipi.o
+obj-$(CONFIG_SMP)               += setup_percpu.o
+obj-$(CONFIG_X86_64_SMP)        += tsc_sync.o
 obj-$(CONFIG_X86_TRAMPOLINE)    += trampoline_$(BITS).o
 obj-$(CONFIG_X86_MPPARSE)       += mpparse.o
-obj-$(CONFIG_X86_LOCAL_APIC)    += apic.o nmi.o
+obj-$(CONFIG_X86_LOCAL_APIC)    += apic.o nmi.o ipi.o
 obj-$(CONFIG_X86_IO_APIC)       += io_apic.o
 obj-$(CONFIG_X86_REBOOTFIXUPS)  += reboot_fixups_32.o
 obj-$(CONFIG_DYNAMIC_FTRACE)    += ftrace.o
@@ -70,9 +71,10 @@ obj-$(CONFIG_FUNCTION_GRAPH_TRACER)	+= ftrace.o
 obj-$(CONFIG_KEXEC)             += machine_kexec_$(BITS).o
 obj-$(CONFIG_KEXEC)             += relocate_kernel_$(BITS).o crash.o
 obj-$(CONFIG_CRASH_DUMP)        += crash_dump_$(BITS).o
+obj-$(CONFIG_X86_BIGSMP)        += bigsmp_32.o
 obj-$(CONFIG_X86_NUMAQ)         += numaq_32.o
 obj-$(CONFIG_X86_ES7000)        += es7000_32.o
-obj-$(CONFIG_X86_SUMMIT_NUMA)   += summit_32.o
+obj-$(CONFIG_X86_SUMMIT)        += summit_32.o
 obj-y                           += vsmp_64.o
 obj-$(CONFIG_KPROBES)           += kprobes.o
 obj-$(CONFIG_MODULES)           += module_$(BITS).o
@@ -114,10 +116,11 @@ obj-$(CONFIG_SWIOTLB)			+= pci-swiotlb_64.o # NB rename without _64
 ###
 # 64 bit specific files
 ifeq ($(CONFIG_X86_64),y)
-        obj-y                           += genapic_64.o genapic_flat_64.o genx2apic_uv_x.o tlb_uv.o
-        obj-y                           += bios_uv.o uv_irq.o uv_sysfs.o
+        obj-y                           += genapic_64.o genapic_flat_64.o
         obj-y                           += genx2apic_cluster.o
         obj-y                           += genx2apic_phys.o
+        obj-$(CONFIG_X86_UV)            += genx2apic_uv_x.o tlb_uv.o
+        obj-$(CONFIG_X86_UV)            += bios_uv.o uv_irq.o uv_sysfs.o
         obj-$(CONFIG_X86_PM_TIMER)      += pmtimer_64.o
         obj-$(CONFIG_AUDIT)             += audit_64.o
 
diff --git a/arch/x86/kernel/acpi/boot.c b/arch/x86/kernel/acpi/boot.c
index d37593c2f43..956c1dee6fb 100644
--- a/arch/x86/kernel/acpi/boot.c
+++ b/arch/x86/kernel/acpi/boot.c
@@ -42,10 +42,6 @@
 #include <asm/mpspec.h>
 #include <asm/smp.h>
 
-#ifdef CONFIG_X86_LOCAL_APIC
-# include <mach_apic.h>
-#endif
-
 static int __initdata acpi_force = 0;
 u32 acpi_rsdt_forced;
 #ifdef  CONFIG_ACPI
@@ -56,16 +52,7 @@ int acpi_disabled = 1;
 EXPORT_SYMBOL(acpi_disabled);
 
 #ifdef  CONFIG_X86_64
-
-#include <asm/proto.h>
-
-#else                           /* X86 */
-
-#ifdef  CONFIG_X86_LOCAL_APIC
-#include <mach_apic.h>
-#include <mach_mpparse.h>
-#endif                          /* CONFIG_X86_LOCAL_APIC */
-
+# include <asm/proto.h>
 #endif                          /* X86 */
 
 #define BAD_MADT_ENTRY(entry, end) (                                        \
@@ -121,35 +108,18 @@ enum acpi_irq_model_id acpi_irq_model = ACPI_IRQ_MODEL_PIC;
  */
 char *__init __acpi_map_table(unsigned long phys, unsigned long size)
 {
-        unsigned long base, offset, mapped_size;
-        int idx;
 
         if (!phys || !size)
                 return NULL;
 
-        if (phys+size <= (max_low_pfn_mapped << PAGE_SHIFT))
-                return __va(phys);
-
-        offset = phys & (PAGE_SIZE - 1);
-        mapped_size = PAGE_SIZE - offset;
-        clear_fixmap(FIX_ACPI_END);
-        set_fixmap(FIX_ACPI_END, phys);
-        base = fix_to_virt(FIX_ACPI_END);
-
-        /*
-         * Most cases can be covered by the below.
-         */
-        idx = FIX_ACPI_END;
-        while (mapped_size < size) {
-                if (--idx < FIX_ACPI_BEGIN)
-                        return NULL;    /* cannot handle this */
-                phys += PAGE_SIZE;
-                clear_fixmap(idx);
-                set_fixmap(idx, phys);
-                mapped_size += PAGE_SIZE;
-        }
+        return early_ioremap(phys, size);
+}
+void __init __acpi_unmap_table(char *map, unsigned long size)
+{
+        if (!map || !size)
+                return;
 
-        return ((unsigned char *)base + offset);
+        early_iounmap(map, size);
 }
 
 #ifdef CONFIG_PCI_MMCONFIG
@@ -239,7 +209,8 @@ static int __init acpi_parse_madt(struct acpi_table_header *table)
                        madt->address);
         }
 
-        acpi_madt_oem_check(madt->header.oem_id, madt->header.oem_table_id);
+        default_acpi_madt_oem_check(madt->header.oem_id,
+                                    madt->header.oem_table_id);
 
         return 0;
 }
@@ -884,7 +855,7 @@ static struct {
         DECLARE_BITMAP(pin_programmed, MP_MAX_IOAPIC_PIN + 1);
 } mp_ioapic_routing[MAX_IO_APICS];
 
-static int mp_find_ioapic(int gsi)
+int mp_find_ioapic(int gsi)
 {
         int i = 0;
 
@@ -899,6 +870,16 @@ static int mp_find_ioapic(int gsi)
         return -1;
 }
 
+int mp_find_ioapic_pin(int ioapic, int gsi)
+{
+        if (WARN_ON(ioapic == -1))
+                return -1;
+        if (WARN_ON(gsi > mp_ioapic_routing[ioapic].gsi_end))
+                return -1;
+
+        return gsi - mp_ioapic_routing[ioapic].gsi_base;
+}
+
 static u8 __init uniq_ioapic_id(u8 id)
 {
 #ifdef CONFIG_X86_32
@@ -912,8 +893,8 @@ static u8 __init uniq_ioapic_id(u8 id)
         DECLARE_BITMAP(used, 256);
         bitmap_zero(used, 256);
         for (i = 0; i < nr_ioapics; i++) {
-                struct mp_config_ioapic *ia = &mp_ioapics[i];
-                __set_bit(ia->mp_apicid, used);
+                struct mpc_ioapic *ia = &mp_ioapics[i];
+                __set_bit(ia->apicid, used);
         }
         if (!test_bit(id, used))
                 return id;
@@ -945,47 +926,70 @@ void __init mp_register_ioapic(int id, u32 address, u32 gsi_base)
 
         idx = nr_ioapics;
 
-        mp_ioapics[idx].mp_type = MP_IOAPIC;
-        mp_ioapics[idx].mp_flags = MPC_APIC_USABLE;
-        mp_ioapics[idx].mp_apicaddr = address;
+        mp_ioapics[idx].type = MP_IOAPIC;
+        mp_ioapics[idx].flags = MPC_APIC_USABLE;
+        mp_ioapics[idx].apicaddr = address;
 
         set_fixmap_nocache(FIX_IO_APIC_BASE_0 + idx, address);
-        mp_ioapics[idx].mp_apicid = uniq_ioapic_id(id);
+        mp_ioapics[idx].apicid = uniq_ioapic_id(id);
 #ifdef CONFIG_X86_32
-        mp_ioapics[idx].mp_apicver = io_apic_get_version(idx);
+        mp_ioapics[idx].apicver = io_apic_get_version(idx);
 #else
-        mp_ioapics[idx].mp_apicver = 0;
+        mp_ioapics[idx].apicver = 0;
 #endif
         /*
          * Build basic GSI lookup table to facilitate gsi->io_apic lookups
          * and to prevent reprogramming of IOAPIC pins (PCI GSIs).
          */
-        mp_ioapic_routing[idx].apic_id = mp_ioapics[idx].mp_apicid;
+        mp_ioapic_routing[idx].apic_id = mp_ioapics[idx].apicid;
         mp_ioapic_routing[idx].gsi_base = gsi_base;
         mp_ioapic_routing[idx].gsi_end = gsi_base +
             io_apic_get_redir_entries(idx);
 
-        printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%lx, "
-               "GSI %d-%d\n", idx, mp_ioapics[idx].mp_apicid,
-               mp_ioapics[idx].mp_apicver, mp_ioapics[idx].mp_apicaddr,
+        printk(KERN_INFO "IOAPIC[%d]: apic_id %d, version %d, address 0x%x, "
+               "GSI %d-%d\n", idx, mp_ioapics[idx].apicid,
+               mp_ioapics[idx].apicver, mp_ioapics[idx].apicaddr,
                mp_ioapic_routing[idx].gsi_base, mp_ioapic_routing[idx].gsi_end);
 
         nr_ioapics++;
 }
 
-static void assign_to_mp_irq(struct mp_config_intsrc *m,
-                                    struct mp_config_intsrc *mp_irq)
+int __init acpi_probe_gsi(void)
 {
-        memcpy(mp_irq, m, sizeof(struct mp_config_intsrc));
+        int idx;
+        int gsi;
+        int max_gsi = 0;
+
+        if (acpi_disabled)
+                return 0;
+
+        if (!acpi_ioapic)
+                return 0;
+
+        max_gsi = 0;
+        for (idx = 0; idx < nr_ioapics; idx++) {
+                gsi = mp_ioapic_routing[idx].gsi_end;
+
+                if (gsi > max_gsi)
+                        max_gsi = gsi;
+        }
+
+        return max_gsi + 1;
 }
 
-static int mp_irq_cmp(struct mp_config_intsrc *mp_irq,
-                                struct mp_config_intsrc *m)
+static void assign_to_mp_irq(struct mpc_intsrc *m,
+                                    struct mpc_intsrc *mp_irq)
 {
-        return memcmp(mp_irq, m, sizeof(struct mp_config_intsrc));
+        memcpy(mp_irq, m, sizeof(struct mpc_intsrc));
 }
 
-static void save_mp_irq(struct mp_config_intsrc *m)
+static int mp_irq_cmp(struct mpc_intsrc *mp_irq,
+                                struct mpc_intsrc *m)
+{
+        return memcmp(mp_irq, m, sizeof(struct mpc_intsrc));
+}
+
+static void save_mp_irq(struct mpc_intsrc *m)
 {
         int i;
 
@@ -1003,7 +1007,7 @@ void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, u32 gsi)
 {
         int ioapic;
         int pin;
-        struct mp_config_intsrc mp_irq;
+        struct mpc_intsrc mp_irq;
 
         /*
          * Convert 'gsi' to 'ioapic.pin'.
@@ -1011,7 +1015,7 @@ void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, u32 gsi)
         ioapic = mp_find_ioapic(gsi);
         if (ioapic < 0)
                 return;
-        pin = gsi - mp_ioapic_routing[ioapic].gsi_base;
+        pin = mp_find_ioapic_pin(ioapic, gsi);
 
         /*
          * TBD: This check is for faulty timer entries, where the override
@@ -1021,13 +1025,13 @@ void __init mp_override_legacy_irq(u8 bus_irq, u8 polarity, u8 trigger, u32 gsi)
         if ((bus_irq == 0) && (trigger == 3))
                 trigger = 1;
 
-        mp_irq.mp_type = MP_INTSRC;
-        mp_irq.mp_irqtype = mp_INT;
-        mp_irq.mp_irqflag = (trigger << 2) | polarity;
-        mp_irq.mp_srcbus = MP_ISA_BUS;
-        mp_irq.mp_srcbusirq = bus_irq;  /* IRQ */
-        mp_irq.mp_dstapic = mp_ioapics[ioapic].mp_apicid; /* APIC ID */
-        mp_irq.mp_dstirq = pin; /* INTIN# */
+        mp_irq.type = MP_INTSRC;
+        mp_irq.irqtype = mp_INT;
+        mp_irq.irqflag = (trigger << 2) | polarity;
+        mp_irq.srcbus = MP_ISA_BUS;
+        mp_irq.srcbusirq = bus_irq;     /* IRQ */
+        mp_irq.dstapic = mp_ioapics[ioapic].apicid; /* APIC ID */
+        mp_irq.dstirq = pin;    /* INTIN# */
 
         save_mp_irq(&mp_irq);
 }
@@ -1037,7 +1041,7 @@ void __init mp_config_acpi_legacy_irqs(void)
         int i;
         int ioapic;
         unsigned int dstapic;
-        struct mp_config_intsrc mp_irq;
+        struct mpc_intsrc mp_irq;
 
 #if defined (CONFIG_MCA) || defined (CONFIG_EISA)
         /*
@@ -1062,7 +1066,7 @@ void __init mp_config_acpi_legacy_irqs(void)
         ioapic = mp_find_ioapic(0);
         if (ioapic < 0)
                 return;
-        dstapic = mp_ioapics[ioapic].mp_apicid;
+        dstapic = mp_ioapics[ioapic].apicid;
 
         /*
          * Use the default configuration for the IRQs 0-15.  Unless
@@ -1072,16 +1076,14 @@ void __init mp_config_acpi_legacy_irqs(void)
                 int idx;
 
                 for (idx = 0; idx < mp_irq_entries; idx++) {
-                        struct mp_config_intsrc *irq = mp_irqs + idx;
+                        struct mpc_intsrc *irq = mp_irqs + idx;
 
                         /* Do we already have a mapping for this ISA IRQ? */
-                        if (irq->mp_srcbus == MP_ISA_BUS
-                            && irq->mp_srcbusirq == i)
+                        if (irq->srcbus == MP_ISA_BUS && irq->srcbusirq == i)
                                 break;
 
                         /* Do we already have a mapping for this IOAPIC pin */
-                        if (irq->mp_dstapic == dstapic &&
-                            irq->mp_dstirq == i)
+                        if (irq->dstapic == dstapic && irq->dstirq == i)
                                 break;
                 }
 
@@ -1090,13 +1092,13 @@ void __init mp_config_acpi_legacy_irqs(void)
                         continue;       /* IRQ already used */
                 }
 
-                mp_irq.mp_type = MP_INTSRC;
-                mp_irq.mp_irqflag = 0;  /* Conforming */
-                mp_irq.mp_srcbus = MP_ISA_BUS;
-                mp_irq.mp_dstapic = dstapic;
-                mp_irq.mp_irqtype = mp_INT;
-                mp_irq.mp_srcbusirq = i; /* Identity mapped */
-                mp_irq.mp_dstirq = i;
+                mp_irq.type = MP_INTSRC;
+                mp_irq.irqflag = 0;     /* Conforming */
+                mp_irq.srcbus = MP_ISA_BUS;
+                mp_irq.dstapic = dstapic;
+                mp_irq.irqtype = mp_INT;
+                mp_irq.srcbusirq = i; /* Identity mapped */
+                mp_irq.dstirq = i;
 
                 save_mp_irq(&mp_irq);
         }
@@ -1133,7 +1135,7 @@ int mp_register_gsi(u32 gsi, int triggering, int polarity)
                 return gsi;
         }
 
-        ioapic_pin = gsi - mp_ioapic_routing[ioapic].gsi_base;
+        ioapic_pin = mp_find_ioapic_pin(ioapic, gsi);
 
 #ifdef CONFIG_X86_32
         if (ioapic_renumber_irq)
@@ -1207,22 +1209,22 @@ int mp_config_acpi_gsi(unsigned char number, unsigned int devfn, u8 pin,
                         u32 gsi, int triggering, int polarity)
 {
 #ifdef CONFIG_X86_MPPARSE
-        struct mp_config_intsrc mp_irq;
+        struct mpc_intsrc mp_irq;
         int ioapic;
 
         if (!acpi_ioapic)
                 return 0;
 
         /* print the entry should happen on mptable identically */
-        mp_irq.mp_type = MP_INTSRC;
-        mp_irq.mp_irqtype = mp_INT;
-        mp_irq.mp_irqflag = (triggering == ACPI_EDGE_SENSITIVE ? 4 : 0x0c) |
+        mp_irq.type = MP_INTSRC;
+        mp_irq.irqtype = mp_INT;
+        mp_irq.irqflag = (triggering == ACPI_EDGE_SENSITIVE ? 4 : 0x0c) |
                                 (polarity == ACPI_ACTIVE_HIGH ? 1 : 3);
-        mp_irq.mp_srcbus = number;
-        mp_irq.mp_srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
+        mp_irq.srcbus = number;
+        mp_irq.srcbusirq = (((devfn >> 3) & 0x1f) << 2) | ((pin - 1) & 3);
         ioapic = mp_find_ioapic(gsi);
-        mp_irq.mp_dstapic = mp_ioapic_routing[ioapic].apic_id;
-        mp_irq.mp_dstirq = gsi - mp_ioapic_routing[ioapic].gsi_base;
+        mp_irq.dstapic = mp_ioapic_routing[ioapic].apic_id;
+        mp_irq.dstirq = mp_find_ioapic_pin(ioapic, gsi);
 
         save_mp_irq(&mp_irq);
 #endif
@@ -1349,7 +1351,7 @@ static void __init acpi_process_madt(void)
                 if (!error) {
                         acpi_lapic = 1;
 
-#ifdef CONFIG_X86_GENERICARCH
+#ifdef CONFIG_X86_BIGSMP
                         generic_bigsmp_probe();
 #endif
                         /*
@@ -1361,9 +1363,8 @@ static void __init acpi_process_madt(void)
                                 acpi_ioapic = 1;
 
                                 smp_found_config = 1;
-#ifdef CONFIG_X86_32
-                                setup_apic_routing();
-#endif
+                                if (apic->setup_apic_routing)
+                                        apic->setup_apic_routing();
                         }
                 }
                 if (error == -EINVAL) {
diff --git a/arch/x86/kernel/acpi/sleep.c b/arch/x86/kernel/acpi/sleep.c
index 707c1f6f95f..7c243a2c511 100644
--- a/arch/x86/kernel/acpi/sleep.c
+++ b/arch/x86/kernel/acpi/sleep.c
@@ -101,6 +101,7 @@ int acpi_save_state_mem(void)
         stack_start.sp = temp_stack + sizeof(temp_stack);
         early_gdt_descr.address =
                         (unsigned long)get_cpu_gdt_table(smp_processor_id());
+        initial_gs = per_cpu_offset(smp_processor_id());
 #endif
         initial_code = (unsigned long)wakeup_long64;
         saved_magic = 0x123456789abcdef0;
@@ -156,11 +157,11 @@ static int __init acpi_sleep_setup(char *str)
 #ifdef CONFIG_HIBERNATION
                 if (strncmp(str, "s4_nohwsig", 10) == 0)
                         acpi_no_s4_hw_signature();
+                if (strncmp(str, "s4_nonvs", 8) == 0)
+                        acpi_s4_no_nvs();
 #endif
                 if (strncmp(str, "old_ordering", 12) == 0)
                         acpi_old_suspend_ordering();
-                if (strncmp(str, "s4_nonvs", 8) == 0)
-                        acpi_s4_no_nvs();
                 str = strchr(str, ',');
                 if (str != NULL)
                         str += strspn(str, ", \t");
diff --git a/arch/x86/kernel/apic.c b/arch/x86/kernel/apic.c
index 4b6df2469fe..cf2ca19e62d 100644
--- a/arch/x86/kernel/apic.c
+++ b/arch/x86/kernel/apic.c
@@ -1,7 +1,7 @@
 /*
  *      Local APIC handling, local APIC timers
  *
- *      (c) 1999, 2000 Ingo Molnar <mingo@redhat.com>
+ *      (c) 1999, 2000, 2009 Ingo Molnar <mingo@redhat.com>
  *
  *      Fixes
  *      Maciej W. Rozycki       :       Bits for genuine 82489DX APICs;
@@ -14,51 +14,71 @@
  *      Mikael Pettersson       :       PM converted to driver model.
  */
 
-#include <linux/init.h>
-
-#include <linux/mm.h>
-#include <linux/delay.h>
-#include <linux/bootmem.h>
-#include <linux/interrupt.h>
-#include <linux/mc146818rtc.h>
 #include <linux/kernel_stat.h>
-#include <linux/sysdev.h>
-#include <linux/ioport.h>
-#include <linux/cpu.h>
-#include <linux/clockchips.h>
+#include <linux/mc146818rtc.h>
 #include <linux/acpi_pmtmr.h>
+#include <linux/clockchips.h>
+#include <linux/interrupt.h>
+#include <linux/bootmem.h>
+#include <linux/ftrace.h>
+#include <linux/ioport.h>
 #include <linux/module.h>
-#include <linux/dmi.h>
+#include <linux/sysdev.h>
+#include <linux/delay.h>
+#include <linux/timex.h>
 #include <linux/dmar.h>
-#include <linux/ftrace.h>
-#include <linux/smp.h>
+#include <linux/init.h>
+#include <linux/cpu.h>
+#include <linux/dmi.h>
 #include <linux/nmi.h>
-#include <linux/timex.h>
+#include <linux/smp.h>
+#include <linux/mm.h>
 
-#include <asm/atomic.h>
-#include <asm/mtrr.h>
-#include <asm/mpspec.h>
-#include <asm/desc.h>
 #include <asm/arch_hooks.h>
-#include <asm/hpet.h>
 #include <asm/pgalloc.h>
+#include <asm/genapic.h>
+#include <asm/atomic.h>
+#include <asm/mpspec.h>
 #include <asm/i8253.h>
-#include <asm/idle.h>
+#include <asm/i8259.h>
 #include <asm/proto.h>
 #include <asm/apic.h>
-#include <asm/i8259.h>
+#include <asm/desc.h>
+#include <asm/hpet.h>
+#include <asm/idle.h>
+#include <asm/mtrr.h>
 #include <asm/smp.h>
 
-#include <mach_apic.h>
-#include <mach_apicdef.h>
-#include <mach_ipi.h>
+unsigned int num_processors;
+
+unsigned disabled_cpus __cpuinitdata;
+
+/* Processor that is doing the boot up */
+unsigned int boot_cpu_physical_apicid = -1U;
 
 /*
- * Sanity check
+ * The highest APIC ID seen during enumeration.
+ *
+ * This determines the messaging protocol we can use: if all APIC IDs
+ * are in the 0 ... 7 range, then we can use logical addressing which
+ * has some performance advantages (better broadcasting).
+ *
+ * If there's an APIC ID above 8, we use physical addressing.
  */
-#if ((SPURIOUS_APIC_VECTOR & 0x0F) != 0x0F)
-# error SPURIOUS_APIC_VECTOR definition error
-#endif
+unsigned int max_physical_apicid;
+
+/*
+ * Bitmask of physically existing CPUs:
+ */
+physid_mask_t phys_cpu_present_map;
+
+/*
+ * Map cpu index to physical APIC ID
+ */
+DEFINE_EARLY_PER_CPU(u16, x86_cpu_to_apicid, BAD_APICID);
+DEFINE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid, BAD_APICID);
+EXPORT_EARLY_PER_CPU_SYMBOL(x86_cpu_to_apicid);
+EXPORT_EARLY_PER_CPU_SYMBOL(x86_bios_cpu_apicid);
 
 #ifdef CONFIG_X86_32
 /*
@@ -457,7 +477,7 @@ static void lapic_timer_setup(enum clock_event_mode mode,
 static void lapic_timer_broadcast(const struct cpumask *mask)
 {
 #ifdef CONFIG_SMP
-        send_IPI_mask(mask, LOCAL_TIMER_VECTOR);
+        apic->send_IPI_mask(mask, LOCAL_TIMER_VECTOR);
 #endif
 }
 
@@ -535,7 +555,8 @@ static void __init lapic_cal_handler(struct clock_event_device *dev)
         }
 }
 
-static int __init calibrate_by_pmtimer(long deltapm, long *delta)
+static int __init
+calibrate_by_pmtimer(long deltapm, long *delta, long *deltatsc)
 {
         const long pm_100ms = PMTMR_TICKS_PER_SEC / 10;
         const long pm_thresh = pm_100ms / 100;
@@ -546,7 +567,7 @@ static int __init calibrate_by_pmtimer(long deltapm, long *delta)
         return -1;
 #endif
 
-        apic_printk(APIC_VERBOSE, "... PM timer delta = %ld\n", deltapm);
+        apic_printk(APIC_VERBOSE, "... PM-Timer delta = %ld\n", deltapm);
 
         /* Check, if the PM timer is available */
         if (!deltapm)
@@ -556,19 +577,30 @@ static int __init calibrate_by_pmtimer(long deltapm, long *delta)
 
         if (deltapm > (pm_100ms - pm_thresh) &&
             deltapm < (pm_100ms + pm_thresh)) {
-                apic_printk(APIC_VERBOSE, "... PM timer result ok\n");
-        } else {
-                res = (((u64)deltapm) *  mult) >> 22;
-                do_div(res, 1000000);
-                pr_warning("APIC calibration not consistent "
-                        "with PM Timer: %ldms instead of 100ms\n",
-                        (long)res);
-                /* Correct the lapic counter value */
-                res = (((u64)(*delta)) * pm_100ms);
+                apic_printk(APIC_VERBOSE, "... PM-Timer result ok\n");
+                return 0;
+        }
+
+        res = (((u64)deltapm) *  mult) >> 22;
+        do_div(res, 1000000);
+        pr_warning("APIC calibration not consistent "
+                   "with PM-Timer: %ldms instead of 100ms\n",(long)res);
+
+        /* Correct the lapic counter value */
+        res = (((u64)(*delta)) * pm_100ms);
+        do_div(res, deltapm);
+        pr_info("APIC delta adjusted to PM-Timer: "
+                "%lu (%ld)\n", (unsigned long)res, *delta);
+        *delta = (long)res;
+
+        /* Correct the tsc counter value */
+        if (cpu_has_tsc) {
+                res = (((u64)(*deltatsc)) * pm_100ms);
                 do_div(res, deltapm);
-                pr_info("APIC delta adjusted to PM-Timer: "
-                        "%lu (%ld)\n", (unsigned long)res, *delta);
-                *delta = (long)res;
+                apic_printk(APIC_VERBOSE, "TSC delta adjusted to "
+                                          "PM-Timer: %lu (%ld) \n",
+                                        (unsigned long)res, *deltatsc);
+                *deltatsc = (long)res;
         }
 
         return 0;
@@ -579,7 +611,7 @@ static int __init calibrate_APIC_clock(void)
         struct clock_event_device *levt = &__get_cpu_var(lapic_events);
         void (*real_handler)(struct clock_event_device *dev);
         unsigned long deltaj;
-        long delta;
+        long delta, deltatsc;
         int pm_referenced = 0;
 
         local_irq_disable();
@@ -609,9 +641,11 @@ static int __init calibrate_APIC_clock(void)
         delta = lapic_cal_t1 - lapic_cal_t2;
         apic_printk(APIC_VERBOSE, "... lapic delta = %ld\n", delta);
 
+        deltatsc = (long)(lapic_cal_tsc2 - lapic_cal_tsc1);
+
         /* we trust the PM based calibration if possible */
         pm_referenced = !calibrate_by_pmtimer(lapic_cal_pm2 - lapic_cal_pm1,
-                                        &delta);
+                                        &delta, &deltatsc);
 
         /* Calculate the scaled math multiplication factor */
         lapic_clockevent.mult = div_sc(delta, TICK_NSEC * LAPIC_CAL_LOOPS,
@@ -629,11 +663,10 @@ static int __init calibrate_APIC_clock(void)
                     calibration_result);
 
         if (cpu_has_tsc) {
-                delta = (long)(lapic_cal_tsc2 - lapic_cal_tsc1);
                 apic_printk(APIC_VERBOSE, "..... CPU clock speed is "
                             "%ld.%04ld MHz.\n",
-                            (delta / LAPIC_CAL_LOOPS) / (1000000 / HZ),
-                            (delta / LAPIC_CAL_LOOPS) % (1000000 / HZ));
+                            (deltatsc / LAPIC_CAL_LOOPS) / (1000000 / HZ),
+                            (deltatsc / LAPIC_CAL_LOOPS) % (1000000 / HZ));
         }
 
         apic_printk(APIC_VERBOSE, "..... host bus clock speed is "
@@ -991,11 +1024,11 @@ int __init verify_local_APIC(void)
          */
         reg0 = apic_read(APIC_ID);
         apic_printk(APIC_DEBUG, "Getting ID: %x\n", reg0);
-        apic_write(APIC_ID, reg0 ^ APIC_ID_MASK);
+        apic_write(APIC_ID, reg0 ^ apic->apic_id_mask);
         reg1 = apic_read(APIC_ID);
         apic_printk(APIC_DEBUG, "Getting ID: %x\n", reg1);
         apic_write(APIC_ID, reg0);
-        if (reg1 != (reg0 ^ APIC_ID_MASK))
+        if (reg1 != (reg0 ^ apic->apic_id_mask))
                 return 0;
 
         /*
@@ -1089,7 +1122,7 @@ static void __cpuinit lapic_setup_esr(void)
                 return;
         }
 
-        if (esr_disable) {
+        if (apic->disable_esr) {
                 /*
                  * Something untraceable is creating bad interrupts on
                  * secondary quads ... for the moment, just leave the
@@ -1130,9 +1163,14 @@ void __cpuinit setup_local_APIC(void)
         unsigned int value;
         int i, j;
 
+        if (disable_apic) {
+                arch_disable_smp_support();
+                return;
+        }
+
 #ifdef CONFIG_X86_32
         /* Pound the ESR really hard over the head with a big hammer - mbligh */
-        if (lapic_is_integrated() && esr_disable) {
+        if (lapic_is_integrated() && apic->disable_esr) {
                 apic_write(APIC_ESR, 0);
                 apic_write(APIC_ESR, 0);
                 apic_write(APIC_ESR, 0);
@@ -1146,7 +1184,7 @@ void __cpuinit setup_local_APIC(void)
          * Double-check whether this APIC is really registered.
          * This is meaningless in clustered apic mode, so we skip it.
          */
-        if (!apic_id_registered())
+        if (!apic->apic_id_registered())
                 BUG();
 
         /*
@@ -1154,7 +1192,7 @@ void __cpuinit setup_local_APIC(void)
          * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
          * document number 292116).  So here it goes...
          */
-        init_apic_ldr();
+        apic->init_apic_ldr();
 
         /*
          * Set Task Priority to 'accept all'. We never change this
@@ -1436,7 +1474,7 @@ static int __init detect_init_APIC(void)
         switch (boot_cpu_data.x86_vendor) {
         case X86_VENDOR_AMD:
                 if ((boot_cpu_data.x86 == 6 && boot_cpu_data.x86_model > 1) ||
-                    (boot_cpu_data.x86 == 15))
+                    (boot_cpu_data.x86 >= 15))
                         break;
                 goto no_apic;
         case X86_VENDOR_INTEL:
@@ -1570,11 +1608,11 @@ int apic_version[MAX_APICS];
 
 int __init APIC_init_uniprocessor(void)
 {
-#ifdef CONFIG_X86_64
         if (disable_apic) {
                 pr_info("Apic disabled\n");
                 return -1;
         }
+#ifdef CONFIG_X86_64
         if (!cpu_has_apic) {
                 disable_apic = 1;
                 pr_info("Apic disabled by BIOS\n");
@@ -1600,7 +1638,7 @@ int __init APIC_init_uniprocessor(void)
         enable_IR_x2apic();
 #endif
 #ifdef CONFIG_X86_64
-        setup_apic_routing();
+        default_setup_apic_routing();
 #endif
 
         verify_local_APIC();
@@ -1738,7 +1776,8 @@ void __init connect_bsp_APIC(void)
                 outb(0x01, 0x23);
         }
 #endif
-        enable_apic_mode();
+        if (apic->enable_apic_mode)
+                apic->enable_apic_mode();
 }
 
 /**
@@ -1876,29 +1915,39 @@ void __cpuinit generic_processor_info(int apicid, int version)
         }
 #endif
 
-#if defined(CONFIG_X86_SMP) || defined(CONFIG_X86_64)
-        /* are we being called early in kernel startup? */
-        if (early_per_cpu_ptr(x86_cpu_to_apicid)) {
-                u16 *cpu_to_apicid = early_per_cpu_ptr(x86_cpu_to_apicid);
-                u16 *bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
-
-                cpu_to_apicid[cpu] = apicid;
-                bios_cpu_apicid[cpu] = apicid;
-        } else {
-                per_cpu(x86_cpu_to_apicid, cpu) = apicid;
-                per_cpu(x86_bios_cpu_apicid, cpu) = apicid;
-        }
+#if defined(CONFIG_SMP) || defined(CONFIG_X86_64)
+        early_per_cpu(x86_cpu_to_apicid, cpu) = apicid;
+        early_per_cpu(x86_bios_cpu_apicid, cpu) = apicid;
 #endif
 
         set_cpu_possible(cpu, true);
         set_cpu_present(cpu, true);
 }
 
-#ifdef CONFIG_X86_64
 int hard_smp_processor_id(void)
 {
         return read_apic_id();
 }
+
+void default_init_apic_ldr(void)
+{
+        unsigned long val;
+
+        apic_write(APIC_DFR, APIC_DFR_VALUE);
+        val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+        val |= SET_APIC_LOGICAL_ID(1UL << smp_processor_id());
+        apic_write(APIC_LDR, val);
+}
+
+#ifdef CONFIG_X86_32
+int default_apicid_to_node(int logical_apicid)
+{
+#ifdef CONFIG_SMP
+        return apicid_2_node[hard_smp_processor_id()];
+#else
+        return 0;
+#endif
+}
 #endif
 
 /*
diff --git a/arch/x86/kernel/apm_32.c b/arch/x86/kernel/apm_32.c
index 98807bb095a..37ba5f85b71 100644
--- a/arch/x86/kernel/apm_32.c
+++ b/arch/x86/kernel/apm_32.c
@@ -301,7 +301,7 @@ extern int (*console_blank_hook)(int);
  */
 #define APM_ZERO_SEGS
 
-#include "apm.h"
+#include <asm/apm.h>
 
 /*
  * Define to re-initialize the interrupt 0 timer to 100 Hz after a suspend.
diff --git a/arch/x86/kernel/asm-offsets_32.c b/arch/x86/kernel/asm-offsets_32.c
index ee4df08feee..fbf2f33e308 100644
--- a/arch/x86/kernel/asm-offsets_32.c
+++ b/arch/x86/kernel/asm-offsets_32.c
@@ -75,6 +75,7 @@ void foo(void)
         OFFSET(PT_DS,  pt_regs, ds);
         OFFSET(PT_ES,  pt_regs, es);
         OFFSET(PT_FS,  pt_regs, fs);
+        OFFSET(PT_GS,  pt_regs, gs);
         OFFSET(PT_ORIG_EAX, pt_regs, orig_ax);
         OFFSET(PT_EIP, pt_regs, ip);
         OFFSET(PT_CS,  pt_regs, cs);
diff --git a/arch/x86/kernel/asm-offsets_64.c b/arch/x86/kernel/asm-offsets_64.c
index 1d41d3f1edb..8793ab33e2c 100644
--- a/arch/x86/kernel/asm-offsets_64.c
+++ b/arch/x86/kernel/asm-offsets_64.c
@@ -11,7 +11,6 @@
 #include <linux/hardirq.h>
 #include <linux/suspend.h>
 #include <linux/kbuild.h>
-#include <asm/pda.h>
 #include <asm/processor.h>
 #include <asm/segment.h>
 #include <asm/thread_info.h>
@@ -48,16 +47,6 @@ int main(void)
 #endif
         BLANK();
 #undef ENTRY
-#define ENTRY(entry) DEFINE(pda_ ## entry, offsetof(struct x8664_pda, entry))
-        ENTRY(kernelstack); 
-        ENTRY(oldrsp); 
-        ENTRY(pcurrent); 
-        ENTRY(irqcount);
-        ENTRY(cpunumber);
-        ENTRY(irqstackptr);
-        ENTRY(data_offset);
-        BLANK();
-#undef ENTRY
 #ifdef CONFIG_PARAVIRT
         BLANK();
         OFFSET(PARAVIRT_enabled, pv_info, paravirt_enabled);
diff --git a/arch/x86/kernel/bigsmp_32.c b/arch/x86/kernel/bigsmp_32.c
new file mode 100644
index 00000000000..47a62f46afd
--- /dev/null
+++ b/arch/x86/kernel/bigsmp_32.c
@@ -0,0 +1,266 @@
+/*
+ * APIC driver for "bigsmp" XAPIC machines with more than 8 virtual CPUs.
+ * Drives the local APIC in "clustered mode".
+ */
+#define APIC_DEFINITION 1
+#include <linux/threads.h>
+#include <linux/cpumask.h>
+#include <asm/mpspec.h>
+#include <asm/genapic.h>
+#include <asm/fixmap.h>
+#include <asm/apicdef.h>
+#include <asm/ipi.h>
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/dmi.h>
+#include <linux/smp.h>
+
+
+static inline unsigned bigsmp_get_apic_id(unsigned long x)
+{
+        return (x >> 24) & 0xFF;
+}
+
+#define xapic_phys_to_log_apicid(cpu) (per_cpu(x86_bios_cpu_apicid, cpu))
+
+static inline int bigsmp_apic_id_registered(void)
+{
+        return 1;
+}
+
+static inline const cpumask_t *bigsmp_target_cpus(void)
+{
+#ifdef CONFIG_SMP
+        return &cpu_online_map;
+#else
+        return &cpumask_of_cpu(0);
+#endif
+}
+
+#define APIC_DFR_VALUE          (APIC_DFR_FLAT)
+
+static inline unsigned long
+bigsmp_check_apicid_used(physid_mask_t bitmap, int apicid)
+{
+        return 0;
+}
+
+static inline unsigned long bigsmp_check_apicid_present(int bit)
+{
+        return 1;
+}
+
+static inline unsigned long calculate_ldr(int cpu)
+{
+        unsigned long val, id;
+        val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+        id = xapic_phys_to_log_apicid(cpu);
+        val |= SET_APIC_LOGICAL_ID(id);
+        return val;
+}
+
+/*
+ * Set up the logical destination ID.
+ *
+ * Intel recommends to set DFR, LDR and TPR before enabling
+ * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
+ * document number 292116).  So here it goes...
+ */
+static inline void bigsmp_init_apic_ldr(void)
+{
+        unsigned long val;
+        int cpu = smp_processor_id();
+
+        apic_write(APIC_DFR, APIC_DFR_VALUE);
+        val = calculate_ldr(cpu);
+        apic_write(APIC_LDR, val);
+}
+
+static inline void bigsmp_setup_apic_routing(void)
+{
+        printk("Enabling APIC mode:  %s.  Using %d I/O APICs\n",
+                "Physflat", nr_ioapics);
+}
+
+static inline int bigsmp_apicid_to_node(int logical_apicid)
+{
+        return apicid_2_node[hard_smp_processor_id()];
+}
+
+static inline int bigsmp_cpu_present_to_apicid(int mps_cpu)
+{
+        if (mps_cpu < nr_cpu_ids)
+                return (int) per_cpu(x86_bios_cpu_apicid, mps_cpu);
+
+        return BAD_APICID;
+}
+
+static inline physid_mask_t bigsmp_apicid_to_cpu_present(int phys_apicid)
+{
+        return physid_mask_of_physid(phys_apicid);
+}
+
+extern u8 cpu_2_logical_apicid[];
+/* Mapping from cpu number to logical apicid */
+static inline int bigsmp_cpu_to_logical_apicid(int cpu)
+{
+        if (cpu >= nr_cpu_ids)
+                return BAD_APICID;
+        return cpu_physical_id(cpu);
+}
+
+static inline physid_mask_t bigsmp_ioapic_phys_id_map(physid_mask_t phys_map)
+{
+        /* For clustered we don't have a good way to do this yet - hack */
+        return physids_promote(0xFFL);
+}
+
+static inline void bigsmp_setup_portio_remap(void)
+{
+}
+
+static inline int bigsmp_check_phys_apicid_present(int boot_cpu_physical_apicid)
+{
+        return 1;
+}
+
+/* As we are using single CPU as destination, pick only one CPU here */
+static inline unsigned int bigsmp_cpu_mask_to_apicid(const cpumask_t *cpumask)
+{
+        return bigsmp_cpu_to_logical_apicid(first_cpu(*cpumask));
+}
+
+static inline unsigned int
+bigsmp_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
+                              const struct cpumask *andmask)
+{
+        int cpu;
+
+        /*
+         * We're using fixed IRQ delivery, can only return one phys APIC ID.
+         * May as well be the first.
+         */
+        for_each_cpu_and(cpu, cpumask, andmask) {
+                if (cpumask_test_cpu(cpu, cpu_online_mask))
+                        break;
+        }
+        if (cpu < nr_cpu_ids)
+                return bigsmp_cpu_to_logical_apicid(cpu);
+
+        return BAD_APICID;
+}
+
+static inline int bigsmp_phys_pkg_id(int cpuid_apic, int index_msb)
+{
+        return cpuid_apic >> index_msb;
+}
+
+static inline void bigsmp_send_IPI_mask(const struct cpumask *mask, int vector)
+{
+        default_send_IPI_mask_sequence_phys(mask, vector);
+}
+
+static inline void bigsmp_send_IPI_allbutself(int vector)
+{
+        default_send_IPI_mask_allbutself_phys(cpu_online_mask, vector);
+}
+
+static inline void bigsmp_send_IPI_all(int vector)
+{
+        bigsmp_send_IPI_mask(cpu_online_mask, vector);
+}
+
+static int dmi_bigsmp; /* can be set by dmi scanners */
+
+static int hp_ht_bigsmp(const struct dmi_system_id *d)
+{
+        printk(KERN_NOTICE "%s detected: force use of apic=bigsmp\n", d->ident);
+        dmi_bigsmp = 1;
+        return 0;
+}
+
+
+static const struct dmi_system_id bigsmp_dmi_table[] = {
+        { hp_ht_bigsmp, "HP ProLiant DL760 G2",
+        { DMI_MATCH(DMI_BIOS_VENDOR, "HP"),
+        DMI_MATCH(DMI_BIOS_VERSION, "P44-"),}
+        },
+
+        { hp_ht_bigsmp, "HP ProLiant DL740",
+        { DMI_MATCH(DMI_BIOS_VENDOR, "HP"),
+        DMI_MATCH(DMI_BIOS_VERSION, "P47-"),}
+        },
+         { }
+};
+
+static void bigsmp_vector_allocation_domain(int cpu, cpumask_t *retmask)
+{
+        cpus_clear(*retmask);
+        cpu_set(cpu, *retmask);
+}
+
+static int probe_bigsmp(void)
+{
+        if (def_to_bigsmp)
+                dmi_bigsmp = 1;
+        else
+                dmi_check_system(bigsmp_dmi_table);
+        return dmi_bigsmp;
+}
+
+struct genapic apic_bigsmp = {
+
+        .name                           = "bigsmp",
+        .probe                          = probe_bigsmp,
+        .acpi_madt_oem_check            = NULL,
+        .apic_id_registered             = bigsmp_apic_id_registered,
+
+        .irq_delivery_mode              = dest_Fixed,
+        /* phys delivery to target CPU: */
+        .irq_dest_mode                  = 0,
+
+        .target_cpus                    = bigsmp_target_cpus,
+        .disable_esr                    = 1,
+        .dest_logical                   = 0,
+        .check_apicid_used              = bigsmp_check_apicid_used,
+        .check_apicid_present           = bigsmp_check_apicid_present,
+
+        .vector_allocation_domain       = bigsmp_vector_allocation_domain,
+        .init_apic_ldr                  = bigsmp_init_apic_ldr,
+
+        .ioapic_phys_id_map             = bigsmp_ioapic_phys_id_map,
+        .setup_apic_routing             = bigsmp_setup_apic_routing,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = bigsmp_apicid_to_node,
+        .cpu_to_logical_apicid          = bigsmp_cpu_to_logical_apicid,
+        .cpu_present_to_apicid          = bigsmp_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = bigsmp_apicid_to_cpu_present,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = bigsmp_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = bigsmp_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = bigsmp_get_apic_id,
+        .set_apic_id                    = NULL,
+        .apic_id_mask                   = 0xFF << 24,
+
+        .cpu_mask_to_apicid             = bigsmp_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = bigsmp_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = bigsmp_send_IPI_mask,
+        .send_IPI_mask_allbutself       = NULL,
+        .send_IPI_allbutself            = bigsmp_send_IPI_allbutself,
+        .send_IPI_all                   = bigsmp_send_IPI_all,
+        .send_IPI_self                  = default_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+
+        .wait_for_init_deassert         = default_wait_for_init_deassert,
+
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = default_inquire_remote_apic,
+};
diff --git a/arch/x86/kernel/cpu/addon_cpuid_features.c b/arch/x86/kernel/cpu/addon_cpuid_features.c
index 2cf23634b6d..e48640cfac0 100644
--- a/arch/x86/kernel/cpu/addon_cpuid_features.c
+++ b/arch/x86/kernel/cpu/addon_cpuid_features.c
@@ -7,7 +7,7 @@
 #include <asm/pat.h>
 #include <asm/processor.h>
 
-#include <mach_apic.h>
+#include <asm/genapic.h>
 
 struct cpuid_bit {
         u16 feature;
@@ -69,7 +69,7 @@ void __cpuinit init_scattered_cpuid_features(struct cpuinfo_x86 *c)
  */
 void __cpuinit detect_extended_topology(struct cpuinfo_x86 *c)
 {
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_SMP
         unsigned int eax, ebx, ecx, edx, sub_index;
         unsigned int ht_mask_width, core_plus_mask_width;
         unsigned int core_select_mask, core_level_siblings;
@@ -116,22 +116,14 @@ void __cpuinit detect_extended_topology(struct cpuinfo_x86 *c)
 
         core_select_mask = (~(-1 << core_plus_mask_width)) >> ht_mask_width;
 
-#ifdef CONFIG_X86_32
-        c->cpu_core_id = phys_pkg_id(c->initial_apicid, ht_mask_width)
+        c->cpu_core_id = apic->phys_pkg_id(c->initial_apicid, ht_mask_width)
                                                  & core_select_mask;
-        c->phys_proc_id = phys_pkg_id(c->initial_apicid, core_plus_mask_width);
+        c->phys_proc_id = apic->phys_pkg_id(c->initial_apicid, core_plus_mask_width);
         /*
          * Reinit the apicid, now that we have extended initial_apicid.
          */
-        c->apicid = phys_pkg_id(c->initial_apicid, 0);
-#else
-        c->cpu_core_id = phys_pkg_id(ht_mask_width) & core_select_mask;
-        c->phys_proc_id = phys_pkg_id(core_plus_mask_width);
-        /*
-         * Reinit the apicid, now that we have extended initial_apicid.
-         */
-        c->apicid = phys_pkg_id(0);
-#endif
+        c->apicid = apic->phys_pkg_id(c->initial_apicid, 0);
+
         c->x86_max_cores = (core_level_siblings / smp_num_siblings);
 
 
@@ -143,37 +135,3 @@ void __cpuinit detect_extended_topology(struct cpuinfo_x86 *c)
         return;
 #endif
 }
-
-#ifdef CONFIG_X86_PAT
-void __cpuinit validate_pat_support(struct cpuinfo_x86 *c)
-{
-        if (!cpu_has_pat)
-                pat_disable("PAT not supported by CPU.");
-
-        switch (c->x86_vendor) {
-        case X86_VENDOR_INTEL:
-                /*
-                 * There is a known erratum on Pentium III and Core Solo
-                 * and Core Duo CPUs.
-                 * " Page with PAT set to WC while associated MTRR is UC
-                 *   may consolidate to UC "
-                 * Because of this erratum, it is better to stick with
-                 * setting WC in MTRR rather than using PAT on these CPUs.
-                 *
-                 * Enable PAT WC only on P4, Core 2 or later CPUs.
-                 */
-                if (c->x86 > 0x6 || (c->x86 == 6 && c->x86_model >= 15))
-                        return;
-
-                pat_disable("PAT WC disabled due to known CPU erratum.");
-                return;
-
-        case X86_VENDOR_AMD:
-        case X86_VENDOR_CENTAUR:
-        case X86_VENDOR_TRANSMETA:
-                return;
-        }
-
-        pat_disable("PAT disabled. Not yet verified on this CPU type.");
-}
-#endif
diff --git a/arch/x86/kernel/cpu/amd.c b/arch/x86/kernel/cpu/amd.c
index 7c878f6aa91..ff4d7b9e32e 100644
--- a/arch/x86/kernel/cpu/amd.c
+++ b/arch/x86/kernel/cpu/amd.c
@@ -12,7 +12,7 @@
 # include <asm/cacheflush.h>
 #endif
 
-#include <mach_apic.h>
+#include <asm/genapic.h>
 
 #include "cpu.h"
 
diff --git a/arch/x86/kernel/cpu/common.c b/arch/x86/kernel/cpu/common.c
index 83492b1f93b..e8f4a386bd9 100644
--- a/arch/x86/kernel/cpu/common.c
+++ b/arch/x86/kernel/cpu/common.c
@@ -21,14 +21,16 @@
 #include <asm/asm.h>
 #include <asm/numa.h>
 #include <asm/smp.h>
+#include <asm/cpu.h>
+#include <asm/cpumask.h>
 #ifdef CONFIG_X86_LOCAL_APIC
 #include <asm/mpspec.h>
 #include <asm/apic.h>
-#include <mach_apic.h>
 #include <asm/genapic.h>
+#include <asm/genapic.h>
+#include <asm/uv/uv.h>
 #endif
 
-#include <asm/pda.h>
 #include <asm/pgtable.h>
 #include <asm/processor.h>
 #include <asm/desc.h>
@@ -37,6 +39,7 @@
 #include <asm/sections.h>
 #include <asm/setup.h>
 #include <asm/hypervisor.h>
+#include <asm/stackprotector.h>
 
 #include "cpu.h"
 
@@ -50,6 +53,15 @@ cpumask_var_t cpu_initialized_mask;
 /* representing cpus for which sibling maps can be computed */
 cpumask_var_t cpu_sibling_setup_mask;
 
+/* correctly size the local cpu masks */
+void __init setup_cpu_local_masks(void)
+{
+        alloc_bootmem_cpumask_var(&cpu_initialized_mask);
+        alloc_bootmem_cpumask_var(&cpu_callin_mask);
+        alloc_bootmem_cpumask_var(&cpu_callout_mask);
+        alloc_bootmem_cpumask_var(&cpu_sibling_setup_mask);
+}
+
 #else /* CONFIG_X86_32 */
 
 cpumask_t cpu_callin_map;
@@ -62,23 +74,23 @@ cpumask_t cpu_sibling_setup_map;
 
 static struct cpu_dev *this_cpu __cpuinitdata;
 
+DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
 #ifdef CONFIG_X86_64
-/* We need valid kernel segments for data and code in long mode too
- * IRET will check the segment types  kkeil 2000/10/28
- * Also sysret mandates a special GDT layout
- */
-/* The TLS descriptors are currently at a different place compared to i386.
-   Hopefully nobody expects them at a fixed place (Wine?) */
-DEFINE_PER_CPU(struct gdt_page, gdt_page) = { .gdt = {
+        /*
+         * We need valid kernel segments for data and code in long mode too
+         * IRET will check the segment types  kkeil 2000/10/28
+         * Also sysret mandates a special GDT layout
+         *
+         * The TLS descriptors are currently at a different place compared to i386.
+         * Hopefully nobody expects them at a fixed place (Wine?)
+         */
         [GDT_ENTRY_KERNEL32_CS] = { { { 0x0000ffff, 0x00cf9b00 } } },
         [GDT_ENTRY_KERNEL_CS] = { { { 0x0000ffff, 0x00af9b00 } } },
         [GDT_ENTRY_KERNEL_DS] = { { { 0x0000ffff, 0x00cf9300 } } },
         [GDT_ENTRY_DEFAULT_USER32_CS] = { { { 0x0000ffff, 0x00cffb00 } } },
         [GDT_ENTRY_DEFAULT_USER_DS] = { { { 0x0000ffff, 0x00cff300 } } },
         [GDT_ENTRY_DEFAULT_USER_CS] = { { { 0x0000ffff, 0x00affb00 } } },
-} };
 #else
-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
         [GDT_ENTRY_KERNEL_CS] = { { { 0x0000ffff, 0x00cf9a00 } } },
         [GDT_ENTRY_KERNEL_DS] = { { { 0x0000ffff, 0x00cf9200 } } },
         [GDT_ENTRY_DEFAULT_USER_CS] = { { { 0x0000ffff, 0x00cffa00 } } },
@@ -110,9 +122,10 @@ DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
         [GDT_ENTRY_APMBIOS_BASE+2] = { { { 0x0000ffff, 0x00409200 } } },
 
         [GDT_ENTRY_ESPFIX_SS] = { { { 0x00000000, 0x00c09200 } } },
-        [GDT_ENTRY_PERCPU] = { { { 0x00000000, 0x00000000 } } },
-} };
+        [GDT_ENTRY_PERCPU] = { { { 0x0000ffff, 0x00cf9200 } } },
+        GDT_STACK_CANARY_INIT
 #endif
+} };
 EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
 
 #ifdef CONFIG_X86_32
@@ -213,6 +226,49 @@ static inline void squash_the_stupid_serial_number(struct cpuinfo_x86 *c)
 #endif
 
 /*
+ * Some CPU features depend on higher CPUID levels, which may not always
+ * be available due to CPUID level capping or broken virtualization
+ * software.  Add those features to this table to auto-disable them.
+ */
+struct cpuid_dependent_feature {
+        u32 feature;
+        u32 level;
+};
+static const struct cpuid_dependent_feature __cpuinitconst
+cpuid_dependent_features[] = {
+        { X86_FEATURE_MWAIT,            0x00000005 },
+        { X86_FEATURE_DCA,              0x00000009 },
+        { X86_FEATURE_XSAVE,            0x0000000d },
+        { 0, 0 }
+};
+
+static void __cpuinit filter_cpuid_features(struct cpuinfo_x86 *c, bool warn)
+{
+        const struct cpuid_dependent_feature *df;
+        for (df = cpuid_dependent_features; df->feature; df++) {
+                /*
+                 * Note: cpuid_level is set to -1 if unavailable, but
+                 * extended_extended_level is set to 0 if unavailable
+                 * and the legitimate extended levels are all negative
+                 * when signed; hence the weird messing around with
+                 * signs here...
+                 */
+                if (cpu_has(c, df->feature) &&
+                    ((s32)df->feature < 0 ?
+                     (u32)df->feature > (u32)c->extended_cpuid_level :
+                     (s32)df->feature > (s32)c->cpuid_level)) {
+                        clear_cpu_cap(c, df->feature);
+                        if (warn)
+                                printk(KERN_WARNING
+                                       "CPU: CPU feature %s disabled "
+                                       "due to lack of CPUID level 0x%x\n",
+                                       x86_cap_flags[df->feature],
+                                       df->level);
+                }
+        }
+}       
+
+/*
  * Naming convention should be: <Name> [(<Codename>)]
  * This table only is used unless init_<vendor>() below doesn't set it;
  * in particular, if CPUID levels 0x80000002..4 are supported, this isn't used
@@ -242,18 +298,29 @@ static char __cpuinit *table_lookup_model(struct cpuinfo_x86 *c)
 
 __u32 cleared_cpu_caps[NCAPINTS] __cpuinitdata;
 
+void load_percpu_segment(int cpu)
+{
+#ifdef CONFIG_X86_32
+        loadsegment(fs, __KERNEL_PERCPU);
+#else
+        loadsegment(gs, 0);
+        wrmsrl(MSR_GS_BASE, (unsigned long)per_cpu(irq_stack_union.gs_base, cpu));
+#endif
+        load_stack_canary_segment();
+}
+
 /* Current gdt points %fs at the "master" per-cpu area: after this,
  * it's on the real one. */
-void switch_to_new_gdt(void)
+void switch_to_new_gdt(int cpu)
 {
         struct desc_ptr gdt_descr;
 
-        gdt_descr.address = (long)get_cpu_gdt_table(smp_processor_id());
+        gdt_descr.address = (long)get_cpu_gdt_table(cpu);
         gdt_descr.size = GDT_SIZE - 1;
         load_gdt(&gdt_descr);
-#ifdef CONFIG_X86_32
-        asm("mov %0, %%fs" : : "r" (__KERNEL_PERCPU) : "memory");
-#endif
+        /* Reload the per-cpu base */
+
+        load_percpu_segment(cpu);
 }
 
 static struct cpu_dev *cpu_devs[X86_VENDOR_NUM] = {};
@@ -383,11 +450,7 @@ void __cpuinit detect_ht(struct cpuinfo_x86 *c)
                 }
 
                 index_msb = get_count_order(smp_num_siblings);
-#ifdef CONFIG_X86_64
-                c->phys_proc_id = phys_pkg_id(index_msb);
-#else
-                c->phys_proc_id = phys_pkg_id(c->initial_apicid, index_msb);
-#endif
+                c->phys_proc_id = apic->phys_pkg_id(c->initial_apicid, index_msb);
 
                 smp_num_siblings = smp_num_siblings / c->x86_max_cores;
 
@@ -395,13 +458,8 @@ void __cpuinit detect_ht(struct cpuinfo_x86 *c)
 
                 core_bits = get_count_order(c->x86_max_cores);
 
-#ifdef CONFIG_X86_64
-                c->cpu_core_id = phys_pkg_id(index_msb) &
-                                               ((1 << core_bits) - 1);
-#else
-                c->cpu_core_id = phys_pkg_id(c->initial_apicid, index_msb) &
+                c->cpu_core_id = apic->phys_pkg_id(c->initial_apicid, index_msb) &
                                                ((1 << core_bits) - 1);
-#endif
         }
 
 out:
@@ -570,11 +628,10 @@ static void __init early_identify_cpu(struct cpuinfo_x86 *c)
         if (this_cpu->c_early_init)
                 this_cpu->c_early_init(c);
 
-        validate_pat_support(c);
-
 #ifdef CONFIG_SMP
         c->cpu_index = boot_cpu_id;
 #endif
+        filter_cpuid_features(c, false);
 }
 
 void __init early_cpu_init(void)
@@ -637,7 +694,7 @@ static void __cpuinit generic_identify(struct cpuinfo_x86 *c)
                 c->initial_apicid = (cpuid_ebx(1) >> 24) & 0xFF;
 #ifdef CONFIG_X86_32
 # ifdef CONFIG_X86_HT
-                c->apicid = phys_pkg_id(c->initial_apicid, 0);
+                c->apicid = apic->phys_pkg_id(c->initial_apicid, 0);
 # else
                 c->apicid = c->initial_apicid;
 # endif
@@ -684,7 +741,7 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
                 this_cpu->c_identify(c);
 
 #ifdef CONFIG_X86_64
-        c->apicid = phys_pkg_id(0);
+        c->apicid = apic->phys_pkg_id(c->initial_apicid, 0);
 #endif
 
         /*
@@ -708,6 +765,9 @@ static void __cpuinit identify_cpu(struct cpuinfo_x86 *c)
          * we do "generic changes."
          */
 
+        /* Filter out anything that depends on CPUID levels we don't have */
+        filter_cpuid_features(c, true);
+
         /* If the model name is still unset, do table lookup. */
         if (!c->x86_model_id[0]) {
                 char *p;
@@ -877,54 +937,22 @@ static __init int setup_disablecpuid(char *arg)
 __setup("clearcpuid=", setup_disablecpuid);
 
 #ifdef CONFIG_X86_64
-struct x8664_pda **_cpu_pda __read_mostly;
-EXPORT_SYMBOL(_cpu_pda);
-
 struct desc_ptr idt_descr = { 256 * 16 - 1, (unsigned long) idt_table };
 
-static char boot_cpu_stack[IRQSTACKSIZE] __page_aligned_bss;
-
-void __cpuinit pda_init(int cpu)
-{
-        struct x8664_pda *pda = cpu_pda(cpu);
+DEFINE_PER_CPU_FIRST(union irq_stack_union,
+                     irq_stack_union) __aligned(PAGE_SIZE);
+DEFINE_PER_CPU(char *, irq_stack_ptr) =
+        init_per_cpu_var(irq_stack_union.irq_stack) + IRQ_STACK_SIZE - 64;
 
-        /* Setup up data that may be needed in __get_free_pages early */
-        loadsegment(fs, 0);
-        loadsegment(gs, 0);
-        /* Memory clobbers used to order PDA accessed */
-        mb();
-        wrmsrl(MSR_GS_BASE, pda);
-        mb();
-
-        pda->cpunumber = cpu;
-        pda->irqcount = -1;
-        pda->kernelstack = (unsigned long)stack_thread_info() -
-                                 PDA_STACKOFFSET + THREAD_SIZE;
-        pda->active_mm = &init_mm;
-        pda->mmu_state = 0;
-
-        if (cpu == 0) {
-                /* others are initialized in smpboot.c */
-                pda->pcurrent = &init_task;
-                pda->irqstackptr = boot_cpu_stack;
-                pda->irqstackptr += IRQSTACKSIZE - 64;
-        } else {
-                if (!pda->irqstackptr) {
-                        pda->irqstackptr = (char *)
-                                __get_free_pages(GFP_ATOMIC, IRQSTACK_ORDER);
-                        if (!pda->irqstackptr)
-                                panic("cannot allocate irqstack for cpu %d",
-                                      cpu);
-                        pda->irqstackptr += IRQSTACKSIZE - 64;
-                }
+DEFINE_PER_CPU(unsigned long, kernel_stack) =
+        (unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
+EXPORT_PER_CPU_SYMBOL(kernel_stack);
 
-                if (pda->nodenumber == 0 && cpu_to_node(cpu) != NUMA_NO_NODE)
-                        pda->nodenumber = cpu_to_node(cpu);
-        }
-}
+DEFINE_PER_CPU(unsigned int, irq_count) = -1;
 
-static char boot_exception_stacks[(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ +
-                                  DEBUG_STKSZ] __page_aligned_bss;
+static DEFINE_PER_CPU_PAGE_ALIGNED(char, exception_stacks
+        [(N_EXCEPTION_STACKS - 1) * EXCEPTION_STKSZ + DEBUG_STKSZ])
+        __aligned(PAGE_SIZE);
 
 extern asmlinkage void ignore_sysret(void);
 
@@ -957,16 +985,21 @@ unsigned long kernel_eflags;
  */
 DEFINE_PER_CPU(struct orig_ist, orig_ist);
 
-#else
+#else   /* x86_64 */
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+DEFINE_PER_CPU(unsigned long, stack_canary);
+#endif
 
-/* Make sure %fs is initialized properly in idle threads */
+/* Make sure %fs and %gs are initialized properly in idle threads */
 struct pt_regs * __cpuinit idle_regs(struct pt_regs *regs)
 {
         memset(regs, 0, sizeof(struct pt_regs));
         regs->fs = __KERNEL_PERCPU;
+        regs->gs = __KERNEL_STACK_CANARY;
         return regs;
 }
-#endif
+#endif  /* x86_64 */
 
 /*
  * cpu_init() initializes state that is per-CPU. Some data is already
@@ -982,15 +1015,14 @@ void __cpuinit cpu_init(void)
         struct tss_struct *t = &per_cpu(init_tss, cpu);
         struct orig_ist *orig_ist = &per_cpu(orig_ist, cpu);
         unsigned long v;
-        char *estacks = NULL;
         struct task_struct *me;
         int i;
 
-        /* CPU 0 is initialised in head64.c */
-        if (cpu != 0)
-                pda_init(cpu);
-        else
-                estacks = boot_exception_stacks;
+#ifdef CONFIG_NUMA
+        if (cpu != 0 && percpu_read(node_number) == 0 &&
+            cpu_to_node(cpu) != NUMA_NO_NODE)
+                percpu_write(node_number, cpu_to_node(cpu));
+#endif
 
         me = current;
 
@@ -1006,7 +1038,9 @@ void __cpuinit cpu_init(void)
          * and set up the GDT descriptor:
          */
 
-        switch_to_new_gdt();
+        switch_to_new_gdt(cpu);
+        loadsegment(fs, 0);
+
         load_idt((const struct desc_ptr *)&idt_descr);
 
         memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
@@ -1024,18 +1058,13 @@ void __cpuinit cpu_init(void)
          * set up and load the per-CPU TSS
          */
         if (!orig_ist->ist[0]) {
-                static const unsigned int order[N_EXCEPTION_STACKS] = {
-                  [0 ... N_EXCEPTION_STACKS - 1] = EXCEPTION_STACK_ORDER,
-                  [DEBUG_STACK - 1] = DEBUG_STACK_ORDER
+                static const unsigned int sizes[N_EXCEPTION_STACKS] = {
+                  [0 ... N_EXCEPTION_STACKS - 1] = EXCEPTION_STKSZ,
+                  [DEBUG_STACK - 1] = DEBUG_STKSZ
                 };
+                char *estacks = per_cpu(exception_stacks, cpu);
                 for (v = 0; v < N_EXCEPTION_STACKS; v++) {
-                        if (cpu) {
-                                estacks = (char *)__get_free_pages(GFP_ATOMIC, order[v]);
-                                if (!estacks)
-                                        panic("Cannot allocate exception "
-                                              "stack %ld %d\n", v, cpu);
-                        }
-                        estacks += PAGE_SIZE << order[v];
+                        estacks += sizes[v];
                         orig_ist->ist[v] = t->x86_tss.ist[v] =
                                         (unsigned long)estacks;
                 }
@@ -1069,22 +1098,19 @@ void __cpuinit cpu_init(void)
          */
         if (kgdb_connected && arch_kgdb_ops.correct_hw_break)
                 arch_kgdb_ops.correct_hw_break();
-        else {
+        else
 #endif
-        /*
-         * Clear all 6 debug registers:
-         */
-
-        set_debugreg(0UL, 0);
-        set_debugreg(0UL, 1);
-        set_debugreg(0UL, 2);
-        set_debugreg(0UL, 3);
-        set_debugreg(0UL, 6);
-        set_debugreg(0UL, 7);
-#ifdef CONFIG_KGDB
-        /* If the kgdb is connected no debug regs should be altered. */
+        {
+                /*
+                 * Clear all 6 debug registers:
+                 */
+                set_debugreg(0UL, 0);
+                set_debugreg(0UL, 1);
+                set_debugreg(0UL, 2);
+                set_debugreg(0UL, 3);
+                set_debugreg(0UL, 6);
+                set_debugreg(0UL, 7);
         }
-#endif
 
         fpu_init();
 
@@ -1114,7 +1140,7 @@ void __cpuinit cpu_init(void)
                 clear_in_cr4(X86_CR4_VME|X86_CR4_PVI|X86_CR4_TSD|X86_CR4_DE);
 
         load_idt(&idt_descr);
-        switch_to_new_gdt();
+        switch_to_new_gdt(cpu);
 
         /*
          * Set up and load the per-CPU TSS and LDT
@@ -1135,9 +1161,6 @@ void __cpuinit cpu_init(void)
         __set_tss_desc(cpu, GDT_ENTRY_DOUBLEFAULT_TSS, &doublefault_tss);
 #endif
 
-        /* Clear %gs. */
-        asm volatile ("mov %0, %%gs" : : "r" (0));
-
         /* Clear all 6 debug registers: */
         set_debugreg(0, 0);
         set_debugreg(0, 1);
diff --git a/arch/x86/kernel/cpu/cpufreq/Kconfig b/arch/x86/kernel/cpu/cpufreq/Kconfig
index efae3b22a0f..65792c2cc46 100644
--- a/arch/x86/kernel/cpu/cpufreq/Kconfig
+++ b/arch/x86/kernel/cpu/cpufreq/Kconfig
@@ -245,17 +245,6 @@ config X86_E_POWERSAVER
 
 comment "shared options"
 
-config X86_ACPI_CPUFREQ_PROC_INTF
-        bool "/proc/acpi/processor/../performance interface (deprecated)"
-        depends on PROC_FS
-        depends on X86_ACPI_CPUFREQ || X86_POWERNOW_K7_ACPI || X86_POWERNOW_K8_ACPI
-        help
-          This enables the deprecated /proc/acpi/processor/../performance
-          interface. While it is helpful for debugging, the generic,
-          cross-architecture cpufreq interfaces should be used.
-
-          If in doubt, say N.
-
 config X86_SPEEDSTEP_LIB
         tristate
         default (X86_SPEEDSTEP_ICH || X86_SPEEDSTEP_SMI || X86_P4_CLOCKMOD)
diff --git a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
index 5c28b37dea1..fb039cd345d 100644
--- a/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
+++ b/arch/x86/kernel/cpu/cpufreq/powernow-k8.c
@@ -939,10 +939,25 @@ static void powernow_k8_cpu_exit_acpi(struct powernow_k8_data *data)
         free_cpumask_var(data->acpi_data.shared_cpu_map);
 }
 
+static int get_transition_latency(struct powernow_k8_data *data)
+{
+        int max_latency = 0;
+        int i;
+        for (i = 0; i < data->acpi_data.state_count; i++) {
+                int cur_latency = data->acpi_data.states[i].transition_latency
+                        + data->acpi_data.states[i].bus_master_latency;
+                if (cur_latency > max_latency)
+                        max_latency = cur_latency;
+        }
+        /* value in usecs, needs to be in nanoseconds */
+        return 1000 * max_latency;
+}
+
 #else
 static int powernow_k8_cpu_init_acpi(struct powernow_k8_data *data) { return -ENODEV; }
 static void powernow_k8_cpu_exit_acpi(struct powernow_k8_data *data) { return; }
 static void powernow_k8_acpi_pst_values(struct powernow_k8_data *data, unsigned int index) { return; }
+static int get_transition_latency(struct powernow_k8_data *data) { return 0; }
 #endif /* CONFIG_X86_POWERNOW_K8_ACPI */
 
 /* Take a frequency, and issue the fid/vid transition command */
@@ -1173,7 +1188,13 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                 if (rc) {
                         goto err_out;
                 }
-        }
+                /* Take a crude guess here.
+                 * That guess was in microseconds, so multiply with 1000 */
+                pol->cpuinfo.transition_latency = (
+                         ((data->rvo + 8) * data->vstable * VST_UNITS_20US) +
+                         ((1 << data->irt) * 30)) * 1000;
+        } else /* ACPI _PSS objects available */
+                pol->cpuinfo.transition_latency = get_transition_latency(data);
 
         /* only run on specific CPU from here on */
         oldmask = current->cpus_allowed;
@@ -1204,11 +1225,6 @@ static int __cpuinit powernowk8_cpu_init(struct cpufreq_policy *pol)
                 cpumask_copy(pol->cpus, &per_cpu(cpu_core_map, pol->cpu));
         data->available_cores = pol->cpus;
 
-        /* Take a crude guess here.
-         * That guess was in microseconds, so multiply with 1000 */
-        pol->cpuinfo.transition_latency = (((data->rvo + 8) * data->vstable * VST_UNITS_20US)
-            + (3 * (1 << data->irt) * 10)) * 1000;
-
         if (cpu_family == CPU_HW_PSTATE)
                 pol->cur = find_khz_freq_from_pstate(data->powernow_table, data->currpstate);
         else
diff --git a/arch/x86/kernel/cpu/intel.c b/arch/x86/kernel/cpu/intel.c
index 549f2ada55f..1f137a87d4b 100644
--- a/arch/x86/kernel/cpu/intel.c
+++ b/arch/x86/kernel/cpu/intel.c
@@ -24,13 +24,13 @@
 #ifdef CONFIG_X86_LOCAL_APIC
 #include <asm/mpspec.h>
 #include <asm/apic.h>
-#include <mach_apic.h>
+#include <asm/genapic.h>
 #endif
 
 static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
 {
         /* Unmask CPUID levels if masked: */
-        if (c->x86 == 6 && c->x86_model >= 15) {
+        if (c->x86 > 6 || (c->x86 == 6 && c->x86_model >= 0xd)) {
                 u64 misc_enable;
 
                 rdmsrl(MSR_IA32_MISC_ENABLE, misc_enable);
@@ -63,6 +63,18 @@ static void __cpuinit early_init_intel(struct cpuinfo_x86 *c)
                 set_cpu_cap(c, X86_FEATURE_NONSTOP_TSC);
         }
 
+        /*
+         * There is a known erratum on Pentium III and Core Solo
+         * and Core Duo CPUs.
+         * " Page with PAT set to WC while associated MTRR is UC
+         *   may consolidate to UC "
+         * Because of this erratum, it is better to stick with
+         * setting WC in MTRR rather than using PAT on these CPUs.
+         *
+         * Enable PAT WC only on P4, Core 2 or later CPUs.
+         */
+        if (c->x86 == 6 && c->x86_model < 15)
+                clear_cpu_cap(c, X86_FEATURE_PAT);
 }
 
 #ifdef CONFIG_X86_32
@@ -291,6 +303,9 @@ static void __cpuinit init_intel(struct cpuinfo_x86 *c)
                 ds_init_intel(c);
         }
 
+        if (c->x86 == 6 && c->x86_model == 29 && cpu_has_clflush)
+                set_cpu_cap(c, X86_FEATURE_CLFLUSH_MONITOR);
+
 #ifdef CONFIG_X86_64
         if (c->x86 == 15)
                 c->x86_cache_alignment = c->x86_clflush_size * 2;
diff --git a/arch/x86/kernel/cpu/intel_cacheinfo.c b/arch/x86/kernel/cpu/intel_cacheinfo.c
index 48533d77be7..7293508d8f5 100644
--- a/arch/x86/kernel/cpu/intel_cacheinfo.c
+++ b/arch/x86/kernel/cpu/intel_cacheinfo.c
@@ -36,8 +36,11 @@ static struct _cache_table cache_table[] __cpuinitdata =
 {
         { 0x06, LVL_1_INST, 8 },        /* 4-way set assoc, 32 byte line size */
         { 0x08, LVL_1_INST, 16 },       /* 4-way set assoc, 32 byte line size */
+        { 0x09, LVL_1_INST, 32 },       /* 4-way set assoc, 64 byte line size */
         { 0x0a, LVL_1_DATA, 8 },        /* 2 way set assoc, 32 byte line size */
         { 0x0c, LVL_1_DATA, 16 },       /* 4-way set assoc, 32 byte line size */
+        { 0x0d, LVL_1_DATA, 16 },       /* 4-way set assoc, 64 byte line size */
+        { 0x21, LVL_2,      256 },      /* 8-way set assoc, 64 byte line size */
         { 0x22, LVL_3,      512 },      /* 4-way set assoc, sectored cache, 64 byte line size */
         { 0x23, LVL_3,      1024 },     /* 8-way set assoc, sectored cache, 64 byte line size */
         { 0x25, LVL_3,      2048 },     /* 8-way set assoc, sectored cache, 64 byte line size */
@@ -85,6 +88,18 @@ static struct _cache_table cache_table[] __cpuinitdata =
         { 0x85, LVL_2,    2048 },       /* 8-way set assoc, 32 byte line size */
         { 0x86, LVL_2,     512 },       /* 4-way set assoc, 64 byte line size */
         { 0x87, LVL_2,    1024 },       /* 8-way set assoc, 64 byte line size */
+        { 0xd0, LVL_3,     512 },       /* 4-way set assoc, 64 byte line size */
+        { 0xd1, LVL_3,    1024 },       /* 4-way set assoc, 64 byte line size */
+        { 0xd2, LVL_3,    2048 },       /* 4-way set assoc, 64 byte line size */
+        { 0xd6, LVL_3,    1024 },       /* 8-way set assoc, 64 byte line size */
+        { 0xd7, LVL_3,    2038 },       /* 8-way set assoc, 64 byte line size */
+        { 0xd8, LVL_3,    4096 },       /* 12-way set assoc, 64 byte line size */
+        { 0xdc, LVL_3,    2048 },       /* 12-way set assoc, 64 byte line size */
+        { 0xdd, LVL_3,    4096 },       /* 12-way set assoc, 64 byte line size */
+        { 0xde, LVL_3,    8192 },       /* 12-way set assoc, 64 byte line size */
+        { 0xe2, LVL_3,    2048 },       /* 16-way set assoc, 64 byte line size */
+        { 0xe3, LVL_3,    4096 },       /* 16-way set assoc, 64 byte line size */
+        { 0xe4, LVL_3,    8192 },       /* 16-way set assoc, 64 byte line size */
         { 0x00, 0, 0}
 };
 
@@ -132,7 +147,16 @@ struct _cpuid4_info {
         union _cpuid4_leaf_ecx ecx;
         unsigned long size;
         unsigned long can_disable;
-        cpumask_t shared_cpu_map;       /* future?: only cpus/node is needed */
+        DECLARE_BITMAP(shared_cpu_map, NR_CPUS);
+};
+
+/* subset of above _cpuid4_info w/o shared_cpu_map */
+struct _cpuid4_info_regs {
+        union _cpuid4_leaf_eax eax;
+        union _cpuid4_leaf_ebx ebx;
+        union _cpuid4_leaf_ecx ecx;
+        unsigned long size;
+        unsigned long can_disable;
 };
 
 #ifdef CONFIG_PCI
@@ -263,7 +287,7 @@ amd_cpuid4(int leaf, union _cpuid4_leaf_eax *eax,
 }
 
 static void __cpuinit
-amd_check_l3_disable(int index, struct _cpuid4_info *this_leaf)
+amd_check_l3_disable(int index, struct _cpuid4_info_regs *this_leaf)
 {
         if (index < 3)
                 return;
@@ -271,7 +295,8 @@ amd_check_l3_disable(int index, struct _cpuid4_info *this_leaf)
 }
 
 static int
-__cpuinit cpuid4_cache_lookup(int index, struct _cpuid4_info *this_leaf)
+__cpuinit cpuid4_cache_lookup_regs(int index,
+                                   struct _cpuid4_info_regs *this_leaf)
 {
         union _cpuid4_leaf_eax  eax;
         union _cpuid4_leaf_ebx  ebx;
@@ -299,6 +324,15 @@ __cpuinit cpuid4_cache_lookup(int index, struct _cpuid4_info *this_leaf)
         return 0;
 }
 
+static int
+__cpuinit cpuid4_cache_lookup(int index, struct _cpuid4_info *this_leaf)
+{
+        struct _cpuid4_info_regs *leaf_regs =
+                (struct _cpuid4_info_regs *)this_leaf;
+
+        return cpuid4_cache_lookup_regs(index, leaf_regs);
+}
+
 static int __cpuinit find_num_cache_leaves(void)
 {
         unsigned int            eax, ebx, ecx, edx;
@@ -338,11 +372,10 @@ unsigned int __cpuinit init_intel_cacheinfo(struct cpuinfo_x86 *c)
                  * parameters cpuid leaf to find the cache details
                  */
                 for (i = 0; i < num_cache_leaves; i++) {
-                        struct _cpuid4_info this_leaf;
-
+                        struct _cpuid4_info_regs this_leaf;
                         int retval;
 
-                        retval = cpuid4_cache_lookup(i, &this_leaf);
+                        retval = cpuid4_cache_lookup_regs(i, &this_leaf);
                         if (retval >= 0) {
                                 switch(this_leaf.eax.split.level) {
                                     case 1:
@@ -491,17 +524,20 @@ static void __cpuinit cache_shared_cpu_map_setup(unsigned int cpu, int index)
         num_threads_sharing = 1 + this_leaf->eax.split.num_threads_sharing;
 
         if (num_threads_sharing == 1)
-                cpu_set(cpu, this_leaf->shared_cpu_map);
+                cpumask_set_cpu(cpu, to_cpumask(this_leaf->shared_cpu_map));
         else {
                 index_msb = get_count_order(num_threads_sharing);
 
                 for_each_online_cpu(i) {
                         if (cpu_data(i).apicid >> index_msb ==
                             c->apicid >> index_msb) {
-                                cpu_set(i, this_leaf->shared_cpu_map);
+                                cpumask_set_cpu(i,
+                                        to_cpumask(this_leaf->shared_cpu_map));
                                 if (i != cpu && per_cpu(cpuid4_info, i))  {
-                                        sibling_leaf = CPUID4_INFO_IDX(i, index);
-                                        cpu_set(cpu, sibling_leaf->shared_cpu_map);
+                                        sibling_leaf =
+                                                CPUID4_INFO_IDX(i, index);
+                                        cpumask_set_cpu(cpu, to_cpumask(
+                                                sibling_leaf->shared_cpu_map));
                                 }
                         }
                 }
@@ -513,9 +549,10 @@ static void __cpuinit cache_remove_shared_cpu_map(unsigned int cpu, int index)
         int sibling;
 
         this_leaf = CPUID4_INFO_IDX(cpu, index);
-        for_each_cpu_mask_nr(sibling, this_leaf->shared_cpu_map) {
+        for_each_cpu(sibling, to_cpumask(this_leaf->shared_cpu_map)) {
                 sibling_leaf = CPUID4_INFO_IDX(sibling, index);
-                cpu_clear(cpu, sibling_leaf->shared_cpu_map);
+                cpumask_clear_cpu(cpu,
+                                  to_cpumask(sibling_leaf->shared_cpu_map));
         }
 }
 #else
@@ -620,8 +657,9 @@ static ssize_t show_shared_cpu_map_func(struct _cpuid4_info *this_leaf,
         int n = 0;
 
         if (len > 1) {
-                cpumask_t *mask = &this_leaf->shared_cpu_map;
+                const struct cpumask *mask;
 
+                mask = to_cpumask(this_leaf->shared_cpu_map);
                 n = type?
                         cpulist_scnprintf(buf, len-2, mask) :
                         cpumask_scnprintf(buf, len-2, mask);
@@ -684,7 +722,8 @@ static struct pci_dev *get_k8_northbridge(int node)
 
 static ssize_t show_cache_disable(struct _cpuid4_info *this_leaf, char *buf)
 {
-        int node = cpu_to_node(first_cpu(this_leaf->shared_cpu_map));
+        const struct cpumask *mask = to_cpumask(this_leaf->shared_cpu_map);
+        int node = cpu_to_node(cpumask_first(mask));
         struct pci_dev *dev = NULL;
         ssize_t ret = 0;
         int i;
@@ -718,7 +757,8 @@ static ssize_t
 store_cache_disable(struct _cpuid4_info *this_leaf, const char *buf,
                     size_t count)
 {
-        int node = cpu_to_node(first_cpu(this_leaf->shared_cpu_map));
+        const struct cpumask *mask = to_cpumask(this_leaf->shared_cpu_map);
+        int node = cpu_to_node(cpumask_first(mask));
         struct pci_dev *dev = NULL;
         unsigned int ret, index, val;
 
@@ -863,7 +903,7 @@ err_out:
         return -ENOMEM;
 }
 
-static cpumask_t cache_dev_map = CPU_MASK_NONE;
+static DECLARE_BITMAP(cache_dev_map, NR_CPUS);
 
 /* Add/Remove cache interface for CPU device */
 static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
@@ -903,7 +943,7 @@ static int __cpuinit cache_add_dev(struct sys_device * sys_dev)
                 }
                 kobject_uevent(&(this_object->kobj), KOBJ_ADD);
         }
-        cpu_set(cpu, cache_dev_map);
+        cpumask_set_cpu(cpu, to_cpumask(cache_dev_map));
 
         kobject_uevent(per_cpu(cache_kobject, cpu), KOBJ_ADD);
         return 0;
@@ -916,9 +956,9 @@ static void __cpuinit cache_remove_dev(struct sys_device * sys_dev)
 
         if (per_cpu(cpuid4_info, cpu) == NULL)
                 return;
-        if (!cpu_isset(cpu, cache_dev_map))
+        if (!cpumask_test_cpu(cpu, to_cpumask(cache_dev_map)))
                 return;
-        cpu_clear(cpu, cache_dev_map);
+        cpumask_clear_cpu(cpu, to_cpumask(cache_dev_map));
 
         for (i = 0; i < num_cache_leaves; i++)
                 kobject_put(&(INDEX_KOBJECT_PTR(cpu,i)->kobj));
diff --git a/arch/x86/kernel/cpu/mcheck/mce_amd_64.c b/arch/x86/kernel/cpu/mcheck/mce_amd_64.c
index 8ae8c4ff094..4772e91e824 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_amd_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_amd_64.c
@@ -67,7 +67,7 @@ static struct threshold_block threshold_defaults = {
 struct threshold_bank {
         struct kobject *kobj;
         struct threshold_block *blocks;
-        cpumask_t cpus;
+        cpumask_var_t cpus;
 };
 static DEFINE_PER_CPU(struct threshold_bank *, threshold_banks[NR_BANKS]);
 
@@ -481,7 +481,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
 
 #ifdef CONFIG_SMP
         if (cpu_data(cpu).cpu_core_id && shared_bank[bank]) {   /* symlink */
-                i = first_cpu(per_cpu(cpu_core_map, cpu));
+                i = cpumask_first(&per_cpu(cpu_core_map, cpu));
 
                 /* first core not up yet */
                 if (cpu_data(i).cpu_core_id)
@@ -501,7 +501,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
                 if (err)
                         goto out;
 
-                b->cpus = per_cpu(cpu_core_map, cpu);
+                cpumask_copy(b->cpus, &per_cpu(cpu_core_map, cpu));
                 per_cpu(threshold_banks, cpu)[bank] = b;
                 goto out;
         }
@@ -512,15 +512,20 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
                 err = -ENOMEM;
                 goto out;
         }
+        if (!alloc_cpumask_var(&b->cpus, GFP_KERNEL)) {
+                kfree(b);
+                err = -ENOMEM;
+                goto out;
+        }
 
         b->kobj = kobject_create_and_add(name, &per_cpu(device_mce, cpu).kobj);
         if (!b->kobj)
                 goto out_free;
 
 #ifndef CONFIG_SMP
-        b->cpus = CPU_MASK_ALL;
+        cpumask_setall(b->cpus);
 #else
-        b->cpus = per_cpu(cpu_core_map, cpu);
+        cpumask_copy(b->cpus, &per_cpu(cpu_core_map, cpu));
 #endif
 
         per_cpu(threshold_banks, cpu)[bank] = b;
@@ -529,7 +534,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
         if (err)
                 goto out_free;
 
-        for_each_cpu_mask_nr(i, b->cpus) {
+        for_each_cpu(i, b->cpus) {
                 if (i == cpu)
                         continue;
 
@@ -545,6 +550,7 @@ static __cpuinit int threshold_create_bank(unsigned int cpu, unsigned int bank)
 
 out_free:
         per_cpu(threshold_banks, cpu)[bank] = NULL;
+        free_cpumask_var(b->cpus);
         kfree(b);
 out:
         return err;
@@ -619,7 +625,7 @@ static void threshold_remove_bank(unsigned int cpu, int bank)
 #endif
 
         /* remove all sibling symlinks before unregistering */
-        for_each_cpu_mask_nr(i, b->cpus) {
+        for_each_cpu(i, b->cpus) {
                 if (i == cpu)
                         continue;
 
@@ -632,6 +638,7 @@ static void threshold_remove_bank(unsigned int cpu, int bank)
 free_out:
         kobject_del(b->kobj);
         kobject_put(b->kobj);
+        free_cpumask_var(b->cpus);
         kfree(b);
         per_cpu(threshold_banks, cpu)[bank] = NULL;
 }
diff --git a/arch/x86/kernel/cpu/mcheck/mce_intel_64.c b/arch/x86/kernel/cpu/mcheck/mce_intel_64.c
index 4b48f251fd3..5e8c79e748a 100644
--- a/arch/x86/kernel/cpu/mcheck/mce_intel_64.c
+++ b/arch/x86/kernel/cpu/mcheck/mce_intel_64.c
@@ -7,6 +7,7 @@
 #include <linux/interrupt.h>
 #include <linux/percpu.h>
 #include <asm/processor.h>
+#include <asm/apic.h>
 #include <asm/msr.h>
 #include <asm/mce.h>
 #include <asm/hw_irq.h>
diff --git a/arch/x86/kernel/cpu/mtrr/main.c b/arch/x86/kernel/cpu/mtrr/main.c
index d259e5d2e05..236a401b825 100644
--- a/arch/x86/kernel/cpu/mtrr/main.c
+++ b/arch/x86/kernel/cpu/mtrr/main.c
@@ -1594,8 +1594,7 @@ int __init mtrr_trim_uncached_memory(unsigned long end_pfn)
 
         /* kvm/qemu doesn't have mtrr set right, don't trim them all */
         if (!highest_pfn) {
-                WARN(!kvm_para_available(), KERN_WARNING
-                                "WARNING: strange, CPU MTRRs all blank?\n");
+                printk(KERN_INFO "CPU MTRRs all blank - virtualized system.\n");
                 return 0;
         }
 
diff --git a/arch/x86/kernel/crash.c b/arch/x86/kernel/crash.c
index c689d19e35a..ad7f2a696f4 100644
--- a/arch/x86/kernel/crash.c
+++ b/arch/x86/kernel/crash.c
@@ -24,11 +24,11 @@
 #include <asm/apic.h>
 #include <asm/hpet.h>
 #include <linux/kdebug.h>
-#include <asm/smp.h>
+#include <asm/cpu.h>
 #include <asm/reboot.h>
 #include <asm/virtext.h>
 
-#include <mach_ipi.h>
+#include <asm/genapic.h>
 
 
 #if defined(CONFIG_SMP) && defined(CONFIG_X86_LOCAL_APIC)
diff --git a/arch/x86/kernel/ds.c b/arch/x86/kernel/ds.c
index da91701a234..169a120587b 100644
--- a/arch/x86/kernel/ds.c
+++ b/arch/x86/kernel/ds.c
@@ -15,8 +15,8 @@
  * - buffer allocation (memory accounting)
  *
  *
- * Copyright (C) 2007-2008 Intel Corporation.
- * Markus Metzger <markus.t.metzger@intel.com>, 2007-2008
+ * Copyright (C) 2007-2009 Intel Corporation.
+ * Markus Metzger <markus.t.metzger@intel.com>, 2007-2009
  */
 
 
@@ -890,7 +890,7 @@ int ds_set_pebs_reset(struct pebs_tracer *tracer, u64 value)
 }
 
 static const struct ds_configuration ds_cfg_netburst = {
-        .name = "netburst",
+        .name = "Netburst",
         .ctl[dsf_bts]           = (1 << 2) | (1 << 3),
         .ctl[dsf_bts_kernel]    = (1 << 5),
         .ctl[dsf_bts_user]      = (1 << 6),
@@ -904,7 +904,7 @@ static const struct ds_configuration ds_cfg_netburst = {
 #endif
 };
 static const struct ds_configuration ds_cfg_pentium_m = {
-        .name = "pentium m",
+        .name = "Pentium M",
         .ctl[dsf_bts]           = (1 << 6) | (1 << 7),
 
         .sizeof_field           = sizeof(long),
@@ -915,8 +915,8 @@ static const struct ds_configuration ds_cfg_pentium_m = {
         .sizeof_rec[ds_pebs]    = sizeof(long) * 18,
 #endif
 };
-static const struct ds_configuration ds_cfg_core2 = {
-        .name = "core 2",
+static const struct ds_configuration ds_cfg_core2_atom = {
+        .name = "Core 2/Atom",
         .ctl[dsf_bts]           = (1 << 6) | (1 << 7),
         .ctl[dsf_bts_kernel]    = (1 << 9),
         .ctl[dsf_bts_user]      = (1 << 10),
@@ -949,19 +949,22 @@ void __cpuinit ds_init_intel(struct cpuinfo_x86 *c)
         switch (c->x86) {
         case 0x6:
                 switch (c->x86_model) {
-                case 0 ... 0xC:
-                        /* sorry, don't know about them */
-                        break;
-                case 0xD:
-                case 0xE: /* Pentium M */
+                case 0x9:
+                case 0xd: /* Pentium M */
                         ds_configure(&ds_cfg_pentium_m);
                         break;
-                default: /* Core2, Atom, ... */
-                        ds_configure(&ds_cfg_core2);
+                case 0xf:
+                case 0x17: /* Core2 */
+                case 0x1c: /* Atom */
+                        ds_configure(&ds_cfg_core2_atom);
+                        break;
+                case 0x1a: /* i7 */
+                default:
+                        /* sorry, don't know about them */
                         break;
                 }
                 break;
-        case 0xF:
+        case 0xf:
                 switch (c->x86_model) {
                 case 0x0:
                 case 0x1:
diff --git a/arch/x86/kernel/dumpstack.c b/arch/x86/kernel/dumpstack.c
index 6b1f6f6f866..87d103ded1c 100644
--- a/arch/x86/kernel/dumpstack.c
+++ b/arch/x86/kernel/dumpstack.c
@@ -99,7 +99,7 @@ print_context_stack(struct thread_info *tinfo,
                                 frame = frame->next_frame;
                                 bp = (unsigned long) frame;
                         } else {
-                                ops->address(data, addr, bp == 0);
+                                ops->address(data, addr, 0);
                         }
                         print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
                 }
diff --git a/arch/x86/kernel/dumpstack_64.c b/arch/x86/kernel/dumpstack_64.c
index c302d070704..d35db5993fd 100644
--- a/arch/x86/kernel/dumpstack_64.c
+++ b/arch/x86/kernel/dumpstack_64.c
@@ -106,7 +106,8 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                 const struct stacktrace_ops *ops, void *data)
 {
         const unsigned cpu = get_cpu();
-        unsigned long *irqstack_end = (unsigned long *)cpu_pda(cpu)->irqstackptr;
+        unsigned long *irq_stack_end =
+                (unsigned long *)per_cpu(irq_stack_ptr, cpu);
         unsigned used = 0;
         struct thread_info *tinfo;
         int graph = 0;
@@ -160,23 +161,23 @@ void dump_trace(struct task_struct *task, struct pt_regs *regs,
                         stack = (unsigned long *) estack_end[-2];
                         continue;
                 }
-                if (irqstack_end) {
-                        unsigned long *irqstack;
-                        irqstack = irqstack_end -
-                                (IRQSTACKSIZE - 64) / sizeof(*irqstack);
+                if (irq_stack_end) {
+                        unsigned long *irq_stack;
+                        irq_stack = irq_stack_end -
+                                (IRQ_STACK_SIZE - 64) / sizeof(*irq_stack);
 
-                        if (stack >= irqstack && stack < irqstack_end) {
+                        if (stack >= irq_stack && stack < irq_stack_end) {
                                 if (ops->stack(data, "IRQ") < 0)
                                         break;
                                 bp = print_context_stack(tinfo, stack, bp,
-                                        ops, data, irqstack_end, &graph);
+                                        ops, data, irq_stack_end, &graph);
                                 /*
                                  * We link to the next stack (which would be
                                  * the process stack normally) the last
                                  * pointer (index -1 to end) in the IRQ stack:
                                  */
-                                stack = (unsigned long *) (irqstack_end[-1]);
-                                irqstack_end = NULL;
+                                stack = (unsigned long *) (irq_stack_end[-1]);
+                                irq_stack_end = NULL;
                                 ops->stack(data, "EOI");
                                 continue;
                         }
@@ -199,10 +200,10 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
         unsigned long *stack;
         int i;
         const int cpu = smp_processor_id();
-        unsigned long *irqstack_end =
-                (unsigned long *) (cpu_pda(cpu)->irqstackptr);
-        unsigned long *irqstack =
-                (unsigned long *) (cpu_pda(cpu)->irqstackptr - IRQSTACKSIZE);
+        unsigned long *irq_stack_end =
+                (unsigned long *)(per_cpu(irq_stack_ptr, cpu));
+        unsigned long *irq_stack =
+                (unsigned long *)(per_cpu(irq_stack_ptr, cpu) - IRQ_STACK_SIZE);
 
         /*
          * debugging aid: "show_stack(NULL, NULL);" prints the
@@ -218,9 +219,9 @@ show_stack_log_lvl(struct task_struct *task, struct pt_regs *regs,
 
         stack = sp;
         for (i = 0; i < kstack_depth_to_print; i++) {
-                if (stack >= irqstack && stack <= irqstack_end) {
-                        if (stack == irqstack_end) {
-                                stack = (unsigned long *) (irqstack_end[-1]);
+                if (stack >= irq_stack && stack <= irq_stack_end) {
+                        if (stack == irq_stack_end) {
+                                stack = (unsigned long *) (irq_stack_end[-1]);
                                 printk(" <EOI> ");
                         }
                 } else {
@@ -241,7 +242,7 @@ void show_registers(struct pt_regs *regs)
         int i;
         unsigned long sp;
         const int cpu = smp_processor_id();
-        struct task_struct *cur = cpu_pda(cpu)->pcurrent;
+        struct task_struct *cur = current;
 
         sp = regs->sp;
         printk("CPU %d ", cpu);
diff --git a/arch/x86/kernel/early_printk.c b/arch/x86/kernel/early_printk.c
index 504ad198e4a..639ad98238a 100644
--- a/arch/x86/kernel/early_printk.c
+++ b/arch/x86/kernel/early_printk.c
@@ -13,8 +13,8 @@
 #include <asm/setup.h>
 #include <xen/hvc-console.h>
 #include <asm/pci-direct.h>
-#include <asm/pgtable.h>
 #include <asm/fixmap.h>
+#include <asm/pgtable.h>
 #include <linux/usb/ehci_def.h>
 
 /* Simple VGA output */
diff --git a/arch/x86/kernel/efi.c b/arch/x86/kernel/efi.c
index 1119d247fe1..b205272ad39 100644
--- a/arch/x86/kernel/efi.c
+++ b/arch/x86/kernel/efi.c
@@ -366,10 +366,12 @@ void __init efi_init(void)
                                         SMBIOS_TABLE_GUID)) {
                         efi.smbios = config_tables[i].table;
                         printk(" SMBIOS=0x%lx ", config_tables[i].table);
+#ifdef CONFIG_X86_UV
                 } else if (!efi_guidcmp(config_tables[i].guid,
                                         UV_SYSTEM_TABLE_GUID)) {
                         efi.uv_systab = config_tables[i].table;
                         printk(" UVsystab=0x%lx ", config_tables[i].table);
+#endif
                 } else if (!efi_guidcmp(config_tables[i].guid,
                                         HCDP_TABLE_GUID)) {
                         efi.hcdp = config_tables[i].table;
diff --git a/arch/x86/kernel/efi_64.c b/arch/x86/kernel/efi_64.c
index 652c5287215..a4ee29127fd 100644
--- a/arch/x86/kernel/efi_64.c
+++ b/arch/x86/kernel/efi_64.c
@@ -36,6 +36,7 @@
 #include <asm/proto.h>
 #include <asm/efi.h>
 #include <asm/cacheflush.h>
+#include <asm/fixmap.h>
 
 static pgd_t save_pgd __initdata;
 static unsigned long efi_flags __initdata;
diff --git a/arch/x86/kernel/entry_32.S b/arch/x86/kernel/entry_32.S
index 46469029e9d..e9920683145 100644
--- a/arch/x86/kernel/entry_32.S
+++ b/arch/x86/kernel/entry_32.S
@@ -30,12 +30,13 @@
  *      1C(%esp) - %ds
  *      20(%esp) - %es
  *      24(%esp) - %fs
- *      28(%esp) - orig_eax
- *      2C(%esp) - %eip
- *      30(%esp) - %cs
- *      34(%esp) - %eflags
- *      38(%esp) - %oldesp
- *      3C(%esp) - %oldss
+ *      28(%esp) - %gs          saved iff !CONFIG_X86_32_LAZY_GS
+ *      2C(%esp) - orig_eax
+ *      30(%esp) - %eip
+ *      34(%esp) - %cs
+ *      38(%esp) - %eflags
+ *      3C(%esp) - %oldesp
+ *      40(%esp) - %oldss
  *
  * "current" is in register %ebx during any slow entries.
  */
@@ -101,121 +102,221 @@
 #define resume_userspace_sig    resume_userspace
 #endif
 
-#define SAVE_ALL \
-        cld; \
-        pushl %fs; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        /*CFI_REL_OFFSET fs, 0;*/\
-        pushl %es; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        /*CFI_REL_OFFSET es, 0;*/\
-        pushl %ds; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        /*CFI_REL_OFFSET ds, 0;*/\
-        pushl %eax; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET eax, 0;\
-        pushl %ebp; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET ebp, 0;\
-        pushl %edi; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET edi, 0;\
-        pushl %esi; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET esi, 0;\
-        pushl %edx; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET edx, 0;\
-        pushl %ecx; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET ecx, 0;\
-        pushl %ebx; \
-        CFI_ADJUST_CFA_OFFSET 4;\
-        CFI_REL_OFFSET ebx, 0;\
-        movl $(__USER_DS), %edx; \
-        movl %edx, %ds; \
-        movl %edx, %es; \
-        movl $(__KERNEL_PERCPU), %edx; \
+/*
+ * User gs save/restore
+ *
+ * %gs is used for userland TLS and kernel only uses it for stack
+ * canary which is required to be at %gs:20 by gcc.  Read the comment
+ * at the top of stackprotector.h for more info.
+ *
+ * Local labels 98 and 99 are used.
+ */
+#ifdef CONFIG_X86_32_LAZY_GS
+
+ /* unfortunately push/pop can't be no-op */
+.macro PUSH_GS
+        pushl $0
+        CFI_ADJUST_CFA_OFFSET 4
+.endm
+.macro POP_GS pop=0
+        addl $(4 + \pop), %esp
+        CFI_ADJUST_CFA_OFFSET -(4 + \pop)
+.endm
+.macro POP_GS_EX
+.endm
+
+ /* all the rest are no-op */
+.macro PTGS_TO_GS
+.endm
+.macro PTGS_TO_GS_EX
+.endm
+.macro GS_TO_REG reg
+.endm
+.macro REG_TO_PTGS reg
+.endm
+.macro SET_KERNEL_GS reg
+.endm
+
+#else   /* CONFIG_X86_32_LAZY_GS */
+
+.macro PUSH_GS
+        pushl %gs
+        CFI_ADJUST_CFA_OFFSET 4
+        /*CFI_REL_OFFSET gs, 0*/
+.endm
+
+.macro POP_GS pop=0
+98:     popl %gs
+        CFI_ADJUST_CFA_OFFSET -4
+        /*CFI_RESTORE gs*/
+  .if \pop <> 0
+        add $\pop, %esp
+        CFI_ADJUST_CFA_OFFSET -\pop
+  .endif
+.endm
+.macro POP_GS_EX
+.pushsection .fixup, "ax"
+99:     movl $0, (%esp)
+        jmp 98b
+.section __ex_table, "a"
+        .align 4
+        .long 98b, 99b
+.popsection
+.endm
+
+.macro PTGS_TO_GS
+98:     mov PT_GS(%esp), %gs
+.endm
+.macro PTGS_TO_GS_EX
+.pushsection .fixup, "ax"
+99:     movl $0, PT_GS(%esp)
+        jmp 98b
+.section __ex_table, "a"
+        .align 4
+        .long 98b, 99b
+.popsection
+.endm
+
+.macro GS_TO_REG reg
+        movl %gs, \reg
+        /*CFI_REGISTER gs, \reg*/
+.endm
+.macro REG_TO_PTGS reg
+        movl \reg, PT_GS(%esp)
+        /*CFI_REL_OFFSET gs, PT_GS*/
+.endm
+.macro SET_KERNEL_GS reg
+        movl $(__KERNEL_STACK_CANARY), \reg
+        movl \reg, %gs
+.endm
+
+#endif  /* CONFIG_X86_32_LAZY_GS */
+
+.macro SAVE_ALL
+        cld
+        PUSH_GS
+        pushl %fs
+        CFI_ADJUST_CFA_OFFSET 4
+        /*CFI_REL_OFFSET fs, 0;*/
+        pushl %es
+        CFI_ADJUST_CFA_OFFSET 4
+        /*CFI_REL_OFFSET es, 0;*/
+        pushl %ds
+        CFI_ADJUST_CFA_OFFSET 4
+        /*CFI_REL_OFFSET ds, 0;*/
+        pushl %eax
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET eax, 0
+        pushl %ebp
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET ebp, 0
+        pushl %edi
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET edi, 0
+        pushl %esi
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET esi, 0
+        pushl %edx
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET edx, 0
+        pushl %ecx
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET ecx, 0
+        pushl %ebx
+        CFI_ADJUST_CFA_OFFSET 4
+        CFI_REL_OFFSET ebx, 0
+        movl $(__USER_DS), %edx
+        movl %edx, %ds
+        movl %edx, %es
+        movl $(__KERNEL_PERCPU), %edx
         movl %edx, %fs
+        SET_KERNEL_GS %edx
+.endm
 
-#define RESTORE_INT_REGS \
-        popl %ebx;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        CFI_RESTORE ebx;\
-        popl %ecx;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        CFI_RESTORE ecx;\
-        popl %edx;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        CFI_RESTORE edx;\
-        popl %esi;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        CFI_RESTORE esi;\
-        popl %edi;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        CFI_RESTORE edi;\
-        popl %ebp;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        CFI_RESTORE ebp;\
-        popl %eax;      \
-        CFI_ADJUST_CFA_OFFSET -4;\
+.macro RESTORE_INT_REGS
+        popl %ebx
+        CFI_ADJUST_CFA_OFFSET -4
+        CFI_RESTORE ebx
+        popl %ecx
+        CFI_ADJUST_CFA_OFFSET -4
+        CFI_RESTORE ecx
+        popl %edx
+        CFI_ADJUST_CFA_OFFSET -4
+        CFI_RESTORE edx
+        popl %esi
+        CFI_ADJUST_CFA_OFFSET -4
+        CFI_RESTORE esi
+        popl %edi
+        CFI_ADJUST_CFA_OFFSET -4
+        CFI_RESTORE edi
+        popl %ebp
+        CFI_ADJUST_CFA_OFFSET -4
+        CFI_RESTORE ebp
+        popl %eax
+        CFI_ADJUST_CFA_OFFSET -4
         CFI_RESTORE eax
+.endm
 
-#define RESTORE_REGS    \
-        RESTORE_INT_REGS; \
-1:      popl %ds;       \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        /*CFI_RESTORE ds;*/\
-2:      popl %es;       \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        /*CFI_RESTORE es;*/\
-3:      popl %fs;       \
-        CFI_ADJUST_CFA_OFFSET -4;\
-        /*CFI_RESTORE fs;*/\
-.pushsection .fixup,"ax";       \
-4:      movl $0,(%esp); \
-        jmp 1b;         \
-5:      movl $0,(%esp); \
-        jmp 2b;         \
-6:      movl $0,(%esp); \
-        jmp 3b;         \
-.section __ex_table,"a";\
-        .align 4;       \
-        .long 1b,4b;    \
-        .long 2b,5b;    \
-        .long 3b,6b;    \
+.macro RESTORE_REGS pop=0
+        RESTORE_INT_REGS
+1:      popl %ds
+        CFI_ADJUST_CFA_OFFSET -4
+        /*CFI_RESTORE ds;*/
+2:      popl %es
+        CFI_ADJUST_CFA_OFFSET -4
+        /*CFI_RESTORE es;*/
+3:      popl %fs
+        CFI_ADJUST_CFA_OFFSET -4
+        /*CFI_RESTORE fs;*/
+        POP_GS \pop
+.pushsection .fixup, "ax"
+4:      movl $0, (%esp)
+        jmp 1b
+5:      movl $0, (%esp)
+        jmp 2b
+6:      movl $0, (%esp)
+        jmp 3b
+.section __ex_table, "a"
+        .align 4
+        .long 1b, 4b
+        .long 2b, 5b
+        .long 3b, 6b
 .popsection
+        POP_GS_EX
+.endm
 
-#define RING0_INT_FRAME \
-        CFI_STARTPROC simple;\
-        CFI_SIGNAL_FRAME;\
-        CFI_DEF_CFA esp, 3*4;\
-        /*CFI_OFFSET cs, -2*4;*/\
+.macro RING0_INT_FRAME
+        CFI_STARTPROC simple
+        CFI_SIGNAL_FRAME
+        CFI_DEF_CFA esp, 3*4
+        /*CFI_OFFSET cs, -2*4;*/
         CFI_OFFSET eip, -3*4
+.endm
 
-#define RING0_EC_FRAME \
-        CFI_STARTPROC simple;\
-        CFI_SIGNAL_FRAME;\
-        CFI_DEF_CFA esp, 4*4;\
-        /*CFI_OFFSET cs, -2*4;*/\
+.macro RING0_EC_FRAME
+        CFI_STARTPROC simple
+        CFI_SIGNAL_FRAME
+        CFI_DEF_CFA esp, 4*4
+        /*CFI_OFFSET cs, -2*4;*/
         CFI_OFFSET eip, -3*4
+.endm
 
-#define RING0_PTREGS_FRAME \
-        CFI_STARTPROC simple;\
-        CFI_SIGNAL_FRAME;\
-        CFI_DEF_CFA esp, PT_OLDESP-PT_EBX;\
-        /*CFI_OFFSET cs, PT_CS-PT_OLDESP;*/\
-        CFI_OFFSET eip, PT_EIP-PT_OLDESP;\
-        /*CFI_OFFSET es, PT_ES-PT_OLDESP;*/\
-        /*CFI_OFFSET ds, PT_DS-PT_OLDESP;*/\
-        CFI_OFFSET eax, PT_EAX-PT_OLDESP;\
-        CFI_OFFSET ebp, PT_EBP-PT_OLDESP;\
-        CFI_OFFSET edi, PT_EDI-PT_OLDESP;\
-        CFI_OFFSET esi, PT_ESI-PT_OLDESP;\
-        CFI_OFFSET edx, PT_EDX-PT_OLDESP;\
-        CFI_OFFSET ecx, PT_ECX-PT_OLDESP;\
+.macro RING0_PTREGS_FRAME
+        CFI_STARTPROC simple
+        CFI_SIGNAL_FRAME
+        CFI_DEF_CFA esp, PT_OLDESP-PT_EBX
+        /*CFI_OFFSET cs, PT_CS-PT_OLDESP;*/
+        CFI_OFFSET eip, PT_EIP-PT_OLDESP
+        /*CFI_OFFSET es, PT_ES-PT_OLDESP;*/
+        /*CFI_OFFSET ds, PT_DS-PT_OLDESP;*/
+        CFI_OFFSET eax, PT_EAX-PT_OLDESP
+        CFI_OFFSET ebp, PT_EBP-PT_OLDESP
+        CFI_OFFSET edi, PT_EDI-PT_OLDESP
+        CFI_OFFSET esi, PT_ESI-PT_OLDESP
+        CFI_OFFSET edx, PT_EDX-PT_OLDESP
+        CFI_OFFSET ecx, PT_ECX-PT_OLDESP
         CFI_OFFSET ebx, PT_EBX-PT_OLDESP
+.endm
 
 ENTRY(ret_from_fork)
         CFI_STARTPROC
@@ -362,6 +463,7 @@ sysenter_exit:
         xorl %ebp,%ebp
         TRACE_IRQS_ON
 1:      mov  PT_FS(%esp), %fs
+        PTGS_TO_GS
         ENABLE_INTERRUPTS_SYSEXIT
 
 #ifdef CONFIG_AUDITSYSCALL
@@ -410,6 +512,7 @@ sysexit_audit:
         .align 4
         .long 1b,2b
 .popsection
+        PTGS_TO_GS_EX
 ENDPROC(ia32_sysenter_target)
 
         # system call handler stub
@@ -452,8 +555,7 @@ restore_all:
 restore_nocheck:
         TRACE_IRQS_IRET
 restore_nocheck_notrace:
-        RESTORE_REGS
-        addl $4, %esp                   # skip orig_eax/error_code
+        RESTORE_REGS 4                  # skip orig_eax/error_code
         CFI_ADJUST_CFA_OFFSET -4
 irq_return:
         INTERRUPT_RETURN
@@ -595,28 +697,50 @@ syscall_badsys:
 END(syscall_badsys)
         CFI_ENDPROC
 
-#define FIXUP_ESPFIX_STACK \
-        /* since we are on a wrong stack, we cant make it a C code :( */ \
-        PER_CPU(gdt_page, %ebx); \
-        GET_DESC_BASE(GDT_ENTRY_ESPFIX_SS, %ebx, %eax, %ax, %al, %ah); \
-        addl %esp, %eax; \
-        pushl $__KERNEL_DS; \
-        CFI_ADJUST_CFA_OFFSET 4; \
-        pushl %eax; \
-        CFI_ADJUST_CFA_OFFSET 4; \
-        lss (%esp), %esp; \
-        CFI_ADJUST_CFA_OFFSET -8;
-#define UNWIND_ESPFIX_STACK \
-        movl %ss, %eax; \
-        /* see if on espfix stack */ \
-        cmpw $__ESPFIX_SS, %ax; \
-        jne 27f; \
-        movl $__KERNEL_DS, %eax; \
-        movl %eax, %ds; \
-        movl %eax, %es; \
-        /* switch to normal stack */ \
-        FIXUP_ESPFIX_STACK; \
-27:;
+/*
+ * System calls that need a pt_regs pointer.
+ */
+#define PTREGSCALL(name) \
+        ALIGN; \
+ptregs_##name: \
+        leal 4(%esp),%eax; \
+        jmp sys_##name;
+
+PTREGSCALL(iopl)
+PTREGSCALL(fork)
+PTREGSCALL(clone)
+PTREGSCALL(vfork)
+PTREGSCALL(execve)
+PTREGSCALL(sigaltstack)
+PTREGSCALL(sigreturn)
+PTREGSCALL(rt_sigreturn)
+PTREGSCALL(vm86)
+PTREGSCALL(vm86old)
+
+.macro FIXUP_ESPFIX_STACK
+        /* since we are on a wrong stack, we cant make it a C code :( */
+        PER_CPU(gdt_page, %ebx)
+        GET_DESC_BASE(GDT_ENTRY_ESPFIX_SS, %ebx, %eax, %ax, %al, %ah)
+        addl %esp, %eax
+        pushl $__KERNEL_DS
+        CFI_ADJUST_CFA_OFFSET 4
+        pushl %eax
+        CFI_ADJUST_CFA_OFFSET 4
+        lss (%esp), %esp
+        CFI_ADJUST_CFA_OFFSET -8
+.endm
+.macro UNWIND_ESPFIX_STACK
+        movl %ss, %eax
+        /* see if on espfix stack */
+        cmpw $__ESPFIX_SS, %ax
+        jne 27f
+        movl $__KERNEL_DS, %eax
+        movl %eax, %ds
+        movl %eax, %es
+        /* switch to normal stack */
+        FIXUP_ESPFIX_STACK
+27:
+.endm
 
 /*
  * Build the entry stubs and pointer table with some assembler magic.
@@ -672,7 +796,7 @@ common_interrupt:
 ENDPROC(common_interrupt)
         CFI_ENDPROC
 
-#define BUILD_INTERRUPT(name, nr)       \
+#define BUILD_INTERRUPT3(name, nr, fn)  \
 ENTRY(name)                             \
         RING0_INT_FRAME;                \
         pushl $~(nr);                   \
@@ -680,13 +804,15 @@ ENTRY(name)				\
         SAVE_ALL;                       \
         TRACE_IRQS_OFF                  \
         movl %esp,%eax;                 \
-        call smp_##name;                \
+        call fn;                        \
         jmp ret_from_intr;              \
         CFI_ENDPROC;                    \
 ENDPROC(name)
 
+#define BUILD_INTERRUPT(name, nr)       BUILD_INTERRUPT3(name, nr, smp_##name)
+
 /* The include is where all of the SMP etc. interrupts come from */
-#include "entry_arch.h"
+#include <asm/entry_arch.h>
 
 ENTRY(coprocessor_error)
         RING0_INT_FRAME
@@ -1068,7 +1194,10 @@ ENTRY(page_fault)
         CFI_ADJUST_CFA_OFFSET 4
         ALIGN
 error_code:
-        /* the function address is in %fs's slot on the stack */
+        /* the function address is in %gs's slot on the stack */
+        pushl %fs
+        CFI_ADJUST_CFA_OFFSET 4
+        /*CFI_REL_OFFSET fs, 0*/
         pushl %es
         CFI_ADJUST_CFA_OFFSET 4
         /*CFI_REL_OFFSET es, 0*/
@@ -1097,20 +1226,15 @@ error_code:
         CFI_ADJUST_CFA_OFFSET 4
         CFI_REL_OFFSET ebx, 0
         cld
-        pushl %fs
-        CFI_ADJUST_CFA_OFFSET 4
-        /*CFI_REL_OFFSET fs, 0*/
         movl $(__KERNEL_PERCPU), %ecx
         movl %ecx, %fs
         UNWIND_ESPFIX_STACK
-        popl %ecx
-        CFI_ADJUST_CFA_OFFSET -4
-        /*CFI_REGISTER es, ecx*/
-        movl PT_FS(%esp), %edi          # get the function address
+        GS_TO_REG %ecx
+        movl PT_GS(%esp), %edi          # get the function address
         movl PT_ORIG_EAX(%esp), %edx    # get the error code
         movl $-1, PT_ORIG_EAX(%esp)     # no syscall to restart
-        mov  %ecx, PT_FS(%esp)
-        /*CFI_REL_OFFSET fs, ES*/
+        REG_TO_PTGS %ecx
+        SET_KERNEL_GS %ecx
         movl $(__USER_DS), %ecx
         movl %ecx, %ds
         movl %ecx, %es
@@ -1134,26 +1258,27 @@ END(page_fault)
  * by hand onto the new stack - while updating the return eip past
  * the instruction that would have done it for sysenter.
  */
-#define FIX_STACK(offset, ok, label)            \
-        cmpw $__KERNEL_CS,4(%esp);              \
-        jne ok;                                 \
-label:                                          \
-        movl TSS_sysenter_sp0+offset(%esp),%esp;        \
-        CFI_DEF_CFA esp, 0;                     \
-        CFI_UNDEFINED eip;                      \
-        pushfl;                                 \
-        CFI_ADJUST_CFA_OFFSET 4;                \
-        pushl $__KERNEL_CS;                     \
-        CFI_ADJUST_CFA_OFFSET 4;                \
-        pushl $sysenter_past_esp;               \
-        CFI_ADJUST_CFA_OFFSET 4;                \
+.macro FIX_STACK offset ok label
+        cmpw $__KERNEL_CS, 4(%esp)
+        jne \ok
+\label:
+        movl TSS_sysenter_sp0 + \offset(%esp), %esp
+        CFI_DEF_CFA esp, 0
+        CFI_UNDEFINED eip
+        pushfl
+        CFI_ADJUST_CFA_OFFSET 4
+        pushl $__KERNEL_CS
+        CFI_ADJUST_CFA_OFFSET 4
+        pushl $sysenter_past_esp
+        CFI_ADJUST_CFA_OFFSET 4
         CFI_REL_OFFSET eip, 0
+.endm
 
 ENTRY(debug)
         RING0_INT_FRAME
         cmpl $ia32_sysenter_target,(%esp)
         jne debug_stack_correct
-        FIX_STACK(12, debug_stack_correct, debug_esp_fix_insn)
+        FIX_STACK 12, debug_stack_correct, debug_esp_fix_insn
 debug_stack_correct:
         pushl $-1                       # mark this as an int
         CFI_ADJUST_CFA_OFFSET 4
@@ -1211,7 +1336,7 @@ nmi_stack_correct:
 
 nmi_stack_fixup:
         RING0_INT_FRAME
-        FIX_STACK(12,nmi_stack_correct, 1)
+        FIX_STACK 12, nmi_stack_correct, 1
         jmp nmi_stack_correct
 
 nmi_debug_stack_check:
@@ -1222,7 +1347,7 @@ nmi_debug_stack_check:
         jb nmi_stack_correct
         cmpl $debug_esp_fix_insn,(%esp)
         ja nmi_stack_correct
-        FIX_STACK(24,nmi_stack_correct, 1)
+        FIX_STACK 24, nmi_stack_correct, 1
         jmp nmi_stack_correct
 
 nmi_espfix_stack:
diff --git a/arch/x86/kernel/entry_64.S b/arch/x86/kernel/entry_64.S
index e28c7a98779..fbcf96b295f 100644
--- a/arch/x86/kernel/entry_64.S
+++ b/arch/x86/kernel/entry_64.S
@@ -52,6 +52,7 @@
 #include <asm/irqflags.h>
 #include <asm/paravirt.h>
 #include <asm/ftrace.h>
+#include <asm/percpu.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -209,7 +210,7 @@ ENTRY(native_usergs_sysret64)
 
         /* %rsp:at FRAMEEND */
         .macro FIXUP_TOP_OF_STACK tmp offset=0
-        movq %gs:pda_oldrsp,\tmp
+        movq PER_CPU_VAR(old_rsp),\tmp
         movq \tmp,RSP+\offset(%rsp)
         movq $__USER_DS,SS+\offset(%rsp)
         movq $__USER_CS,CS+\offset(%rsp)
@@ -220,7 +221,7 @@ ENTRY(native_usergs_sysret64)
 
         .macro RESTORE_TOP_OF_STACK tmp offset=0
         movq RSP+\offset(%rsp),\tmp
-        movq \tmp,%gs:pda_oldrsp
+        movq \tmp,PER_CPU_VAR(old_rsp)
         movq EFLAGS+\offset(%rsp),\tmp
         movq \tmp,R11+\offset(%rsp)
         .endm
@@ -336,16 +337,17 @@ ENTRY(save_args)
         je 1f
         SWAPGS
         /*
-         * irqcount is used to check if a CPU is already on an interrupt stack
+         * irq_count is used to check if a CPU is already on an interrupt stack
          * or not. While this is essentially redundant with preempt_count it is
          * a little cheaper to use a separate counter in the PDA (short of
          * moving irq_enter into assembly, which would be too much work)
          */
-1:      incl %gs:pda_irqcount
+1:      incl PER_CPU_VAR(irq_count)
         jne 2f
         popq_cfi %rax                   /* move return address... */
-        mov %gs:pda_irqstackptr,%rsp
+        mov PER_CPU_VAR(irq_stack_ptr),%rsp
         EMPTY_FRAME 0
+        pushq_cfi %rbp                  /* backlink for unwinder */
         pushq_cfi %rax                  /* ... to the new stack */
         /*
          * We entered an interrupt context - irqs are off:
@@ -408,6 +410,8 @@ END(save_paranoid)
 ENTRY(ret_from_fork)
         DEFAULT_FRAME
 
+        LOCK ; btr $TIF_FORK,TI_flags(%r8)
+
         push kernel_eflags(%rip)
         CFI_ADJUST_CFA_OFFSET 8
         popf                                    # reset kernel eflags
@@ -467,7 +471,7 @@ END(ret_from_fork)
 ENTRY(system_call)
         CFI_STARTPROC   simple
         CFI_SIGNAL_FRAME
-        CFI_DEF_CFA     rsp,PDA_STACKOFFSET
+        CFI_DEF_CFA     rsp,KERNEL_STACK_OFFSET
         CFI_REGISTER    rip,rcx
         /*CFI_REGISTER  rflags,r11*/
         SWAPGS_UNSAFE_STACK
@@ -478,8 +482,8 @@ ENTRY(system_call)
          */
 ENTRY(system_call_after_swapgs)
 
-        movq    %rsp,%gs:pda_oldrsp
-        movq    %gs:pda_kernelstack,%rsp
+        movq    %rsp,PER_CPU_VAR(old_rsp)
+        movq    PER_CPU_VAR(kernel_stack),%rsp
         /*
          * No need to follow this irqs off/on section - it's straight
          * and short:
@@ -522,7 +526,7 @@ sysret_check:
         CFI_REGISTER    rip,rcx
         RESTORE_ARGS 0,-ARG_SKIP,1
         /*CFI_REGISTER  rflags,r11*/
-        movq    %gs:pda_oldrsp, %rsp
+        movq    PER_CPU_VAR(old_rsp), %rsp
         USERGS_SYSRET64
 
         CFI_RESTORE_STATE
@@ -832,11 +836,11 @@ common_interrupt:
         XCPT_FRAME
         addq $-0x80,(%rsp)              /* Adjust vector to [-256,-1] range */
         interrupt do_IRQ
-        /* 0(%rsp): oldrsp-ARGOFFSET */
+        /* 0(%rsp): old_rsp-ARGOFFSET */
 ret_from_intr:
         DISABLE_INTERRUPTS(CLBR_NONE)
         TRACE_IRQS_OFF
-        decl %gs:pda_irqcount
+        decl PER_CPU_VAR(irq_count)
         leaveq
         CFI_DEF_CFA_REGISTER    rsp
         CFI_ADJUST_CFA_OFFSET   -8
@@ -981,8 +985,10 @@ apicinterrupt IRQ_MOVE_CLEANUP_VECTOR \
         irq_move_cleanup_interrupt smp_irq_move_cleanup_interrupt
 #endif
 
+#ifdef CONFIG_X86_UV
 apicinterrupt UV_BAU_MESSAGE \
         uv_bau_message_intr1 uv_bau_message_interrupt
+#endif
 apicinterrupt LOCAL_TIMER_VECTOR \
         apic_timer_interrupt smp_apic_timer_interrupt
 
@@ -1072,10 +1078,10 @@ ENTRY(\sym)
         TRACE_IRQS_OFF
         movq %rsp,%rdi          /* pt_regs pointer */
         xorl %esi,%esi          /* no error code */
-        movq %gs:pda_data_offset, %rbp
-        subq $EXCEPTION_STKSZ, per_cpu__init_tss + TSS_ist + (\ist - 1) * 8(%rbp)
+        PER_CPU(init_tss, %rbp)
+        subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
         call \do_sym
-        addq $EXCEPTION_STKSZ, per_cpu__init_tss + TSS_ist + (\ist - 1) * 8(%rbp)
+        addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
         jmp paranoid_exit       /* %ebx: no swapgs flag */
         CFI_ENDPROC
 END(\sym)
@@ -1137,7 +1143,7 @@ ENTRY(native_load_gs_index)
         CFI_STARTPROC
         pushf
         CFI_ADJUST_CFA_OFFSET 8
-        DISABLE_INTERRUPTS(CLBR_ANY | ~(CLBR_RDI))
+        DISABLE_INTERRUPTS(CLBR_ANY & ~CLBR_RDI)
         SWAPGS
 gs_change:
         movl %edi,%gs
@@ -1259,14 +1265,14 @@ ENTRY(call_softirq)
         CFI_REL_OFFSET rbp,0
         mov  %rsp,%rbp
         CFI_DEF_CFA_REGISTER rbp
-        incl %gs:pda_irqcount
-        cmove %gs:pda_irqstackptr,%rsp
+        incl PER_CPU_VAR(irq_count)
+        cmove PER_CPU_VAR(irq_stack_ptr),%rsp
         push  %rbp                      # backlink for old unwinder
         call __do_softirq
         leaveq
         CFI_DEF_CFA_REGISTER    rsp
         CFI_ADJUST_CFA_OFFSET   -8
-        decl %gs:pda_irqcount
+        decl PER_CPU_VAR(irq_count)
         ret
         CFI_ENDPROC
 END(call_softirq)
@@ -1296,15 +1302,15 @@ ENTRY(xen_do_hypervisor_callback)   # do_hypervisor_callback(struct *pt_regs)
         movq %rdi, %rsp            # we don't return, adjust the stack frame
         CFI_ENDPROC
         DEFAULT_FRAME
-11:     incl %gs:pda_irqcount
+11:     incl PER_CPU_VAR(irq_count)
         movq %rsp,%rbp
         CFI_DEF_CFA_REGISTER rbp
-        cmovzq %gs:pda_irqstackptr,%rsp
+        cmovzq PER_CPU_VAR(irq_stack_ptr),%rsp
         pushq %rbp                      # backlink for old unwinder
         call xen_evtchn_do_upcall
         popq %rsp
         CFI_DEF_CFA_REGISTER rsp
-        decl %gs:pda_irqcount
+        decl PER_CPU_VAR(irq_count)
         jmp  error_exit
         CFI_ENDPROC
 END(do_hypervisor_callback)
diff --git a/arch/x86/kernel/es7000_32.c b/arch/x86/kernel/es7000_32.c
index 53699c931ad..55515d73d9c 100644
--- a/arch/x86/kernel/es7000_32.c
+++ b/arch/x86/kernel/es7000_32.c
@@ -40,7 +40,6 @@
 #include <asm/smp.h>
 #include <asm/atomic.h>
 #include <asm/apicdef.h>
-#include <mach_mpparse.h>
 #include <asm/genapic.h>
 #include <asm/setup.h>
 
@@ -182,20 +181,16 @@ static int wakeup_secondary_cpu_via_mip(int cpu, unsigned long eip)
         return 0;
 }
 
-static void noop_wait_for_deassert(atomic_t *deassert_not_used)
-{
-}
-
 static int __init es7000_update_genapic(void)
 {
-        genapic->wakeup_cpu = wakeup_secondary_cpu_via_mip;
+        apic->wakeup_cpu = wakeup_secondary_cpu_via_mip;
 
         /* MPENTIUMIII */
         if (boot_cpu_data.x86 == 6 &&
             (boot_cpu_data.x86_model >= 7 || boot_cpu_data.x86_model <= 11)) {
                 es7000_update_genapic_to_cluster();
-                genapic->wait_for_init_deassert = noop_wait_for_deassert;
-                genapic->wakeup_cpu = wakeup_secondary_cpu_via_mip;
+                apic->wait_for_init_deassert = NULL;
+                apic->wakeup_cpu = wakeup_secondary_cpu_via_mip;
         }
 
         return 0;
@@ -292,24 +287,31 @@ int __init find_unisys_acpi_oem_table(unsigned long *oem_addr)
 {
         struct acpi_table_header *header = NULL;
         int i = 0;
+        acpi_size tbl_size;
 
-        while (ACPI_SUCCESS(acpi_get_table("OEM1", i++, &header))) {
+        while (ACPI_SUCCESS(acpi_get_table_with_size("OEM1", i++, &header, &tbl_size))) {
                 if (!memcmp((char *) &header->oem_id, "UNISYS", 6)) {
                         struct oem_table *t = (struct oem_table *)header;
 
                         oem_addrX = t->OEMTableAddr;
                         oem_size = t->OEMTableSize;
+                        early_acpi_os_unmap_memory(header, tbl_size);
 
                         *oem_addr = (unsigned long)__acpi_map_table(oem_addrX,
                                                                     oem_size);
                         return 0;
                 }
+                early_acpi_os_unmap_memory(header, tbl_size);
         }
         return -1;
 }
 
 void __init unmap_unisys_acpi_oem_table(unsigned long oem_addr)
 {
+        if (!oem_addr)
+                return;
+
+        __acpi_unmap_table((char *)oem_addr, oem_size);
 }
 #endif
 
@@ -359,20 +361,449 @@ es7000_mip_write(struct mip_reg *mip_reg)
         return status;
 }
 
-void __init
-es7000_sw_apic(void)
-{
-        if (es7000_plat) {
-                int mip_status;
-                struct mip_reg es7000_mip_reg;
-
-                printk("ES7000: Enabling APIC mode.\n");
-                memset(&es7000_mip_reg, 0, sizeof(struct mip_reg));
-                es7000_mip_reg.off_0 = MIP_SW_APIC;
-                es7000_mip_reg.off_38 = (MIP_VALID);
-                while ((mip_status = es7000_mip_write(&es7000_mip_reg)) != 0)
-                        printk("es7000_sw_apic: command failed, status = %x\n",
-                                mip_status);
+void __init es7000_enable_apic_mode(void)
+{
+        struct mip_reg es7000_mip_reg;
+        int mip_status;
+
+        if (!es7000_plat)
                 return;
+
+        printk("ES7000: Enabling APIC mode.\n");
+        memset(&es7000_mip_reg, 0, sizeof(struct mip_reg));
+        es7000_mip_reg.off_0 = MIP_SW_APIC;
+        es7000_mip_reg.off_38 = MIP_VALID;
+
+        while ((mip_status = es7000_mip_write(&es7000_mip_reg)) != 0) {
+                printk("es7000_enable_apic_mode: command failed, status = %x\n",
+                        mip_status);
+        }
+}
+
+/*
+ * APIC driver for the Unisys ES7000 chipset.
+ */
+#define APIC_DEFINITION 1
+#include <linux/threads.h>
+#include <linux/cpumask.h>
+#include <asm/mpspec.h>
+#include <asm/genapic.h>
+#include <asm/fixmap.h>
+#include <asm/apicdef.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/init.h>
+#include <linux/acpi.h>
+#include <linux/smp.h>
+#include <asm/ipi.h>
+
+#define APIC_DFR_VALUE_CLUSTER          (APIC_DFR_CLUSTER)
+#define INT_DELIVERY_MODE_CLUSTER       (dest_LowestPrio)
+#define INT_DEST_MODE_CLUSTER           (1) /* logical delivery broadcast to all procs */
+
+#define APIC_DFR_VALUE                  (APIC_DFR_FLAT)
+
+extern void es7000_enable_apic_mode(void);
+extern int apic_version [MAX_APICS];
+extern u8 cpu_2_logical_apicid[];
+extern unsigned int boot_cpu_physical_apicid;
+
+extern int parse_unisys_oem (char *oemptr);
+extern int find_unisys_acpi_oem_table(unsigned long *oem_addr);
+extern void unmap_unisys_acpi_oem_table(unsigned long oem_addr);
+extern void setup_unisys(void);
+
+#define apicid_cluster(apicid)          (apicid & 0xF0)
+#define xapic_phys_to_log_apicid(cpu)   per_cpu(x86_bios_cpu_apicid, cpu)
+
+static void es7000_vector_allocation_domain(int cpu, cpumask_t *retmask)
+{
+        /* Careful. Some cpus do not strictly honor the set of cpus
+         * specified in the interrupt destination when using lowest
+         * priority interrupt delivery mode.
+         *
+         * In particular there was a hyperthreading cpu observed to
+         * deliver interrupts to the wrong hyperthread when only one
+         * hyperthread was specified in the interrupt desitination.
+         */
+        *retmask = (cpumask_t){ { [0] = APIC_ALL_CPUS, } };
+}
+
+
+static void es7000_wait_for_init_deassert(atomic_t *deassert)
+{
+#ifndef CONFIG_ES7000_CLUSTERED_APIC
+        while (!atomic_read(deassert))
+                cpu_relax();
+#endif
+        return;
+}
+
+static unsigned int es7000_get_apic_id(unsigned long x)
+{
+        return (x >> 24) & 0xFF;
+}
+
+#ifdef CONFIG_ACPI
+static int es7000_check_dsdt(void)
+{
+        struct acpi_table_header header;
+
+        if (ACPI_SUCCESS(acpi_get_table_header(ACPI_SIG_DSDT, 0, &header)) &&
+            !strncmp(header.oem_id, "UNISYS", 6))
+                return 1;
+        return 0;
+}
+#endif
+
+static void es7000_send_IPI_mask(const struct cpumask *mask, int vector)
+{
+        default_send_IPI_mask_sequence_phys(mask, vector);
+}
+
+static void es7000_send_IPI_allbutself(int vector)
+{
+        default_send_IPI_mask_allbutself_phys(cpu_online_mask, vector);
+}
+
+static void es7000_send_IPI_all(int vector)
+{
+        es7000_send_IPI_mask(cpu_online_mask, vector);
+}
+
+static int es7000_apic_id_registered(void)
+{
+                return 1;
+}
+
+static const cpumask_t *target_cpus_cluster(void)
+{
+        return &CPU_MASK_ALL;
+}
+
+static const cpumask_t *es7000_target_cpus(void)
+{
+        return &cpumask_of_cpu(smp_processor_id());
+}
+
+static unsigned long
+es7000_check_apicid_used(physid_mask_t bitmap, int apicid)
+{
+        return 0;
+}
+static unsigned long es7000_check_apicid_present(int bit)
+{
+        return physid_isset(bit, phys_cpu_present_map);
+}
+
+static unsigned long calculate_ldr(int cpu)
+{
+        unsigned long id = xapic_phys_to_log_apicid(cpu);
+
+        return (SET_APIC_LOGICAL_ID(id));
+}
+
+/*
+ * Set up the logical destination ID.
+ *
+ * Intel recommends to set DFR, LdR and TPR before enabling
+ * an APIC.  See e.g. "AP-388 82489DX User's Manual" (Intel
+ * document number 292116).  So here it goes...
+ */
+static void es7000_init_apic_ldr_cluster(void)
+{
+        unsigned long val;
+        int cpu = smp_processor_id();
+
+        apic_write(APIC_DFR, APIC_DFR_VALUE_CLUSTER);
+        val = calculate_ldr(cpu);
+        apic_write(APIC_LDR, val);
+}
+
+static void es7000_init_apic_ldr(void)
+{
+        unsigned long val;
+        int cpu = smp_processor_id();
+
+        apic_write(APIC_DFR, APIC_DFR_VALUE);
+        val = calculate_ldr(cpu);
+        apic_write(APIC_LDR, val);
+}
+
+static void es7000_setup_apic_routing(void)
+{
+        int apic = per_cpu(x86_bios_cpu_apicid, smp_processor_id());
+        printk("Enabling APIC mode:  %s. Using %d I/O APICs, target cpus %lx\n",
+                (apic_version[apic] == 0x14) ?
+                        "Physical Cluster" : "Logical Cluster",
+                        nr_ioapics, cpus_addr(*es7000_target_cpus())[0]);
+}
+
+static int es7000_apicid_to_node(int logical_apicid)
+{
+        return 0;
+}
+
+
+static int es7000_cpu_present_to_apicid(int mps_cpu)
+{
+        if (!mps_cpu)
+                return boot_cpu_physical_apicid;
+        else if (mps_cpu < nr_cpu_ids)
+                return (int) per_cpu(x86_bios_cpu_apicid, mps_cpu);
+        else
+                return BAD_APICID;
+}
+
+static physid_mask_t es7000_apicid_to_cpu_present(int phys_apicid)
+{
+        static int id = 0;
+        physid_mask_t mask;
+
+        mask = physid_mask_of_physid(id);
+        ++id;
+
+        return mask;
+}
+
+/* Mapping from cpu number to logical apicid */
+static int es7000_cpu_to_logical_apicid(int cpu)
+{
+#ifdef CONFIG_SMP
+        if (cpu >= nr_cpu_ids)
+                return BAD_APICID;
+        return (int)cpu_2_logical_apicid[cpu];
+#else
+        return logical_smp_processor_id();
+#endif
+}
+
+static physid_mask_t es7000_ioapic_phys_id_map(physid_mask_t phys_map)
+{
+        /* For clustered we don't have a good way to do this yet - hack */
+        return physids_promote(0xff);
+}
+
+static int es7000_check_phys_apicid_present(int cpu_physical_apicid)
+{
+        boot_cpu_physical_apicid = read_apic_id();
+        return (1);
+}
+
+static unsigned int
+es7000_cpu_mask_to_apicid_cluster(const struct cpumask *cpumask)
+{
+        int cpus_found = 0;
+        int num_bits_set;
+        int apicid;
+        int cpu;
+
+        num_bits_set = cpumask_weight(cpumask);
+        /* Return id to all */
+        if (num_bits_set == nr_cpu_ids)
+                return 0xFF;
+        /*
+         * The cpus in the mask must all be on the apic cluster.  If are not
+         * on the same apicid cluster return default value of target_cpus():
+         */
+        cpu = cpumask_first(cpumask);
+        apicid = es7000_cpu_to_logical_apicid(cpu);
+
+        while (cpus_found < num_bits_set) {
+                if (cpumask_test_cpu(cpu, cpumask)) {
+                        int new_apicid = es7000_cpu_to_logical_apicid(cpu);
+
+                        if (apicid_cluster(apicid) !=
+                                        apicid_cluster(new_apicid)) {
+                                printk ("%s: Not a valid mask!\n", __func__);
+
+                                return 0xFF;
+                        }
+                        apicid = new_apicid;
+                        cpus_found++;
+                }
+                cpu++;
+        }
+        return apicid;
+}
+
+static unsigned int es7000_cpu_mask_to_apicid(const cpumask_t *cpumask)
+{
+        int cpus_found = 0;
+        int num_bits_set;
+        int apicid;
+        int cpu;
+
+        num_bits_set = cpus_weight(*cpumask);
+        /* Return id to all */
+        if (num_bits_set == nr_cpu_ids)
+                return es7000_cpu_to_logical_apicid(0);
+        /*
+         * The cpus in the mask must all be on the apic cluster.  If are not
+         * on the same apicid cluster return default value of target_cpus():
+         */
+        cpu = first_cpu(*cpumask);
+        apicid = es7000_cpu_to_logical_apicid(cpu);
+        while (cpus_found < num_bits_set) {
+                if (cpu_isset(cpu, *cpumask)) {
+                        int new_apicid = es7000_cpu_to_logical_apicid(cpu);
+
+                        if (apicid_cluster(apicid) !=
+                                        apicid_cluster(new_apicid)) {
+                                printk ("%s: Not a valid mask!\n", __func__);
+
+                                return es7000_cpu_to_logical_apicid(0);
+                        }
+                        apicid = new_apicid;
+                        cpus_found++;
+                }
+                cpu++;
+        }
+        return apicid;
+}
+
+static unsigned int
+es7000_cpu_mask_to_apicid_and(const struct cpumask *inmask,
+                              const struct cpumask *andmask)
+{
+        int apicid = es7000_cpu_to_logical_apicid(0);
+        cpumask_var_t cpumask;
+
+        if (!alloc_cpumask_var(&cpumask, GFP_ATOMIC))
+                return apicid;
+
+        cpumask_and(cpumask, inmask, andmask);
+        cpumask_and(cpumask, cpumask, cpu_online_mask);
+        apicid = es7000_cpu_mask_to_apicid(cpumask);
+
+        free_cpumask_var(cpumask);
+
+        return apicid;
+}
+
+static int es7000_phys_pkg_id(int cpuid_apic, int index_msb)
+{
+        return cpuid_apic >> index_msb;
+}
+
+void __init es7000_update_genapic_to_cluster(void)
+{
+        apic->target_cpus = target_cpus_cluster;
+        apic->irq_delivery_mode = INT_DELIVERY_MODE_CLUSTER;
+        apic->irq_dest_mode = INT_DEST_MODE_CLUSTER;
+
+        apic->init_apic_ldr = es7000_init_apic_ldr_cluster;
+
+        apic->cpu_mask_to_apicid = es7000_cpu_mask_to_apicid_cluster;
+}
+
+static int probe_es7000(void)
+{
+        /* probed later in mptable/ACPI hooks */
+        return 0;
+}
+
+static __init int
+es7000_mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
+{
+        if (mpc->oemptr) {
+                struct mpc_oemtable *oem_table =
+                        (struct mpc_oemtable *)mpc->oemptr;
+
+                if (!strncmp(oem, "UNISYS", 6))
+                        return parse_unisys_oem((char *)oem_table);
+        }
+        return 0;
+}
+
+#ifdef CONFIG_ACPI
+/* Hook from generic ACPI tables.c */
+static int __init es7000_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+{
+        unsigned long oem_addr = 0;
+        int check_dsdt;
+        int ret = 0;
+
+        /* check dsdt at first to avoid clear fix_map for oem_addr */
+        check_dsdt = es7000_check_dsdt();
+
+        if (!find_unisys_acpi_oem_table(&oem_addr)) {
+                if (check_dsdt)
+                        ret = parse_unisys_oem((char *)oem_addr);
+                else {
+                        setup_unisys();
+                        ret = 1;
+                }
+                /*
+                 * we need to unmap it
+                 */
+                unmap_unisys_acpi_oem_table(oem_addr);
         }
+        return ret;
+}
+#else
+static int __init es7000_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+{
+        return 0;
 }
+#endif
+
+
+struct genapic apic_es7000 = {
+
+        .name                           = "es7000",
+        .probe                          = probe_es7000,
+        .acpi_madt_oem_check            = es7000_acpi_madt_oem_check,
+        .apic_id_registered             = es7000_apic_id_registered,
+
+        .irq_delivery_mode              = dest_Fixed,
+        /* phys delivery to target CPUs: */
+        .irq_dest_mode                  = 0,
+
+        .target_cpus                    = es7000_target_cpus,
+        .disable_esr                    = 1,
+        .dest_logical                   = 0,
+        .check_apicid_used              = es7000_check_apicid_used,
+        .check_apicid_present           = es7000_check_apicid_present,
+
+        .vector_allocation_domain       = es7000_vector_allocation_domain,
+        .init_apic_ldr                  = es7000_init_apic_ldr,
+
+        .ioapic_phys_id_map             = es7000_ioapic_phys_id_map,
+        .setup_apic_routing             = es7000_setup_apic_routing,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = es7000_apicid_to_node,
+        .cpu_to_logical_apicid          = es7000_cpu_to_logical_apicid,
+        .cpu_present_to_apicid          = es7000_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = es7000_apicid_to_cpu_present,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = es7000_check_phys_apicid_present,
+        .enable_apic_mode               = es7000_enable_apic_mode,
+        .phys_pkg_id                    = es7000_phys_pkg_id,
+        .mps_oem_check                  = es7000_mps_oem_check,
+
+        .get_apic_id                    = es7000_get_apic_id,
+        .set_apic_id                    = NULL,
+        .apic_id_mask                   = 0xFF << 24,
+
+        .cpu_mask_to_apicid             = es7000_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = es7000_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = es7000_send_IPI_mask,
+        .send_IPI_mask_allbutself       = NULL,
+        .send_IPI_allbutself            = es7000_send_IPI_allbutself,
+        .send_IPI_all                   = es7000_send_IPI_all,
+        .send_IPI_self                  = default_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+
+        .trampoline_phys_low            = 0x467,
+        .trampoline_phys_high           = 0x469,
+
+        .wait_for_init_deassert         = es7000_wait_for_init_deassert,
+
+        /* Nothing to do for most platforms, since cleared by the INIT cycle: */
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = default_inquire_remote_apic,
+};
diff --git a/arch/x86/kernel/ftrace.c b/arch/x86/kernel/ftrace.c
index 1b43086b097..231bdd3c5b1 100644
--- a/arch/x86/kernel/ftrace.c
+++ b/arch/x86/kernel/ftrace.c
@@ -488,20 +488,21 @@ void prepare_ftrace_return(unsigned long *parent, unsigned long self_addr)
          * ignore such a protection.
          */
         asm volatile(
-                "1: " _ASM_MOV " (%[parent_old]), %[old]\n"
-                "2: " _ASM_MOV " %[return_hooker], (%[parent_replaced])\n"
+                "1: " _ASM_MOV " (%[parent]), %[old]\n"
+                "2: " _ASM_MOV " %[return_hooker], (%[parent])\n"
                 "   movl $0, %[faulted]\n"
+                "3:\n"
 
                 ".section .fixup, \"ax\"\n"
-                "3: movl $1, %[faulted]\n"
+                "4: movl $1, %[faulted]\n"
+                "   jmp 3b\n"
                 ".previous\n"
 
-                _ASM_EXTABLE(1b, 3b)
-                _ASM_EXTABLE(2b, 3b)
+                _ASM_EXTABLE(1b, 4b)
+                _ASM_EXTABLE(2b, 4b)
 
-                : [parent_replaced] "=r" (parent), [old] "=r" (old),
-                  [faulted] "=r" (faulted)
-                : [parent_old] "0" (parent), [return_hooker] "r" (return_hooker)
+                : [old] "=r" (old), [faulted] "=r" (faulted)
+                : [parent] "r" (parent), [return_hooker] "r" (return_hooker)
                 : "memory"
         );
 
diff --git a/arch/x86/kernel/genapic_64.c b/arch/x86/kernel/genapic_64.c
index 2bced78b0b8..820dea5d0eb 100644
--- a/arch/x86/kernel/genapic_64.c
+++ b/arch/x86/kernel/genapic_64.c
@@ -29,10 +29,12 @@ extern struct genapic apic_x2xpic_uv_x;
 extern struct genapic apic_x2apic_phys;
 extern struct genapic apic_x2apic_cluster;
 
-struct genapic __read_mostly *genapic = &apic_flat;
+struct genapic __read_mostly *apic = &apic_flat;
 
 static struct genapic *apic_probe[] __initdata = {
+#ifdef CONFIG_X86_UV
         &apic_x2apic_uv_x,
+#endif
         &apic_x2apic_phys,
         &apic_x2apic_cluster,
         &apic_physflat,
@@ -42,17 +44,17 @@ static struct genapic *apic_probe[] __initdata = {
 /*
  * Check the APIC IDs in bios_cpu_apicid and choose the APIC mode.
  */
-void __init setup_apic_routing(void)
+void __init default_setup_apic_routing(void)
 {
-        if (genapic == &apic_x2apic_phys || genapic == &apic_x2apic_cluster) {
+        if (apic == &apic_x2apic_phys || apic == &apic_x2apic_cluster) {
                 if (!intr_remapping_enabled)
-                        genapic = &apic_flat;
+                        apic = &apic_flat;
         }
 
-        if (genapic == &apic_flat) {
+        if (apic == &apic_flat) {
                 if (max_physical_apicid >= 8)
-                        genapic = &apic_physflat;
-                printk(KERN_INFO "Setting APIC routing to %s\n", genapic->name);
+                        apic = &apic_physflat;
+                printk(KERN_INFO "Setting APIC routing to %s\n", apic->name);
         }
 
         if (x86_quirks->update_genapic)
@@ -63,18 +65,18 @@ void __init setup_apic_routing(void)
 
 void apic_send_IPI_self(int vector)
 {
-        __send_IPI_shortcut(APIC_DEST_SELF, vector, APIC_DEST_PHYSICAL);
+        __default_send_IPI_shortcut(APIC_DEST_SELF, vector, APIC_DEST_PHYSICAL);
 }
 
-int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+int __init default_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
 {
         int i;
 
         for (i = 0; apic_probe[i]; ++i) {
                 if (apic_probe[i]->acpi_madt_oem_check(oem_id, oem_table_id)) {
-                        genapic = apic_probe[i];
+                        apic = apic_probe[i];
                         printk(KERN_INFO "Setting APIC routing to %s.\n",
-                                genapic->name);
+                                apic->name);
                         return 1;
                 }
         }
diff --git a/arch/x86/kernel/genapic_flat_64.c b/arch/x86/kernel/genapic_flat_64.c
index 34185488e4f..249d2d3c034 100644
--- a/arch/x86/kernel/genapic_flat_64.c
+++ b/arch/x86/kernel/genapic_flat_64.c
@@ -19,7 +19,6 @@
 #include <asm/smp.h>
 #include <asm/ipi.h>
 #include <asm/genapic.h>
-#include <mach_apicdef.h>
 
 #ifdef CONFIG_ACPI
 #include <acpi/acpi_bus.h>
@@ -74,7 +73,7 @@ static inline void _flat_send_IPI_mask(unsigned long mask, int vector)
         unsigned long flags;
 
         local_irq_save(flags);
-        __send_IPI_dest_field(mask, vector, APIC_DEST_LOGICAL);
+        __default_send_IPI_dest_field(mask, vector, apic->dest_logical);
         local_irq_restore(flags);
 }
 
@@ -85,14 +84,15 @@ static void flat_send_IPI_mask(const struct cpumask *cpumask, int vector)
         _flat_send_IPI_mask(mask, vector);
 }
 
-static void flat_send_IPI_mask_allbutself(const struct cpumask *cpumask,
-                                          int vector)
+static void
+ flat_send_IPI_mask_allbutself(const struct cpumask *cpumask, int vector)
 {
         unsigned long mask = cpumask_bits(cpumask)[0];
         int cpu = smp_processor_id();
 
         if (cpu < BITS_PER_LONG)
                 clear_bit(cpu, &mask);
+
         _flat_send_IPI_mask(mask, vector);
 }
 
@@ -114,23 +114,27 @@ static void flat_send_IPI_allbutself(int vector)
                         _flat_send_IPI_mask(mask, vector);
                 }
         } else if (num_online_cpus() > 1) {
-                __send_IPI_shortcut(APIC_DEST_ALLBUT, vector,APIC_DEST_LOGICAL);
+                __default_send_IPI_shortcut(APIC_DEST_ALLBUT,
+                                            vector, apic->dest_logical);
         }
 }
 
 static void flat_send_IPI_all(int vector)
 {
-        if (vector == NMI_VECTOR)
+        if (vector == NMI_VECTOR) {
                 flat_send_IPI_mask(cpu_online_mask, vector);
-        else
-                __send_IPI_shortcut(APIC_DEST_ALLINC, vector, APIC_DEST_LOGICAL);
+        } else {
+                __default_send_IPI_shortcut(APIC_DEST_ALLINC,
+                                            vector, apic->dest_logical);
+        }
 }
 
-static unsigned int get_apic_id(unsigned long x)
+static unsigned int flat_get_apic_id(unsigned long x)
 {
         unsigned int id;
 
         id = (((x)>>24) & 0xFFu);
+
         return id;
 }
 
@@ -146,7 +150,7 @@ static unsigned int read_xapic_id(void)
 {
         unsigned int id;
 
-        id = get_apic_id(apic_read(APIC_ID));
+        id = flat_get_apic_id(apic_read(APIC_ID));
         return id;
 }
 
@@ -169,31 +173,62 @@ static unsigned int flat_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
         return mask1 & mask2;
 }
 
-static unsigned int phys_pkg_id(int index_msb)
+static int flat_phys_pkg_id(int initial_apic_id, int index_msb)
 {
         return hard_smp_processor_id() >> index_msb;
 }
 
 struct genapic apic_flat =  {
-        .name = "flat",
-        .acpi_madt_oem_check = flat_acpi_madt_oem_check,
-        .int_delivery_mode = dest_LowestPrio,
-        .int_dest_mode = (APIC_DEST_LOGICAL != 0),
-        .target_cpus = flat_target_cpus,
-        .vector_allocation_domain = flat_vector_allocation_domain,
-        .apic_id_registered = flat_apic_id_registered,
-        .init_apic_ldr = flat_init_apic_ldr,
-        .send_IPI_all = flat_send_IPI_all,
-        .send_IPI_allbutself = flat_send_IPI_allbutself,
-        .send_IPI_mask = flat_send_IPI_mask,
-        .send_IPI_mask_allbutself = flat_send_IPI_mask_allbutself,
-        .send_IPI_self = apic_send_IPI_self,
-        .cpu_mask_to_apicid = flat_cpu_mask_to_apicid,
-        .cpu_mask_to_apicid_and = flat_cpu_mask_to_apicid_and,
-        .phys_pkg_id = phys_pkg_id,
-        .get_apic_id = get_apic_id,
-        .set_apic_id = set_apic_id,
-        .apic_id_mask = (0xFFu<<24),
+        .name                           = "flat",
+        .probe                          = NULL,
+        .acpi_madt_oem_check            = flat_acpi_madt_oem_check,
+        .apic_id_registered             = flat_apic_id_registered,
+
+        .irq_delivery_mode              = dest_LowestPrio,
+        .irq_dest_mode                  = 1, /* logical */
+
+        .target_cpus                    = flat_target_cpus,
+        .disable_esr                    = 0,
+        .dest_logical                   = APIC_DEST_LOGICAL,
+        .check_apicid_used              = NULL,
+        .check_apicid_present           = NULL,
+
+        .vector_allocation_domain       = flat_vector_allocation_domain,
+        .init_apic_ldr                  = flat_init_apic_ldr,
+
+        .ioapic_phys_id_map             = NULL,
+        .setup_apic_routing             = NULL,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = NULL,
+        .cpu_to_logical_apicid          = NULL,
+        .cpu_present_to_apicid          = default_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = NULL,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = default_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = flat_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = flat_get_apic_id,
+        .set_apic_id                    = set_apic_id,
+        .apic_id_mask                   = 0xFFu << 24,
+
+        .cpu_mask_to_apicid             = flat_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = flat_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = flat_send_IPI_mask,
+        .send_IPI_mask_allbutself       = flat_send_IPI_mask_allbutself,
+        .send_IPI_allbutself            = flat_send_IPI_allbutself,
+        .send_IPI_all                   = flat_send_IPI_all,
+        .send_IPI_self                  = apic_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+        .wait_for_init_deassert         = NULL,
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = NULL,
 };
 
 /*
@@ -232,18 +267,18 @@ static void physflat_vector_allocation_domain(int cpu, struct cpumask *retmask)
 
 static void physflat_send_IPI_mask(const struct cpumask *cpumask, int vector)
 {
-        send_IPI_mask_sequence(cpumask, vector);
+        default_send_IPI_mask_sequence_phys(cpumask, vector);
 }
 
 static void physflat_send_IPI_mask_allbutself(const struct cpumask *cpumask,
                                               int vector)
 {
-        send_IPI_mask_allbutself(cpumask, vector);
+        default_send_IPI_mask_allbutself_phys(cpumask, vector);
 }
 
 static void physflat_send_IPI_allbutself(int vector)
 {
-        send_IPI_mask_allbutself(cpu_online_mask, vector);
+        default_send_IPI_mask_allbutself_phys(cpu_online_mask, vector);
 }
 
 static void physflat_send_IPI_all(int vector)
@@ -276,32 +311,67 @@ physflat_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
          * We're using fixed IRQ delivery, can only return one phys APIC ID.
          * May as well be the first.
          */
-        for_each_cpu_and(cpu, cpumask, andmask)
+        for_each_cpu_and(cpu, cpumask, andmask) {
                 if (cpumask_test_cpu(cpu, cpu_online_mask))
                         break;
+        }
         if (cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
+
         return BAD_APICID;
 }
 
 struct genapic apic_physflat =  {
-        .name = "physical flat",
-        .acpi_madt_oem_check = physflat_acpi_madt_oem_check,
-        .int_delivery_mode = dest_Fixed,
-        .int_dest_mode = (APIC_DEST_PHYSICAL != 0),
-        .target_cpus = physflat_target_cpus,
-        .vector_allocation_domain = physflat_vector_allocation_domain,
-        .apic_id_registered = flat_apic_id_registered,
-        .init_apic_ldr = flat_init_apic_ldr,/*not needed, but shouldn't hurt*/
-        .send_IPI_all = physflat_send_IPI_all,
-        .send_IPI_allbutself = physflat_send_IPI_allbutself,
-        .send_IPI_mask = physflat_send_IPI_mask,
-        .send_IPI_mask_allbutself = physflat_send_IPI_mask_allbutself,
-        .send_IPI_self = apic_send_IPI_self,
-        .cpu_mask_to_apicid = physflat_cpu_mask_to_apicid,
-        .cpu_mask_to_apicid_and = physflat_cpu_mask_to_apicid_and,
-        .phys_pkg_id = phys_pkg_id,
-        .get_apic_id = get_apic_id,
-        .set_apic_id = set_apic_id,
-        .apic_id_mask = (0xFFu<<24),
+
+        .name                           = "physical flat",
+        .probe                          = NULL,
+        .acpi_madt_oem_check            = physflat_acpi_madt_oem_check,
+        .apic_id_registered             = flat_apic_id_registered,
+
+        .irq_delivery_mode              = dest_Fixed,
+        .irq_dest_mode                  = 0, /* physical */
+
+        .target_cpus                    = physflat_target_cpus,
+        .disable_esr                    = 0,
+        .dest_logical                   = 0,
+        .check_apicid_used              = NULL,
+        .check_apicid_present           = NULL,
+
+        .vector_allocation_domain       = physflat_vector_allocation_domain,
+        /* not needed, but shouldn't hurt: */
+        .init_apic_ldr                  = flat_init_apic_ldr,
+
+        .ioapic_phys_id_map             = NULL,
+        .setup_apic_routing             = NULL,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = NULL,
+        .cpu_to_logical_apicid          = NULL,
+        .cpu_present_to_apicid          = default_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = NULL,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = default_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = flat_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = flat_get_apic_id,
+        .set_apic_id                    = set_apic_id,
+        .apic_id_mask                   = 0xFFu << 24,
+
+        .cpu_mask_to_apicid             = physflat_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = physflat_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = physflat_send_IPI_mask,
+        .send_IPI_mask_allbutself       = physflat_send_IPI_mask_allbutself,
+        .send_IPI_allbutself            = physflat_send_IPI_allbutself,
+        .send_IPI_all                   = physflat_send_IPI_all,
+        .send_IPI_self                  = apic_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+        .wait_for_init_deassert         = NULL,
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = NULL,
 };
diff --git a/arch/x86/kernel/genx2apic_cluster.c b/arch/x86/kernel/genx2apic_cluster.c
index 6ce497cc372..7c87156b641 100644
--- a/arch/x86/kernel/genx2apic_cluster.c
+++ b/arch/x86/kernel/genx2apic_cluster.c
@@ -36,8 +36,8 @@ static void x2apic_vector_allocation_domain(int cpu, struct cpumask *retmask)
         cpumask_set_cpu(cpu, retmask);
 }
 
-static void __x2apic_send_IPI_dest(unsigned int apicid, int vector,
-                                   unsigned int dest)
+static void
+ __x2apic_send_IPI_dest(unsigned int apicid, int vector, unsigned int dest)
 {
         unsigned long cfg;
 
@@ -57,45 +57,50 @@ static void __x2apic_send_IPI_dest(unsigned int apicid, int vector,
  */
 static void x2apic_send_IPI_mask(const struct cpumask *mask, int vector)
 {
-        unsigned long flags;
         unsigned long query_cpu;
+        unsigned long flags;
 
         local_irq_save(flags);
-        for_each_cpu(query_cpu, mask)
+        for_each_cpu(query_cpu, mask) {
                 __x2apic_send_IPI_dest(
                         per_cpu(x86_cpu_to_logical_apicid, query_cpu),
-                        vector, APIC_DEST_LOGICAL);
+                        vector, apic->dest_logical);
+        }
         local_irq_restore(flags);
 }
 
-static void x2apic_send_IPI_mask_allbutself(const struct cpumask *mask,
-                                            int vector)
+static void
+ x2apic_send_IPI_mask_allbutself(const struct cpumask *mask, int vector)
 {
-        unsigned long flags;
-        unsigned long query_cpu;
         unsigned long this_cpu = smp_processor_id();
+        unsigned long query_cpu;
+        unsigned long flags;
 
         local_irq_save(flags);
-        for_each_cpu(query_cpu, mask)
-                if (query_cpu != this_cpu)
-                        __x2apic_send_IPI_dest(
+        for_each_cpu(query_cpu, mask) {
+                if (query_cpu == this_cpu)
+                        continue;
+                __x2apic_send_IPI_dest(
                                 per_cpu(x86_cpu_to_logical_apicid, query_cpu),
-                                vector, APIC_DEST_LOGICAL);
+                                vector, apic->dest_logical);
+        }
         local_irq_restore(flags);
 }
 
 static void x2apic_send_IPI_allbutself(int vector)
 {
-        unsigned long flags;
-        unsigned long query_cpu;
         unsigned long this_cpu = smp_processor_id();
+        unsigned long query_cpu;
+        unsigned long flags;
 
         local_irq_save(flags);
-        for_each_online_cpu(query_cpu)
-                if (query_cpu != this_cpu)
-                        __x2apic_send_IPI_dest(
+        for_each_online_cpu(query_cpu) {
+                if (query_cpu == this_cpu)
+                        continue;
+                __x2apic_send_IPI_dest(
                                 per_cpu(x86_cpu_to_logical_apicid, query_cpu),
-                                vector, APIC_DEST_LOGICAL);
+                                vector, apic->dest_logical);
+        }
         local_irq_restore(flags);
 }
 
@@ -111,21 +116,21 @@ static int x2apic_apic_id_registered(void)
 
 static unsigned int x2apic_cpu_mask_to_apicid(const struct cpumask *cpumask)
 {
-        int cpu;
-
         /*
          * We're using fixed IRQ delivery, can only return one logical APIC ID.
          * May as well be the first.
          */
-        cpu = cpumask_first(cpumask);
+        int cpu = cpumask_first(cpumask);
+
         if ((unsigned)cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_logical_apicid, cpu);
         else
                 return BAD_APICID;
 }
 
-static unsigned int x2apic_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
-                                                  const struct cpumask *andmask)
+static unsigned int
+x2apic_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
+                              const struct cpumask *andmask)
 {
         int cpu;
 
@@ -133,15 +138,18 @@ static unsigned int x2apic_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
          * We're using fixed IRQ delivery, can only return one logical APIC ID.
          * May as well be the first.
          */
-        for_each_cpu_and(cpu, cpumask, andmask)
+        for_each_cpu_and(cpu, cpumask, andmask) {
                 if (cpumask_test_cpu(cpu, cpu_online_mask))
                         break;
+        }
+
         if (cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_logical_apicid, cpu);
+
         return BAD_APICID;
 }
 
-static unsigned int get_apic_id(unsigned long x)
+static unsigned int x2apic_cluster_phys_get_apic_id(unsigned long x)
 {
         unsigned int id;
 
@@ -157,7 +165,7 @@ static unsigned long set_apic_id(unsigned int id)
         return x;
 }
 
-static unsigned int phys_pkg_id(int index_msb)
+static int x2apic_cluster_phys_pkg_id(int initial_apicid, int index_msb)
 {
         return current_cpu_data.initial_apicid >> index_msb;
 }
@@ -172,27 +180,58 @@ static void init_x2apic_ldr(void)
         int cpu = smp_processor_id();
 
         per_cpu(x86_cpu_to_logical_apicid, cpu) = apic_read(APIC_LDR);
-        return;
 }
 
 struct genapic apic_x2apic_cluster = {
-        .name = "cluster x2apic",
-        .acpi_madt_oem_check = x2apic_acpi_madt_oem_check,
-        .int_delivery_mode = dest_LowestPrio,
-        .int_dest_mode = (APIC_DEST_LOGICAL != 0),
-        .target_cpus = x2apic_target_cpus,
-        .vector_allocation_domain = x2apic_vector_allocation_domain,
-        .apic_id_registered = x2apic_apic_id_registered,
-        .init_apic_ldr = init_x2apic_ldr,
-        .send_IPI_all = x2apic_send_IPI_all,
-        .send_IPI_allbutself = x2apic_send_IPI_allbutself,
-        .send_IPI_mask = x2apic_send_IPI_mask,
-        .send_IPI_mask_allbutself = x2apic_send_IPI_mask_allbutself,
-        .send_IPI_self = x2apic_send_IPI_self,
-        .cpu_mask_to_apicid = x2apic_cpu_mask_to_apicid,
-        .cpu_mask_to_apicid_and = x2apic_cpu_mask_to_apicid_and,
-        .phys_pkg_id = phys_pkg_id,
-        .get_apic_id = get_apic_id,
-        .set_apic_id = set_apic_id,
-        .apic_id_mask = (0xFFFFFFFFu),
+
+        .name                           = "cluster x2apic",
+        .probe                          = NULL,
+        .acpi_madt_oem_check            = x2apic_acpi_madt_oem_check,
+        .apic_id_registered             = x2apic_apic_id_registered,
+
+        .irq_delivery_mode              = dest_LowestPrio,
+        .irq_dest_mode                  = 1, /* logical */
+
+        .target_cpus                    = x2apic_target_cpus,
+        .disable_esr                    = 0,
+        .dest_logical                   = APIC_DEST_LOGICAL,
+        .check_apicid_used              = NULL,
+        .check_apicid_present           = NULL,
+
+        .vector_allocation_domain       = x2apic_vector_allocation_domain,
+        .init_apic_ldr                  = init_x2apic_ldr,
+
+        .ioapic_phys_id_map             = NULL,
+        .setup_apic_routing             = NULL,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = NULL,
+        .cpu_to_logical_apicid          = NULL,
+        .cpu_present_to_apicid          = default_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = NULL,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = default_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = x2apic_cluster_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = x2apic_cluster_phys_get_apic_id,
+        .set_apic_id                    = set_apic_id,
+        .apic_id_mask                   = 0xFFFFFFFFu,
+
+        .cpu_mask_to_apicid             = x2apic_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = x2apic_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = x2apic_send_IPI_mask,
+        .send_IPI_mask_allbutself       = x2apic_send_IPI_mask_allbutself,
+        .send_IPI_allbutself            = x2apic_send_IPI_allbutself,
+        .send_IPI_all                   = x2apic_send_IPI_all,
+        .send_IPI_self                  = x2apic_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+        .wait_for_init_deassert         = NULL,
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = NULL,
 };
diff --git a/arch/x86/kernel/genx2apic_phys.c b/arch/x86/kernel/genx2apic_phys.c
index 21bcc0e098b..5cbae8aa040 100644
--- a/arch/x86/kernel/genx2apic_phys.c
+++ b/arch/x86/kernel/genx2apic_phys.c
@@ -55,8 +55,8 @@ static void __x2apic_send_IPI_dest(unsigned int apicid, int vector,
 
 static void x2apic_send_IPI_mask(const struct cpumask *mask, int vector)
 {
-        unsigned long flags;
         unsigned long query_cpu;
+        unsigned long flags;
 
         local_irq_save(flags);
         for_each_cpu(query_cpu, mask) {
@@ -66,12 +66,12 @@ static void x2apic_send_IPI_mask(const struct cpumask *mask, int vector)
         local_irq_restore(flags);
 }
 
-static void x2apic_send_IPI_mask_allbutself(const struct cpumask *mask,
-                                            int vector)
+static void
+ x2apic_send_IPI_mask_allbutself(const struct cpumask *mask, int vector)
 {
-        unsigned long flags;
-        unsigned long query_cpu;
         unsigned long this_cpu = smp_processor_id();
+        unsigned long query_cpu;
+        unsigned long flags;
 
         local_irq_save(flags);
         for_each_cpu(query_cpu, mask) {
@@ -85,16 +85,17 @@ static void x2apic_send_IPI_mask_allbutself(const struct cpumask *mask,
 
 static void x2apic_send_IPI_allbutself(int vector)
 {
-        unsigned long flags;
-        unsigned long query_cpu;
         unsigned long this_cpu = smp_processor_id();
+        unsigned long query_cpu;
+        unsigned long flags;
 
         local_irq_save(flags);
-        for_each_online_cpu(query_cpu)
-                if (query_cpu != this_cpu)
-                        __x2apic_send_IPI_dest(
-                                per_cpu(x86_cpu_to_apicid, query_cpu),
-                                vector, APIC_DEST_PHYSICAL);
+        for_each_online_cpu(query_cpu) {
+                if (query_cpu == this_cpu)
+                        continue;
+                __x2apic_send_IPI_dest(per_cpu(x86_cpu_to_apicid, query_cpu),
+                                       vector, APIC_DEST_PHYSICAL);
+        }
         local_irq_restore(flags);
 }
 
@@ -110,21 +111,21 @@ static int x2apic_apic_id_registered(void)
 
 static unsigned int x2apic_cpu_mask_to_apicid(const struct cpumask *cpumask)
 {
-        int cpu;
-
         /*
          * We're using fixed IRQ delivery, can only return one phys APIC ID.
          * May as well be the first.
          */
-        cpu = cpumask_first(cpumask);
+        int cpu = cpumask_first(cpumask);
+
         if ((unsigned)cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
         else
                 return BAD_APICID;
 }
 
-static unsigned int x2apic_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
-                                                  const struct cpumask *andmask)
+static unsigned int
+x2apic_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
+                              const struct cpumask *andmask)
 {
         int cpu;
 
@@ -132,31 +133,28 @@ static unsigned int x2apic_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
          * We're using fixed IRQ delivery, can only return one phys APIC ID.
          * May as well be the first.
          */
-        for_each_cpu_and(cpu, cpumask, andmask)
+        for_each_cpu_and(cpu, cpumask, andmask) {
                 if (cpumask_test_cpu(cpu, cpu_online_mask))
                         break;
+        }
+
         if (cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
+
         return BAD_APICID;
 }
 
-static unsigned int get_apic_id(unsigned long x)
+static unsigned int x2apic_phys_get_apic_id(unsigned long x)
 {
-        unsigned int id;
-
-        id = x;
-        return id;
+        return x;
 }
 
 static unsigned long set_apic_id(unsigned int id)
 {
-        unsigned long x;
-
-        x = id;
-        return x;
+        return id;
 }
 
-static unsigned int phys_pkg_id(int index_msb)
+static int x2apic_phys_pkg_id(int initial_apicid, int index_msb)
 {
         return current_cpu_data.initial_apicid >> index_msb;
 }
@@ -168,27 +166,58 @@ static void x2apic_send_IPI_self(int vector)
 
 static void init_x2apic_ldr(void)
 {
-        return;
 }
 
 struct genapic apic_x2apic_phys = {
-        .name = "physical x2apic",
-        .acpi_madt_oem_check = x2apic_acpi_madt_oem_check,
-        .int_delivery_mode = dest_Fixed,
-        .int_dest_mode = (APIC_DEST_PHYSICAL != 0),
-        .target_cpus = x2apic_target_cpus,
-        .vector_allocation_domain = x2apic_vector_allocation_domain,
-        .apic_id_registered = x2apic_apic_id_registered,
-        .init_apic_ldr = init_x2apic_ldr,
-        .send_IPI_all = x2apic_send_IPI_all,
-        .send_IPI_allbutself = x2apic_send_IPI_allbutself,
-        .send_IPI_mask = x2apic_send_IPI_mask,
-        .send_IPI_mask_allbutself = x2apic_send_IPI_mask_allbutself,
-        .send_IPI_self = x2apic_send_IPI_self,
-        .cpu_mask_to_apicid = x2apic_cpu_mask_to_apicid,
-        .cpu_mask_to_apicid_and = x2apic_cpu_mask_to_apicid_and,
-        .phys_pkg_id = phys_pkg_id,
-        .get_apic_id = get_apic_id,
-        .set_apic_id = set_apic_id,
-        .apic_id_mask = (0xFFFFFFFFu),
+
+        .name                           = "physical x2apic",
+        .probe                          = NULL,
+        .acpi_madt_oem_check            = x2apic_acpi_madt_oem_check,
+        .apic_id_registered             = x2apic_apic_id_registered,
+
+        .irq_delivery_mode              = dest_Fixed,
+        .irq_dest_mode                  = 0, /* physical */
+
+        .target_cpus                    = x2apic_target_cpus,
+        .disable_esr                    = 0,
+        .dest_logical                   = 0,
+        .check_apicid_used              = NULL,
+        .check_apicid_present           = NULL,
+
+        .vector_allocation_domain       = x2apic_vector_allocation_domain,
+        .init_apic_ldr                  = init_x2apic_ldr,
+
+        .ioapic_phys_id_map             = NULL,
+        .setup_apic_routing             = NULL,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = NULL,
+        .cpu_to_logical_apicid          = NULL,
+        .cpu_present_to_apicid          = default_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = NULL,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = default_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = x2apic_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = x2apic_phys_get_apic_id,
+        .set_apic_id                    = set_apic_id,
+        .apic_id_mask                   = 0xFFFFFFFFu,
+
+        .cpu_mask_to_apicid             = x2apic_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = x2apic_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = x2apic_send_IPI_mask,
+        .send_IPI_mask_allbutself       = x2apic_send_IPI_mask_allbutself,
+        .send_IPI_allbutself            = x2apic_send_IPI_allbutself,
+        .send_IPI_all                   = x2apic_send_IPI_all,
+        .send_IPI_self                  = x2apic_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+        .wait_for_init_deassert         = NULL,
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = NULL,
 };
diff --git a/arch/x86/kernel/genx2apic_uv_x.c b/arch/x86/kernel/genx2apic_uv_x.c
index b193e082f6c..6adb5e6f4d9 100644
--- a/arch/x86/kernel/genx2apic_uv_x.c
+++ b/arch/x86/kernel/genx2apic_uv_x.c
@@ -25,6 +25,7 @@
 #include <asm/ipi.h>
 #include <asm/genapic.h>
 #include <asm/pgtable.h>
+#include <asm/uv/uv.h>
 #include <asm/uv/uv_mmrs.h>
 #include <asm/uv/uv_hub.h>
 #include <asm/uv/bios.h>
@@ -117,12 +118,13 @@ static void uv_send_IPI_one(int cpu, int vector)
         int pnode;
 
         apicid = per_cpu(x86_cpu_to_apicid, cpu);
-        lapicid = apicid & 0x3f;                /* ZZZ macro needed */
+        lapicid = apicid & 0x3f; /* ZZZ macro needed */
         pnode = uv_apicid_to_pnode(apicid);
-        val =
-            (1UL << UVH_IPI_INT_SEND_SHFT) | (lapicid <<
-                                              UVH_IPI_INT_APIC_ID_SHFT) |
-            (vector << UVH_IPI_INT_VECTOR_SHFT);
+
+        val = (     1UL << UVH_IPI_INT_SEND_SHFT    ) |
+              ( lapicid << UVH_IPI_INT_APIC_ID_SHFT ) |
+              (  vector << UVH_IPI_INT_VECTOR_SHFT  );
+
         uv_write_global_mmr64(pnode, UVH_IPI_INT, val);
 }
 
@@ -136,22 +138,24 @@ static void uv_send_IPI_mask(const struct cpumask *mask, int vector)
 
 static void uv_send_IPI_mask_allbutself(const struct cpumask *mask, int vector)
 {
-        unsigned int cpu;
         unsigned int this_cpu = smp_processor_id();
+        unsigned int cpu;
 
-        for_each_cpu(cpu, mask)
+        for_each_cpu(cpu, mask) {
                 if (cpu != this_cpu)
                         uv_send_IPI_one(cpu, vector);
+        }
 }
 
 static void uv_send_IPI_allbutself(int vector)
 {
-        unsigned int cpu;
         unsigned int this_cpu = smp_processor_id();
+        unsigned int cpu;
 
-        for_each_online_cpu(cpu)
+        for_each_online_cpu(cpu) {
                 if (cpu != this_cpu)
                         uv_send_IPI_one(cpu, vector);
+        }
 }
 
 static void uv_send_IPI_all(int vector)
@@ -170,21 +174,21 @@ static void uv_init_apic_ldr(void)
 
 static unsigned int uv_cpu_mask_to_apicid(const struct cpumask *cpumask)
 {
-        int cpu;
-
         /*
          * We're using fixed IRQ delivery, can only return one phys APIC ID.
          * May as well be the first.
          */
-        cpu = cpumask_first(cpumask);
+        int cpu = cpumask_first(cpumask);
+
         if ((unsigned)cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
         else
                 return BAD_APICID;
 }
 
-static unsigned int uv_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
-                                              const struct cpumask *andmask)
+static unsigned int
+uv_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
+                          const struct cpumask *andmask)
 {
         int cpu;
 
@@ -192,15 +196,17 @@ static unsigned int uv_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
          * We're using fixed IRQ delivery, can only return one phys APIC ID.
          * May as well be the first.
          */
-        for_each_cpu_and(cpu, cpumask, andmask)
+        for_each_cpu_and(cpu, cpumask, andmask) {
                 if (cpumask_test_cpu(cpu, cpu_online_mask))
                         break;
+        }
         if (cpu < nr_cpu_ids)
                 return per_cpu(x86_cpu_to_apicid, cpu);
+
         return BAD_APICID;
 }
 
-static unsigned int get_apic_id(unsigned long x)
+static unsigned int x2apic_get_apic_id(unsigned long x)
 {
         unsigned int id;
 
@@ -222,10 +228,10 @@ static unsigned long set_apic_id(unsigned int id)
 static unsigned int uv_read_apic_id(void)
 {
 
-        return get_apic_id(apic_read(APIC_ID));
+        return x2apic_get_apic_id(apic_read(APIC_ID));
 }
 
-static unsigned int phys_pkg_id(int index_msb)
+static int uv_phys_pkg_id(int initial_apicid, int index_msb)
 {
         return uv_read_apic_id() >> index_msb;
 }
@@ -236,25 +242,57 @@ static void uv_send_IPI_self(int vector)
 }
 
 struct genapic apic_x2apic_uv_x = {
-        .name = "UV large system",
-        .acpi_madt_oem_check = uv_acpi_madt_oem_check,
-        .int_delivery_mode = dest_Fixed,
-        .int_dest_mode = (APIC_DEST_PHYSICAL != 0),
-        .target_cpus = uv_target_cpus,
-        .vector_allocation_domain = uv_vector_allocation_domain,
-        .apic_id_registered = uv_apic_id_registered,
-        .init_apic_ldr = uv_init_apic_ldr,
-        .send_IPI_all = uv_send_IPI_all,
-        .send_IPI_allbutself = uv_send_IPI_allbutself,
-        .send_IPI_mask = uv_send_IPI_mask,
-        .send_IPI_mask_allbutself = uv_send_IPI_mask_allbutself,
-        .send_IPI_self = uv_send_IPI_self,
-        .cpu_mask_to_apicid = uv_cpu_mask_to_apicid,
-        .cpu_mask_to_apicid_and = uv_cpu_mask_to_apicid_and,
-        .phys_pkg_id = phys_pkg_id,
-        .get_apic_id = get_apic_id,
-        .set_apic_id = set_apic_id,
-        .apic_id_mask = (0xFFFFFFFFu),
+
+        .name                           = "UV large system",
+        .probe                          = NULL,
+        .acpi_madt_oem_check            = uv_acpi_madt_oem_check,
+        .apic_id_registered             = uv_apic_id_registered,
+
+        .irq_delivery_mode              = dest_Fixed,
+        .irq_dest_mode                  = 1, /* logical */
+
+        .target_cpus                    = uv_target_cpus,
+        .disable_esr                    = 0,
+        .dest_logical                   = APIC_DEST_LOGICAL,
+        .check_apicid_used              = NULL,
+        .check_apicid_present           = NULL,
+
+        .vector_allocation_domain       = uv_vector_allocation_domain,
+        .init_apic_ldr                  = uv_init_apic_ldr,
+
+        .ioapic_phys_id_map             = NULL,
+        .setup_apic_routing             = NULL,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = NULL,
+        .cpu_to_logical_apicid          = NULL,
+        .cpu_present_to_apicid          = default_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = NULL,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = default_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = uv_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = x2apic_get_apic_id,
+        .set_apic_id                    = set_apic_id,
+        .apic_id_mask                   = 0xFFFFFFFFu,
+
+        .cpu_mask_to_apicid             = uv_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = uv_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = uv_send_IPI_mask,
+        .send_IPI_mask_allbutself       = uv_send_IPI_mask_allbutself,
+        .send_IPI_allbutself            = uv_send_IPI_allbutself,
+        .send_IPI_all                   = uv_send_IPI_all,
+        .send_IPI_self                  = uv_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+        .wait_for_init_deassert         = NULL,
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = NULL,
 };
 
 static __cpuinit void set_x2apic_extra_bits(int pnode)
diff --git a/arch/x86/kernel/head64.c b/arch/x86/kernel/head64.c
index b9a4d8c4b93..f5b27224769 100644
--- a/arch/x86/kernel/head64.c
+++ b/arch/x86/kernel/head64.c
@@ -26,27 +26,6 @@
 #include <asm/bios_ebda.h>
 #include <asm/trampoline.h>
 
-/* boot cpu pda */
-static struct x8664_pda _boot_cpu_pda;
-
-#ifdef CONFIG_SMP
-/*
- * We install an empty cpu_pda pointer table to indicate to early users
- * (numa_set_node) that the cpu_pda pointer table for cpus other than
- * the boot cpu is not yet setup.
- */
-static struct x8664_pda *__cpu_pda[NR_CPUS] __initdata;
-#else
-static struct x8664_pda *__cpu_pda[NR_CPUS] __read_mostly;
-#endif
-
-void __init x86_64_init_pda(void)
-{
-        _cpu_pda = __cpu_pda;
-        cpu_pda(0) = &_boot_cpu_pda;
-        pda_init(0);
-}
-
 static void __init zap_identity_mappings(void)
 {
         pgd_t *pgd = pgd_offset_k(0UL);
@@ -112,8 +91,6 @@ void __init x86_64_start_kernel(char * real_mode_data)
         if (console_loglevel == 10)
                 early_printk("Kernel alive\n");
 
-        x86_64_init_pda();
-
         x86_64_start_reservations(real_mode_data);
 }
 
diff --git a/arch/x86/kernel/head_32.S b/arch/x86/kernel/head_32.S
index e835b4eea70..2a0aad7718d 100644
--- a/arch/x86/kernel/head_32.S
+++ b/arch/x86/kernel/head_32.S
@@ -19,6 +19,7 @@
 #include <asm/asm-offsets.h>
 #include <asm/setup.h>
 #include <asm/processor-flags.h>
+#include <asm/percpu.h>
 
 /* Physical address */
 #define pa(X) ((X) - __PAGE_OFFSET)
@@ -429,14 +430,34 @@ is386:	movl $2,%ecx		# set MP
         ljmp $(__KERNEL_CS),$1f
 1:      movl $(__KERNEL_DS),%eax        # reload all the segment registers
         movl %eax,%ss                   # after changing gdt.
-        movl %eax,%fs                   # gets reset once there's real percpu
 
         movl $(__USER_DS),%eax          # DS/ES contains default USER segment
         movl %eax,%ds
         movl %eax,%es
 
-        xorl %eax,%eax                  # Clear GS and LDT
+        movl $(__KERNEL_PERCPU), %eax
+        movl %eax,%fs                   # set this cpu's percpu
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+        /*
+         * The linker can't handle this by relocation.  Manually set
+         * base address in stack canary segment descriptor.
+         */
+        cmpb $0,ready
+        jne 1f
+        movl $per_cpu__gdt_page,%eax
+        movl $per_cpu__stack_canary,%ecx
+        subl $20, %ecx
+        movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
+        shrl $16, %ecx
+        movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
+        movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
+1:
+#endif
+        movl $(__KERNEL_STACK_CANARY),%eax
         movl %eax,%gs
+
+        xorl %eax,%eax                  # Clear LDT
         lldt %ax
 
         cld                     # gcc2 wants the direction flag cleared at all times
@@ -446,8 +467,6 @@ is386:	movl $2,%ecx		# set MP
         movb $1, ready
         cmpb $0,%cl             # the first CPU calls start_kernel
         je   1f
-        movl $(__KERNEL_PERCPU), %eax
-        movl %eax,%fs           # set this cpu's percpu
         movl (stack_start), %esp
 1:
 #endif /* CONFIG_SMP */
@@ -548,12 +567,8 @@ early_fault:
         pushl %eax
         pushl %edx              /* trapno */
         pushl $fault_msg
-#ifdef CONFIG_EARLY_PRINTK
-        call early_printk
-#else
         call printk
 #endif
-#endif
         call dump_stack
 hlt_loop:
         hlt
@@ -580,11 +595,10 @@ ignore_int:
         pushl 32(%esp)
         pushl 40(%esp)
         pushl $int_msg
-#ifdef CONFIG_EARLY_PRINTK
-        call early_printk
-#else
         call printk
-#endif
+
+        call dump_stack
+
         addl $(5*4),%esp
         popl %ds
         popl %es
@@ -660,7 +674,7 @@ early_recursion_flag:
         .long 0
 
 int_msg:
-        .asciz "Unknown interrupt or fault at EIP %p %p %p\n"
+        .asciz "Unknown interrupt or fault at: %p %p %p\n"
 
 fault_msg:
 /* fault info: */
diff --git a/arch/x86/kernel/head_64.S b/arch/x86/kernel/head_64.S
index 0e275d49556..2e648e3a5ea 100644
--- a/arch/x86/kernel/head_64.S
+++ b/arch/x86/kernel/head_64.S
@@ -19,6 +19,7 @@
 #include <asm/msr.h>
 #include <asm/cache.h>
 #include <asm/processor-flags.h>
+#include <asm/percpu.h>
 
 #ifdef CONFIG_PARAVIRT
 #include <asm/asm-offsets.h>
@@ -226,12 +227,15 @@ ENTRY(secondary_startup_64)
         movl %eax,%fs
         movl %eax,%gs
 
-        /* 
-         * Setup up a dummy PDA. this is just for some early bootup code
-         * that does in_interrupt() 
-         */ 
+        /* Set up %gs.
+         *
+         * The base of %gs always points to the bottom of the irqstack
+         * union.  If the stack protector canary is enabled, it is
+         * located at %gs:40.  Note that, on SMP, the boot cpu uses
+         * init data section till per cpu areas are set up.
+         */
         movl    $MSR_GS_BASE,%ecx
-        movq    $empty_zero_page,%rax
+        movq    initial_gs(%rip),%rax
         movq    %rax,%rdx
         shrq    $32,%rdx
         wrmsr   
@@ -257,6 +261,8 @@ ENTRY(secondary_startup_64)
         .align  8
         ENTRY(initial_code)
         .quad   x86_64_start_kernel
+        ENTRY(initial_gs)
+        .quad   INIT_PER_CPU_VAR(irq_stack_union)
         __FINITDATA
 
         ENTRY(stack_start)
@@ -401,7 +407,8 @@ NEXT_PAGE(level2_spare_pgt)
         .globl early_gdt_descr
 early_gdt_descr:
         .word   GDT_ENTRIES*8-1
-        .quad   per_cpu__gdt_page
+early_gdt_descr_base:
+        .quad   INIT_PER_CPU_VAR(gdt_page)
 
 ENTRY(phys_base)
         /* This must match the first entry in level2_kernel_pgt */
diff --git a/arch/x86/kernel/hpet.c b/arch/x86/kernel/hpet.c
index 64d5ad0b8ad..a00545fe5cd 100644
--- a/arch/x86/kernel/hpet.c
+++ b/arch/x86/kernel/hpet.c
@@ -269,6 +269,8 @@ static void hpet_set_mode(enum clock_event_mode mode,
                 now = hpet_readl(HPET_COUNTER);
                 cmp = now + (unsigned long) delta;
                 cfg = hpet_readl(HPET_Tn_CFG(timer));
+                /* Make sure we use edge triggered interrupts */
+                cfg &= ~HPET_TN_LEVEL;
                 cfg |= HPET_TN_ENABLE | HPET_TN_PERIODIC |
                        HPET_TN_SETVAL | HPET_TN_32BIT;
                 hpet_writel(cfg, HPET_Tn_CFG(timer));
@@ -897,7 +899,7 @@ static unsigned long hpet_rtc_flags;
 static int hpet_prev_update_sec;
 static struct rtc_time hpet_alarm_time;
 static unsigned long hpet_pie_count;
-static unsigned long hpet_t1_cmp;
+static u32 hpet_t1_cmp;
 static unsigned long hpet_default_delta;
 static unsigned long hpet_pie_delta;
 static unsigned long hpet_pie_limit;
@@ -905,6 +907,14 @@ static unsigned long hpet_pie_limit;
 static rtc_irq_handler irq_handler;
 
 /*
+ * Check that the hpet counter c1 is ahead of the c2
+ */
+static inline int hpet_cnt_ahead(u32 c1, u32 c2)
+{
+        return (s32)(c2 - c1) < 0;
+}
+
+/*
  * Registers a IRQ handler.
  */
 int hpet_register_irq_handler(rtc_irq_handler handler)
@@ -1075,7 +1085,7 @@ static void hpet_rtc_timer_reinit(void)
                 hpet_t1_cmp += delta;
                 hpet_writel(hpet_t1_cmp, HPET_T1_CMP);
                 lost_ints++;
-        } while ((long)(hpet_readl(HPET_COUNTER) - hpet_t1_cmp) > 0);
+        } while (!hpet_cnt_ahead(hpet_t1_cmp, hpet_readl(HPET_COUNTER)));
 
         if (lost_ints) {
                 if (hpet_rtc_flags & RTC_PIE)
diff --git a/arch/x86/kernel/i8237.c b/arch/x86/kernel/i8237.c
index dbd6c1d1b63..b42ca694dc6 100644
--- a/arch/x86/kernel/i8237.c
+++ b/arch/x86/kernel/i8237.c
@@ -28,10 +28,10 @@ static int i8237A_resume(struct sys_device *dev)
 
         flags = claim_dma_lock();
 
-        dma_outb(DMA1_RESET_REG, 0);
-        dma_outb(DMA2_RESET_REG, 0);
+        dma_outb(0, DMA1_RESET_REG);
+        dma_outb(0, DMA2_RESET_REG);
 
-        for (i = 0;i < 8;i++) {
+        for (i = 0; i < 8; i++) {
                 set_dma_addr(i, 0x000000);
                 /* DMA count is a bit weird so this is not 0 */
                 set_dma_count(i, 1);
@@ -51,14 +51,14 @@ static int i8237A_suspend(struct sys_device *dev, pm_message_t state)
 }
 
 static struct sysdev_class i8237_sysdev_class = {
-        .name = "i8237",
-        .suspend = i8237A_suspend,
-        .resume = i8237A_resume,
+        .name           = "i8237",
+        .suspend        = i8237A_suspend,
+        .resume         = i8237A_resume,
 };
 
 static struct sys_device device_i8237A = {
-        .id     = 0,
-        .cls    = &i8237_sysdev_class,
+        .id             = 0,
+        .cls            = &i8237_sysdev_class,
 };
 
 static int __init i8237A_init_sysfs(void)
@@ -68,5 +68,4 @@ static int __init i8237A_init_sysfs(void)
                 error = sysdev_register(&device_i8237A);
         return error;
 }
-
 device_initcall(i8237A_init_sysfs);
diff --git a/arch/x86/kernel/io_apic.c b/arch/x86/kernel/io_apic.c
index 1c4a1302536..7248ca11bdc 100644
--- a/arch/x86/kernel/io_apic.c
+++ b/arch/x86/kernel/io_apic.c
@@ -1,7 +1,7 @@
 /*
  *      Intel IO-APIC support for multi-Pentium hosts.
  *
- *      Copyright (C) 1997, 1998, 1999, 2000 Ingo Molnar, Hajnalka Szabo
+ *      Copyright (C) 1997, 1998, 1999, 2000, 2009 Ingo Molnar, Hajnalka Szabo
  *
  *      Many thanks to Stig Venaas for trying out countless experimental
  *      patches and reporting/debugging problems patiently!
@@ -46,6 +46,7 @@
 #include <asm/idle.h>
 #include <asm/io.h>
 #include <asm/smp.h>
+#include <asm/cpu.h>
 #include <asm/desc.h>
 #include <asm/proto.h>
 #include <asm/acpi.h>
@@ -61,9 +62,7 @@
 #include <asm/uv/uv_hub.h>
 #include <asm/uv/uv_irq.h>
 
-#include <mach_ipi.h>
-#include <mach_apic.h>
-#include <mach_apicdef.h>
+#include <asm/genapic.h>
 
 #define __apicdebuginit(type) static type __init
 
@@ -82,11 +81,11 @@ static DEFINE_SPINLOCK(vector_lock);
 int nr_ioapic_registers[MAX_IO_APICS];
 
 /* I/O APIC entries */
-struct mp_config_ioapic mp_ioapics[MAX_IO_APICS];
+struct mpc_ioapic mp_ioapics[MAX_IO_APICS];
 int nr_ioapics;
 
 /* MP IRQ source entries */
-struct mp_config_intsrc mp_irqs[MAX_IRQ_SOURCES];
+struct mpc_intsrc mp_irqs[MAX_IRQ_SOURCES];
 
 /* # of MP IRQ source entries */
 int mp_irq_entries;
@@ -99,10 +98,19 @@ DECLARE_BITMAP(mp_bus_not_pci, MAX_MP_BUSSES);
 
 int skip_ioapic_setup;
 
+void arch_disable_smp_support(void)
+{
+#ifdef CONFIG_PCI
+        noioapicquirk = 1;
+        noioapicreroute = -1;
+#endif
+        skip_ioapic_setup = 1;
+}
+
 static int __init parse_noapic(char *str)
 {
         /* disable IO-APIC */
-        disable_ioapic_setup();
+        arch_disable_smp_support();
         return 0;
 }
 early_param("noapic", parse_noapic);
@@ -356,7 +364,7 @@ set_extra_move_desc(struct irq_desc *desc, const struct cpumask *mask)
 
         if (!cfg->move_in_progress) {
                 /* it means that domain is not changed */
-                if (!cpumask_intersects(&desc->affinity, mask))
+                if (!cpumask_intersects(desc->affinity, mask))
                         cfg->move_desc_pending = 1;
         }
 }
@@ -386,7 +394,7 @@ struct io_apic {
 static __attribute_const__ struct io_apic __iomem *io_apic_base(int idx)
 {
         return (void __iomem *) __fix_to_virt(FIX_IO_APIC_BASE_0 + idx)
-                + (mp_ioapics[idx].mp_apicaddr & ~PAGE_MASK);
+                + (mp_ioapics[idx].apicaddr & ~PAGE_MASK);
 }
 
 static inline unsigned int io_apic_read(unsigned int apic, unsigned int reg)
@@ -478,7 +486,7 @@ __ioapic_write_entry(int apic, int pin, struct IO_APIC_route_entry e)
         io_apic_write(apic, 0x10 + 2*pin, eu.w1);
 }
 
-static void ioapic_write_entry(int apic, int pin, struct IO_APIC_route_entry e)
+void ioapic_write_entry(int apic, int pin, struct IO_APIC_route_entry e)
 {
         unsigned long flags;
         spin_lock_irqsave(&ioapic_lock, flags);
@@ -513,11 +521,11 @@ static void send_cleanup_vector(struct irq_cfg *cfg)
                 for_each_cpu_and(i, cfg->old_domain, cpu_online_mask)
                         cfg->move_cleanup_count++;
                 for_each_cpu_and(i, cfg->old_domain, cpu_online_mask)
-                        send_IPI_mask(cpumask_of(i), IRQ_MOVE_CLEANUP_VECTOR);
+                        apic->send_IPI_mask(cpumask_of(i), IRQ_MOVE_CLEANUP_VECTOR);
         } else {
                 cpumask_and(cleanup_mask, cfg->old_domain, cpu_online_mask);
                 cfg->move_cleanup_count = cpumask_weight(cleanup_mask);
-                send_IPI_mask(cleanup_mask, IRQ_MOVE_CLEANUP_VECTOR);
+                apic->send_IPI_mask(cleanup_mask, IRQ_MOVE_CLEANUP_VECTOR);
                 free_cpumask_var(cleanup_mask);
         }
         cfg->move_in_progress = 0;
@@ -562,8 +570,9 @@ static int
 assign_irq_vector(int irq, struct irq_cfg *cfg, const struct cpumask *mask);
 
 /*
- * Either sets desc->affinity to a valid value, and returns cpu_mask_to_apicid
- * of that, or returns BAD_APICID and leaves desc->affinity untouched.
+ * Either sets desc->affinity to a valid value, and returns
+ * ->cpu_mask_to_apicid of that, or returns BAD_APICID and
+ * leaves desc->affinity untouched.
  */
 static unsigned int
 set_desc_affinity(struct irq_desc *desc, const struct cpumask *mask)
@@ -579,9 +588,10 @@ set_desc_affinity(struct irq_desc *desc, const struct cpumask *mask)
         if (assign_irq_vector(irq, cfg, mask))
                 return BAD_APICID;
 
-        cpumask_and(&desc->affinity, cfg->domain, mask);
+        cpumask_and(desc->affinity, cfg->domain, mask);
         set_extra_move_desc(desc, mask);
-        return cpu_mask_to_apicid_and(&desc->affinity, cpu_online_mask);
+
+        return apic->cpu_mask_to_apicid_and(desc->affinity, cpu_online_mask);
 }
 
 static void
@@ -796,23 +806,6 @@ static void clear_IO_APIC (void)
                         clear_IO_APIC_pin(apic, pin);
 }
 
-#if !defined(CONFIG_SMP) && defined(CONFIG_X86_32)
-void send_IPI_self(int vector)
-{
-        unsigned int cfg;
-
-        /*
-         * Wait for idle.
-         */
-        apic_wait_icr_idle();
-        cfg = APIC_DM_FIXED | APIC_DEST_SELF | vector | APIC_DEST_LOGICAL;
-        /*
-         * Send the IPI. The write to APIC_ICR fires this off.
-         */
-        apic_write(APIC_ICR, cfg);
-}
-#endif /* !CONFIG_SMP && CONFIG_X86_32*/
-
 #ifdef CONFIG_X86_32
 /*
  * support for broken MP BIOSs, enables hand-redirection of PIRQ0-7 to
@@ -944,10 +937,10 @@ static int find_irq_entry(int apic, int pin, int type)
         int i;
 
         for (i = 0; i < mp_irq_entries; i++)
-                if (mp_irqs[i].mp_irqtype == type &&
-                    (mp_irqs[i].mp_dstapic == mp_ioapics[apic].mp_apicid ||
-                     mp_irqs[i].mp_dstapic == MP_APIC_ALL) &&
-                    mp_irqs[i].mp_dstirq == pin)
+                if (mp_irqs[i].irqtype == type &&
+                    (mp_irqs[i].dstapic == mp_ioapics[apic].apicid ||
+                     mp_irqs[i].dstapic == MP_APIC_ALL) &&
+                    mp_irqs[i].dstirq == pin)
                         return i;
 
         return -1;
@@ -961,13 +954,13 @@ static int __init find_isa_irq_pin(int irq, int type)
         int i;
 
         for (i = 0; i < mp_irq_entries; i++) {
-                int lbus = mp_irqs[i].mp_srcbus;
+                int lbus = mp_irqs[i].srcbus;
 
                 if (test_bit(lbus, mp_bus_not_pci) &&
-                    (mp_irqs[i].mp_irqtype == type) &&
-                    (mp_irqs[i].mp_srcbusirq == irq))
+                    (mp_irqs[i].irqtype == type) &&
+                    (mp_irqs[i].srcbusirq == irq))
 
-                        return mp_irqs[i].mp_dstirq;
+                        return mp_irqs[i].dstirq;
         }
         return -1;
 }
@@ -977,17 +970,17 @@ static int __init find_isa_irq_apic(int irq, int type)
         int i;
 
         for (i = 0; i < mp_irq_entries; i++) {
-                int lbus = mp_irqs[i].mp_srcbus;
+                int lbus = mp_irqs[i].srcbus;
 
                 if (test_bit(lbus, mp_bus_not_pci) &&
-                    (mp_irqs[i].mp_irqtype == type) &&
-                    (mp_irqs[i].mp_srcbusirq == irq))
+                    (mp_irqs[i].irqtype == type) &&
+                    (mp_irqs[i].srcbusirq == irq))
                         break;
         }
         if (i < mp_irq_entries) {
                 int apic;
                 for(apic = 0; apic < nr_ioapics; apic++) {
-                        if (mp_ioapics[apic].mp_apicid == mp_irqs[i].mp_dstapic)
+                        if (mp_ioapics[apic].apicid == mp_irqs[i].dstapic)
                                 return apic;
                 }
         }
@@ -1012,23 +1005,23 @@ int IO_APIC_get_PCI_irq_vector(int bus, int slot, int pin)
                 return -1;
         }
         for (i = 0; i < mp_irq_entries; i++) {
-                int lbus = mp_irqs[i].mp_srcbus;
+                int lbus = mp_irqs[i].srcbus;
 
                 for (apic = 0; apic < nr_ioapics; apic++)
-                        if (mp_ioapics[apic].mp_apicid == mp_irqs[i].mp_dstapic ||
-                            mp_irqs[i].mp_dstapic == MP_APIC_ALL)
+                        if (mp_ioapics[apic].apicid == mp_irqs[i].dstapic ||
+                            mp_irqs[i].dstapic == MP_APIC_ALL)
                                 break;
 
                 if (!test_bit(lbus, mp_bus_not_pci) &&
-                    !mp_irqs[i].mp_irqtype &&
+                    !mp_irqs[i].irqtype &&
                     (bus == lbus) &&
-                    (slot == ((mp_irqs[i].mp_srcbusirq >> 2) & 0x1f))) {
-                        int irq = pin_2_irq(i,apic,mp_irqs[i].mp_dstirq);
+                    (slot == ((mp_irqs[i].srcbusirq >> 2) & 0x1f))) {
+                        int irq = pin_2_irq(i, apic, mp_irqs[i].dstirq);
 
                         if (!(apic || IO_APIC_IRQ(irq)))
                                 continue;
 
-                        if (pin == (mp_irqs[i].mp_srcbusirq & 3))
+                        if (pin == (mp_irqs[i].srcbusirq & 3))
                                 return irq;
                         /*
                          * Use the first all-but-pin matching entry as a
@@ -1071,7 +1064,7 @@ static int EISA_ELCR(unsigned int irq)
  * EISA conforming in the MP table, that means its trigger type must
  * be read in from the ELCR */
 
-#define default_EISA_trigger(idx)       (EISA_ELCR(mp_irqs[idx].mp_srcbusirq))
+#define default_EISA_trigger(idx)       (EISA_ELCR(mp_irqs[idx].srcbusirq))
 #define default_EISA_polarity(idx)      default_ISA_polarity(idx)
 
 /* PCI interrupts are always polarity one level triggered,
@@ -1088,13 +1081,13 @@ static int EISA_ELCR(unsigned int irq)
 
 static int MPBIOS_polarity(int idx)
 {
-        int bus = mp_irqs[idx].mp_srcbus;
+        int bus = mp_irqs[idx].srcbus;
         int polarity;
 
         /*
          * Determine IRQ line polarity (high active or low active):
          */
-        switch (mp_irqs[idx].mp_irqflag & 3)
+        switch (mp_irqs[idx].irqflag & 3)
         {
                 case 0: /* conforms, ie. bus-type dependent polarity */
                         if (test_bit(bus, mp_bus_not_pci))
@@ -1130,13 +1123,13 @@ static int MPBIOS_polarity(int idx)
 
 static int MPBIOS_trigger(int idx)
 {
-        int bus = mp_irqs[idx].mp_srcbus;
+        int bus = mp_irqs[idx].srcbus;
         int trigger;
 
         /*
          * Determine IRQ trigger mode (edge or level sensitive):
          */
-        switch ((mp_irqs[idx].mp_irqflag>>2) & 3)
+        switch ((mp_irqs[idx].irqflag>>2) & 3)
         {
                 case 0: /* conforms, ie. bus-type dependent */
                         if (test_bit(bus, mp_bus_not_pci))
@@ -1214,16 +1207,16 @@ int (*ioapic_renumber_irq)(int ioapic, int irq);
 static int pin_2_irq(int idx, int apic, int pin)
 {
         int irq, i;
-        int bus = mp_irqs[idx].mp_srcbus;
+        int bus = mp_irqs[idx].srcbus;
 
         /*
          * Debugging check, we are in big trouble if this message pops up!
          */
-        if (mp_irqs[idx].mp_dstirq != pin)
+        if (mp_irqs[idx].dstirq != pin)
                 printk(KERN_ERR "broken BIOS or MPTABLE parser, ayiee!!\n");
 
         if (test_bit(bus, mp_bus_not_pci)) {
-                irq = mp_irqs[idx].mp_srcbusirq;
+                irq = mp_irqs[idx].srcbusirq;
         } else {
                 /*
                  * PCI IRQs are mapped in order
@@ -1315,7 +1308,7 @@ __assign_irq_vector(int irq, struct irq_cfg *cfg, const struct cpumask *mask)
                 int new_cpu;
                 int vector, offset;
 
-                vector_allocation_domain(cpu, tmp_mask);
+                apic->vector_allocation_domain(cpu, tmp_mask);
 
                 vector = current_vector;
                 offset = current_offset;
@@ -1485,10 +1478,10 @@ static void ioapic_register_intr(int irq, struct irq_desc *desc, unsigned long t
                                               handle_edge_irq, "edge");
 }
 
-static int setup_ioapic_entry(int apic, int irq,
-                              struct IO_APIC_route_entry *entry,
-                              unsigned int destination, int trigger,
-                              int polarity, int vector)
+int setup_ioapic_entry(int apic_id, int irq,
+                       struct IO_APIC_route_entry *entry,
+                       unsigned int destination, int trigger,
+                       int polarity, int vector)
 {
         /*
          * add it to the IO-APIC irq-routing table:
@@ -1497,25 +1490,25 @@ static int setup_ioapic_entry(int apic, int irq,
 
 #ifdef CONFIG_INTR_REMAP
         if (intr_remapping_enabled) {
-                struct intel_iommu *iommu = map_ioapic_to_ir(apic);
+                struct intel_iommu *iommu = map_ioapic_to_ir(apic_id);
                 struct irte irte;
                 struct IR_IO_APIC_route_entry *ir_entry =
                         (struct IR_IO_APIC_route_entry *) entry;
                 int index;
 
                 if (!iommu)
-                        panic("No mapping iommu for ioapic %d\n", apic);
+                        panic("No mapping iommu for ioapic %d\n", apic_id);
 
                 index = alloc_irte(iommu, irq, 1);
                 if (index < 0)
-                        panic("Failed to allocate IRTE for ioapic %d\n", apic);
+                        panic("Failed to allocate IRTE for ioapic %d\n", apic_id);
 
                 memset(&irte, 0, sizeof(irte));
 
                 irte.present = 1;
-                irte.dst_mode = INT_DEST_MODE;
+                irte.dst_mode = apic->irq_dest_mode;
                 irte.trigger_mode = trigger;
-                irte.dlvry_mode = INT_DELIVERY_MODE;
+                irte.dlvry_mode = apic->irq_delivery_mode;
                 irte.vector = vector;
                 irte.dest_id = IRTE_DEST(destination);
 
@@ -1528,8 +1521,8 @@ static int setup_ioapic_entry(int apic, int irq,
         } else
 #endif
         {
-                entry->delivery_mode = INT_DELIVERY_MODE;
-                entry->dest_mode = INT_DEST_MODE;
+                entry->delivery_mode = apic->irq_delivery_mode;
+                entry->dest_mode = apic->irq_dest_mode;
                 entry->dest = destination;
         }
 
@@ -1546,7 +1539,7 @@ static int setup_ioapic_entry(int apic, int irq,
         return 0;
 }
 
-static void setup_IO_APIC_irq(int apic, int pin, unsigned int irq, struct irq_desc *desc,
+static void setup_IO_APIC_irq(int apic_id, int pin, unsigned int irq, struct irq_desc *desc,
                               int trigger, int polarity)
 {
         struct irq_cfg *cfg;
@@ -1558,22 +1551,22 @@ static void setup_IO_APIC_irq(int apic, int pin, unsigned int irq, struct irq_de
 
         cfg = desc->chip_data;
 
-        if (assign_irq_vector(irq, cfg, TARGET_CPUS))
+        if (assign_irq_vector(irq, cfg, apic->target_cpus()))
                 return;
 
-        dest = cpu_mask_to_apicid_and(cfg->domain, TARGET_CPUS);
+        dest = apic->cpu_mask_to_apicid_and(cfg->domain, apic->target_cpus());
 
         apic_printk(APIC_VERBOSE,KERN_DEBUG
                     "IOAPIC[%d]: Set routing entry (%d-%d -> 0x%x -> "
                     "IRQ %d Mode:%i Active:%i)\n",
-                    apic, mp_ioapics[apic].mp_apicid, pin, cfg->vector,
+                    apic_id, mp_ioapics[apic_id].apicid, pin, cfg->vector,
                     irq, trigger, polarity);
 
 
-        if (setup_ioapic_entry(mp_ioapics[apic].mp_apicid, irq, &entry,
+        if (setup_ioapic_entry(mp_ioapics[apic_id].apicid, irq, &entry,
                                dest, trigger, polarity, cfg->vector)) {
                 printk("Failed to setup ioapic entry for ioapic  %d, pin %d\n",
-                       mp_ioapics[apic].mp_apicid, pin);
+                       mp_ioapics[apic_id].apicid, pin);
                 __clear_irq_vector(irq, cfg);
                 return;
         }
@@ -1582,12 +1575,12 @@ static void setup_IO_APIC_irq(int apic, int pin, unsigned int irq, struct irq_de
         if (irq < NR_IRQS_LEGACY)
                 disable_8259A_irq(irq);
 
-        ioapic_write_entry(apic, pin, entry);
+        ioapic_write_entry(apic_id, pin, entry);
 }
 
 static void __init setup_IO_APIC_irqs(void)
 {
-        int apic, pin, idx, irq;
+        int apic_id, pin, idx, irq;
         int notcon = 0;
         struct irq_desc *desc;
         struct irq_cfg *cfg;
@@ -1595,21 +1588,19 @@ static void __init setup_IO_APIC_irqs(void)
 
         apic_printk(APIC_VERBOSE, KERN_DEBUG "init IO_APIC IRQs\n");
 
-        for (apic = 0; apic < nr_ioapics; apic++) {
-                for (pin = 0; pin < nr_ioapic_registers[apic]; pin++) {
+        for (apic_id = 0; apic_id < nr_ioapics; apic_id++) {
+                for (pin = 0; pin < nr_ioapic_registers[apic_id]; pin++) {
 
-                        idx = find_irq_entry(apic, pin, mp_INT);
+                        idx = find_irq_entry(apic_id, pin, mp_INT);
                         if (idx == -1) {
                                 if (!notcon) {
                                         notcon = 1;
                                         apic_printk(APIC_VERBOSE,
                                                 KERN_DEBUG " %d-%d",
-                                                mp_ioapics[apic].mp_apicid,
-                                                pin);
+                                                mp_ioapics[apic_id].apicid, pin);
                                 } else
                                         apic_printk(APIC_VERBOSE, " %d-%d",
-                                                mp_ioapics[apic].mp_apicid,
-                                                pin);
+                                                mp_ioapics[apic_id].apicid, pin);
                                 continue;
                         }
                         if (notcon) {
@@ -1618,20 +1609,25 @@ static void __init setup_IO_APIC_irqs(void)
                                 notcon = 0;
                         }
 
-                        irq = pin_2_irq(idx, apic, pin);
-#ifdef CONFIG_X86_32
-                        if (multi_timer_check(apic, irq))
+                        irq = pin_2_irq(idx, apic_id, pin);
+
+                        /*
+                         * Skip the timer IRQ if there's a quirk handler
+                         * installed and if it returns 1:
+                         */
+                        if (apic->multi_timer_check &&
+                                        apic->multi_timer_check(apic_id, irq))
                                 continue;
-#endif
+
                         desc = irq_to_desc_alloc_cpu(irq, cpu);
                         if (!desc) {
                                 printk(KERN_INFO "can not get irq_desc for %d\n", irq);
                                 continue;
                         }
                         cfg = desc->chip_data;
-                        add_pin_to_irq_cpu(cfg, cpu, apic, pin);
+                        add_pin_to_irq_cpu(cfg, cpu, apic_id, pin);
 
-                        setup_IO_APIC_irq(apic, pin, irq, desc,
+                        setup_IO_APIC_irq(apic_id, pin, irq, desc,
                                         irq_trigger(idx), irq_polarity(idx));
                 }
         }
@@ -1644,7 +1640,7 @@ static void __init setup_IO_APIC_irqs(void)
 /*
  * Set up the timer pin, possibly with the 8259A-master behind.
  */
-static void __init setup_timer_IRQ0_pin(unsigned int apic, unsigned int pin,
+static void __init setup_timer_IRQ0_pin(unsigned int apic_id, unsigned int pin,
                                         int vector)
 {
         struct IO_APIC_route_entry entry;
@@ -1660,10 +1656,10 @@ static void __init setup_timer_IRQ0_pin(unsigned int apic, unsigned int pin,
          * We use logical delivery to get the timer IRQ
          * to the first CPU.
          */
-        entry.dest_mode = INT_DEST_MODE;
-        entry.mask = 1;                                 /* mask IRQ now */
-        entry.dest = cpu_mask_to_apicid(TARGET_CPUS);
-        entry.delivery_mode = INT_DELIVERY_MODE;
+        entry.dest_mode = apic->irq_dest_mode;
+        entry.mask = 0;                 /* don't mask IRQ for edge */
+        entry.dest = apic->cpu_mask_to_apicid(apic->target_cpus());
+        entry.delivery_mode = apic->irq_delivery_mode;
         entry.polarity = 0;
         entry.trigger = 0;
         entry.vector = vector;
@@ -1677,7 +1673,7 @@ static void __init setup_timer_IRQ0_pin(unsigned int apic, unsigned int pin,
         /*
          * Add it to the IO-APIC irq-routing table:
          */
-        ioapic_write_entry(apic, pin, entry);
+        ioapic_write_entry(apic_id, pin, entry);
 }
 
 
@@ -1699,7 +1695,7 @@ __apicdebuginit(void) print_IO_APIC(void)
         printk(KERN_DEBUG "number of MP IRQ sources: %d.\n", mp_irq_entries);
         for (i = 0; i < nr_ioapics; i++)
                 printk(KERN_DEBUG "number of IO-APIC #%d registers: %d.\n",
-                       mp_ioapics[i].mp_apicid, nr_ioapic_registers[i]);
+                       mp_ioapics[i].apicid, nr_ioapic_registers[i]);
 
         /*
          * We are a bit conservative about what we expect.  We have to
@@ -1719,7 +1715,7 @@ __apicdebuginit(void) print_IO_APIC(void)
         spin_unlock_irqrestore(&ioapic_lock, flags);
 
         printk("\n");
-        printk(KERN_DEBUG "IO APIC #%d......\n", mp_ioapics[apic].mp_apicid);
+        printk(KERN_DEBUG "IO APIC #%d......\n", mp_ioapics[apic].apicid);
         printk(KERN_DEBUG ".... register #00: %08X\n", reg_00.raw);
         printk(KERN_DEBUG ".......    : physical APIC id: %02X\n", reg_00.bits.ID);
         printk(KERN_DEBUG ".......    : Delivery Type: %X\n", reg_00.bits.delivery_type);
@@ -2090,7 +2086,7 @@ static void __init setup_ioapic_ids_from_mpc(void)
 {
         union IO_APIC_reg_00 reg_00;
         physid_mask_t phys_id_present_map;
-        int apic;
+        int apic_id;
         int i;
         unsigned char old_id;
         unsigned long flags;
@@ -2109,26 +2105,26 @@ static void __init setup_ioapic_ids_from_mpc(void)
          * This is broken; anything with a real cpu count has to
          * circumvent this idiocy regardless.
          */
-        phys_id_present_map = ioapic_phys_id_map(phys_cpu_present_map);
+        phys_id_present_map = apic->ioapic_phys_id_map(phys_cpu_present_map);
 
         /*
          * Set the IOAPIC ID to the value stored in the MPC table.
          */
-        for (apic = 0; apic < nr_ioapics; apic++) {
+        for (apic_id = 0; apic_id < nr_ioapics; apic_id++) {
 
                 /* Read the register 0 value */
                 spin_lock_irqsave(&ioapic_lock, flags);
-                reg_00.raw = io_apic_read(apic, 0);
+                reg_00.raw = io_apic_read(apic_id, 0);
                 spin_unlock_irqrestore(&ioapic_lock, flags);
 
-                old_id = mp_ioapics[apic].mp_apicid;
+                old_id = mp_ioapics[apic_id].apicid;
 
-                if (mp_ioapics[apic].mp_apicid >= get_physical_broadcast()) {
+                if (mp_ioapics[apic_id].apicid >= get_physical_broadcast()) {
                         printk(KERN_ERR "BIOS bug, IO-APIC#%d ID is %d in the MPC table!...\n",
-                                apic, mp_ioapics[apic].mp_apicid);
+                                apic_id, mp_ioapics[apic_id].apicid);
                         printk(KERN_ERR "... fixing up to %d. (tell your hw vendor)\n",
                                 reg_00.bits.ID);
-                        mp_ioapics[apic].mp_apicid = reg_00.bits.ID;
+                        mp_ioapics[apic_id].apicid = reg_00.bits.ID;
                 }
 
                 /*
@@ -2136,10 +2132,10 @@ static void __init setup_ioapic_ids_from_mpc(void)
                  * system must have a unique ID or we get lots of nice
                  * 'stuck on smp_invalidate_needed IPI wait' messages.
                  */
-                if (check_apicid_used(phys_id_present_map,
-                                        mp_ioapics[apic].mp_apicid)) {
+                if (apic->check_apicid_used(phys_id_present_map,
+                                        mp_ioapics[apic_id].apicid)) {
                         printk(KERN_ERR "BIOS bug, IO-APIC#%d ID %d is already used!...\n",
-                                apic, mp_ioapics[apic].mp_apicid);
+                                apic_id, mp_ioapics[apic_id].apicid);
                         for (i = 0; i < get_physical_broadcast(); i++)
                                 if (!physid_isset(i, phys_id_present_map))
                                         break;
@@ -2148,13 +2144,13 @@ static void __init setup_ioapic_ids_from_mpc(void)
                         printk(KERN_ERR "... fixing up to %d. (tell your hw vendor)\n",
                                 i);
                         physid_set(i, phys_id_present_map);
-                        mp_ioapics[apic].mp_apicid = i;
+                        mp_ioapics[apic_id].apicid = i;
                 } else {
                         physid_mask_t tmp;
-                        tmp = apicid_to_cpu_present(mp_ioapics[apic].mp_apicid);
+                        tmp = apic->apicid_to_cpu_present(mp_ioapics[apic_id].apicid);
                         apic_printk(APIC_VERBOSE, "Setting %d in the "
                                         "phys_id_present_map\n",
-                                        mp_ioapics[apic].mp_apicid);
+                                        mp_ioapics[apic_id].apicid);
                         physids_or(phys_id_present_map, phys_id_present_map, tmp);
                 }
 
@@ -2163,11 +2159,11 @@ static void __init setup_ioapic_ids_from_mpc(void)
                  * We need to adjust the IRQ routing table
                  * if the ID changed.
                  */
-                if (old_id != mp_ioapics[apic].mp_apicid)
+                if (old_id != mp_ioapics[apic_id].apicid)
                         for (i = 0; i < mp_irq_entries; i++)
-                                if (mp_irqs[i].mp_dstapic == old_id)
-                                        mp_irqs[i].mp_dstapic
-                                                = mp_ioapics[apic].mp_apicid;
+                                if (mp_irqs[i].dstapic == old_id)
+                                        mp_irqs[i].dstapic
+                                                = mp_ioapics[apic_id].apicid;
 
                 /*
                  * Read the right value from the MPC table and
@@ -2175,20 +2171,20 @@ static void __init setup_ioapic_ids_from_mpc(void)
                  */
                 apic_printk(APIC_VERBOSE, KERN_INFO
                         "...changing IO-APIC physical APIC ID to %d ...",
-                        mp_ioapics[apic].mp_apicid);
+                        mp_ioapics[apic_id].apicid);
 
-                reg_00.bits.ID = mp_ioapics[apic].mp_apicid;
+                reg_00.bits.ID = mp_ioapics[apic_id].apicid;
                 spin_lock_irqsave(&ioapic_lock, flags);
-                io_apic_write(apic, 0, reg_00.raw);
+                io_apic_write(apic_id, 0, reg_00.raw);
                 spin_unlock_irqrestore(&ioapic_lock, flags);
 
                 /*
                  * Sanity check
                  */
                 spin_lock_irqsave(&ioapic_lock, flags);
-                reg_00.raw = io_apic_read(apic, 0);
+                reg_00.raw = io_apic_read(apic_id, 0);
                 spin_unlock_irqrestore(&ioapic_lock, flags);
-                if (reg_00.bits.ID != mp_ioapics[apic].mp_apicid)
+                if (reg_00.bits.ID != mp_ioapics[apic_id].apicid)
                         printk("could not set ID!\n");
                 else
                         apic_printk(APIC_VERBOSE, " ok.\n");
@@ -2291,7 +2287,7 @@ static int ioapic_retrigger_irq(unsigned int irq)
         unsigned long flags;
 
         spin_lock_irqsave(&vector_lock, flags);
-        send_IPI_mask(cpumask_of(cpumask_first(cfg->domain)), cfg->vector);
+        apic->send_IPI_mask(cpumask_of(cpumask_first(cfg->domain)), cfg->vector);
         spin_unlock_irqrestore(&vector_lock, flags);
 
         return 1;
@@ -2299,7 +2295,7 @@ static int ioapic_retrigger_irq(unsigned int irq)
 #else
 static int ioapic_retrigger_irq(unsigned int irq)
 {
-        send_IPI_self(irq_cfg(irq)->vector);
+        apic->send_IPI_self(irq_cfg(irq)->vector);
 
         return 1;
 }
@@ -2363,7 +2359,7 @@ migrate_ioapic_irq_desc(struct irq_desc *desc, const struct cpumask *mask)
 
         set_extra_move_desc(desc, mask);
 
-        dest = cpu_mask_to_apicid_and(cfg->domain, mask);
+        dest = apic->cpu_mask_to_apicid_and(cfg->domain, mask);
 
         modify_ioapic_rte = desc->status & IRQ_LEVEL;
         if (modify_ioapic_rte) {
@@ -2383,7 +2379,7 @@ migrate_ioapic_irq_desc(struct irq_desc *desc, const struct cpumask *mask)
         if (cfg->move_in_progress)
                 send_cleanup_vector(cfg);
 
-        cpumask_copy(&desc->affinity, mask);
+        cpumask_copy(desc->affinity, mask);
 }
 
 static int migrate_irq_remapped_level_desc(struct irq_desc *desc)
@@ -2405,11 +2401,11 @@ static int migrate_irq_remapped_level_desc(struct irq_desc *desc)
         }
 
         /* everthing is clear. we have right of way */
-        migrate_ioapic_irq_desc(desc, &desc->pending_mask);
+        migrate_ioapic_irq_desc(desc, desc->pending_mask);
 
         ret = 0;
         desc->status &= ~IRQ_MOVE_PENDING;
-        cpumask_clear(&desc->pending_mask);
+        cpumask_clear(desc->pending_mask);
 
 unmask:
         unmask_IO_APIC_irq_desc(desc);
@@ -2434,7 +2430,7 @@ static void ir_irq_migration(struct work_struct *work)
                                 continue;
                         }
 
-                        desc->chip->set_affinity(irq, &desc->pending_mask);
+                        desc->chip->set_affinity(irq, desc->pending_mask);
                         spin_unlock_irqrestore(&desc->lock, flags);
                 }
         }
@@ -2448,7 +2444,7 @@ static void set_ir_ioapic_affinity_irq_desc(struct irq_desc *desc,
 {
         if (desc->status & IRQ_LEVEL) {
                 desc->status |= IRQ_MOVE_PENDING;
-                cpumask_copy(&desc->pending_mask, mask);
+                cpumask_copy(desc->pending_mask, mask);
                 migrate_irq_remapped_level_desc(desc);
                 return;
         }
@@ -2516,7 +2512,7 @@ static void irq_complete_move(struct irq_desc **descp)
 
                 /* domain has not changed, but affinity did */
                 me = smp_processor_id();
-                if (cpu_isset(me, desc->affinity)) {
+                if (cpumask_test_cpu(me, desc->affinity)) {
                         *descp = desc = move_irq_desc(desc, me);
                         /* get the new one */
                         cfg = desc->chip_data;
@@ -2528,14 +2524,15 @@ static void irq_complete_move(struct irq_desc **descp)
 
         vector = ~get_irq_regs()->orig_ax;
         me = smp_processor_id();
+
+        if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain)) {
 #ifdef CONFIG_NUMA_MIGRATE_IRQ_DESC
                 *descp = desc = move_irq_desc(desc, me);
                 /* get the new one */
                 cfg = desc->chip_data;
 #endif
-
-        if (vector == cfg->vector && cpumask_test_cpu(me, cfg->domain))
                 send_cleanup_vector(cfg);
+        }
 }
 #else
 static inline void irq_complete_move(struct irq_desc **descp) {}
@@ -2866,19 +2863,15 @@ static inline void __init check_timer(void)
         int cpu = boot_cpu_id;
         int apic1, pin1, apic2, pin2;
         unsigned long flags;
-        unsigned int ver;
         int no_pin1 = 0;
 
         local_irq_save(flags);
 
-        ver = apic_read(APIC_LVR);
-        ver = GET_APIC_VERSION(ver);
-
         /*
          * get/set the timer IRQ vector:
          */
         disable_8259A_irq(0);
-        assign_irq_vector(0, cfg, TARGET_CPUS);
+        assign_irq_vector(0, cfg, apic->target_cpus());
 
         /*
          * As IRQ0 is to be enabled in the 8259A, the virtual
@@ -2892,7 +2885,13 @@ static inline void __init check_timer(void)
         apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_EXTINT);
         init_8259A(1);
 #ifdef CONFIG_X86_32
-        timer_ack = (nmi_watchdog == NMI_IO_APIC && !APIC_INTEGRATED(ver));
+        {
+                unsigned int ver;
+
+                ver = apic_read(APIC_LVR);
+                ver = GET_APIC_VERSION(ver);
+                timer_ack = (nmi_watchdog == NMI_IO_APIC && !APIC_INTEGRATED(ver));
+        }
 #endif
 
         pin1  = find_isa_irq_pin(0, mp_INT);
@@ -2931,8 +2930,17 @@ static inline void __init check_timer(void)
                 if (no_pin1) {
                         add_pin_to_irq_cpu(cfg, cpu, apic1, pin1);
                         setup_timer_IRQ0_pin(apic1, pin1, cfg->vector);
+                } else {
+                        /* for edge trigger, setup_IO_APIC_irq already
+                         * leave it unmasked.
+                         * so only need to unmask if it is level-trigger
+                         * do we really have level trigger timer?
+                         */
+                        int idx;
+                        idx = find_irq_entry(apic1, pin1, mp_INT);
+                        if (idx != -1 && irq_trigger(idx))
+                                unmask_IO_APIC_irq_desc(desc);
                 }
-                unmask_IO_APIC_irq_desc(desc);
                 if (timer_irq_works()) {
                         if (nmi_watchdog == NMI_IO_APIC) {
                                 setup_nmi();
@@ -2946,6 +2954,7 @@ static inline void __init check_timer(void)
                 if (intr_remapping_enabled)
                         panic("timer doesn't work through Interrupt-remapped IO-APIC");
 #endif
+                local_irq_disable();
                 clear_IO_APIC_pin(apic1, pin1);
                 if (!no_pin1)
                         apic_printk(APIC_QUIET, KERN_ERR "..MP-BIOS bug: "
@@ -2960,7 +2969,6 @@ static inline void __init check_timer(void)
                  */
                 replace_pin_at_irq_cpu(cfg, cpu, apic1, pin1, apic2, pin2);
                 setup_timer_IRQ0_pin(apic2, pin2, cfg->vector);
-                unmask_IO_APIC_irq_desc(desc);
                 enable_8259A_irq(0);
                 if (timer_irq_works()) {
                         apic_printk(APIC_QUIET, KERN_INFO "....... works.\n");
@@ -2975,6 +2983,7 @@ static inline void __init check_timer(void)
                 /*
                  * Cleanup, just in case ...
                  */
+                local_irq_disable();
                 disable_8259A_irq(0);
                 clear_IO_APIC_pin(apic2, pin2);
                 apic_printk(APIC_QUIET, KERN_INFO "....... failed.\n");
@@ -3000,6 +3009,7 @@ static inline void __init check_timer(void)
                 apic_printk(APIC_QUIET, KERN_INFO "..... works.\n");
                 goto out;
         }
+        local_irq_disable();
         disable_8259A_irq(0);
         apic_write(APIC_LVT0, APIC_LVT_MASKED | APIC_DM_FIXED | cfg->vector);
         apic_printk(APIC_QUIET, KERN_INFO "..... failed.\n");
@@ -3017,6 +3027,7 @@ static inline void __init check_timer(void)
                 apic_printk(APIC_QUIET, KERN_INFO "..... works.\n");
                 goto out;
         }
+        local_irq_disable();
         apic_printk(APIC_QUIET, KERN_INFO "..... failed :(.\n");
         panic("IO-APIC + timer doesn't work!  Boot with apic=debug and send a "
                 "report.  Then try booting with the 'noapic' option.\n");
@@ -3117,8 +3128,8 @@ static int ioapic_resume(struct sys_device *dev)
 
         spin_lock_irqsave(&ioapic_lock, flags);
         reg_00.raw = io_apic_read(dev->id, 0);
-        if (reg_00.bits.ID != mp_ioapics[dev->id].mp_apicid) {
-                reg_00.bits.ID = mp_ioapics[dev->id].mp_apicid;
+        if (reg_00.bits.ID != mp_ioapics[dev->id].apicid) {
+                reg_00.bits.ID = mp_ioapics[dev->id].apicid;
                 io_apic_write(dev->id, 0, reg_00.raw);
         }
         spin_unlock_irqrestore(&ioapic_lock, flags);
@@ -3168,6 +3179,7 @@ static int __init ioapic_init_sysfs(void)
 
 device_initcall(ioapic_init_sysfs);
 
+static int nr_irqs_gsi = NR_IRQS_LEGACY;
 /*
  * Dynamic irq allocate and deallocation
  */
@@ -3182,11 +3194,11 @@ unsigned int create_irq_nr(unsigned int irq_want)
         struct irq_desc *desc_new = NULL;
 
         irq = 0;
-        spin_lock_irqsave(&vector_lock, flags);
-        for (new = irq_want; new < NR_IRQS; new++) {
-                if (platform_legacy_irq(new))
-                        continue;
+        if (irq_want < nr_irqs_gsi)
+                irq_want = nr_irqs_gsi;
 
+        spin_lock_irqsave(&vector_lock, flags);
+        for (new = irq_want; new < nr_irqs; new++) {
                 desc_new = irq_to_desc_alloc_cpu(new, cpu);
                 if (!desc_new) {
                         printk(KERN_INFO "can not get irq_desc for %d\n", new);
@@ -3196,7 +3208,7 @@ unsigned int create_irq_nr(unsigned int irq_want)
 
                 if (cfg_new->vector != 0)
                         continue;
-                if (__assign_irq_vector(new, cfg_new, TARGET_CPUS) == 0)
+                if (__assign_irq_vector(new, cfg_new, apic->target_cpus()) == 0)
                         irq = new;
                 break;
         }
@@ -3211,7 +3223,6 @@ unsigned int create_irq_nr(unsigned int irq_want)
         return irq;
 }
 
-static int nr_irqs_gsi = NR_IRQS_LEGACY;
 int create_irq(void)
 {
         unsigned int irq_want;
@@ -3258,12 +3269,15 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq, struct msi_ms
         int err;
         unsigned dest;
 
+        if (disable_apic)
+                return -ENXIO;
+
         cfg = irq_cfg(irq);
-        err = assign_irq_vector(irq, cfg, TARGET_CPUS);
+        err = assign_irq_vector(irq, cfg, apic->target_cpus());
         if (err)
                 return err;
 
-        dest = cpu_mask_to_apicid_and(cfg->domain, TARGET_CPUS);
+        dest = apic->cpu_mask_to_apicid_and(cfg->domain, apic->target_cpus());
 
 #ifdef CONFIG_INTR_REMAP
         if (irq_remapped(irq)) {
@@ -3277,9 +3291,9 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq, struct msi_ms
                 memset (&irte, 0, sizeof(irte));
 
                 irte.present = 1;
-                irte.dst_mode = INT_DEST_MODE;
+                irte.dst_mode = apic->irq_dest_mode;
                 irte.trigger_mode = 0; /* edge */
-                irte.dlvry_mode = INT_DELIVERY_MODE;
+                irte.dlvry_mode = apic->irq_delivery_mode;
                 irte.vector = cfg->vector;
                 irte.dest_id = IRTE_DEST(dest);
 
@@ -3297,10 +3311,10 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq, struct msi_ms
                 msg->address_hi = MSI_ADDR_BASE_HI;
                 msg->address_lo =
                         MSI_ADDR_BASE_LO |
-                        ((INT_DEST_MODE == 0) ?
+                        ((apic->irq_dest_mode == 0) ?
                                 MSI_ADDR_DEST_MODE_PHYSICAL:
                                 MSI_ADDR_DEST_MODE_LOGICAL) |
-                        ((INT_DELIVERY_MODE != dest_LowestPrio) ?
+                        ((apic->irq_delivery_mode != dest_LowestPrio) ?
                                 MSI_ADDR_REDIRECTION_CPU:
                                 MSI_ADDR_REDIRECTION_LOWPRI) |
                         MSI_ADDR_DEST_ID(dest);
@@ -3308,7 +3322,7 @@ static int msi_compose_msg(struct pci_dev *pdev, unsigned int irq, struct msi_ms
                 msg->data =
                         MSI_DATA_TRIGGER_EDGE |
                         MSI_DATA_LEVEL_ASSERT |
-                        ((INT_DELIVERY_MODE != dest_LowestPrio) ?
+                        ((apic->irq_delivery_mode != dest_LowestPrio) ?
                                 MSI_DATA_DELIVERY_FIXED:
                                 MSI_DATA_DELIVERY_LOWPRI) |
                         MSI_DATA_VECTOR(cfg->vector);
@@ -3463,40 +3477,6 @@ static int setup_msi_irq(struct pci_dev *dev, struct msi_desc *msidesc, int irq)
         return 0;
 }
 
-int arch_setup_msi_irq(struct pci_dev *dev, struct msi_desc *msidesc)
-{
-        unsigned int irq;
-        int ret;
-        unsigned int irq_want;
-
-        irq_want = nr_irqs_gsi;
-        irq = create_irq_nr(irq_want);
-        if (irq == 0)
-                return -1;
-
-#ifdef CONFIG_INTR_REMAP
-        if (!intr_remapping_enabled)
-                goto no_ir;
-
-        ret = msi_alloc_irte(dev, irq, 1);
-        if (ret < 0)
-                goto error;
-no_ir:
-#endif
-        ret = setup_msi_irq(dev, msidesc, irq);
-        if (ret < 0) {
-                destroy_irq(irq);
-                return ret;
-        }
-        return 0;
-
-#ifdef CONFIG_INTR_REMAP
-error:
-        destroy_irq(irq);
-        return ret;
-#endif
-}
-
 int arch_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
 {
         unsigned int irq;
@@ -3513,9 +3493,9 @@ int arch_setup_msi_irqs(struct pci_dev *dev, int nvec, int type)
         sub_handle = 0;
         list_for_each_entry(msidesc, &dev->msi_list, list) {
                 irq = create_irq_nr(irq_want);
-                irq_want++;
                 if (irq == 0)
                         return -1;
+                irq_want = irq + 1;
 #ifdef CONFIG_INTR_REMAP
                 if (!intr_remapping_enabled)
                         goto no_ir;
@@ -3726,13 +3706,17 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
         struct irq_cfg *cfg;
         int err;
 
+        if (disable_apic)
+                return -ENXIO;
+
         cfg = irq_cfg(irq);
-        err = assign_irq_vector(irq, cfg, TARGET_CPUS);
+        err = assign_irq_vector(irq, cfg, apic->target_cpus());
         if (!err) {
                 struct ht_irq_msg msg;
                 unsigned dest;
 
-                dest = cpu_mask_to_apicid_and(cfg->domain, TARGET_CPUS);
+                dest = apic->cpu_mask_to_apicid_and(cfg->domain,
+                                                    apic->target_cpus());
 
                 msg.address_hi = HT_IRQ_HIGH_DEST_ID(dest);
 
@@ -3740,11 +3724,11 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
                         HT_IRQ_LOW_BASE |
                         HT_IRQ_LOW_DEST_ID(dest) |
                         HT_IRQ_LOW_VECTOR(cfg->vector) |
-                        ((INT_DEST_MODE == 0) ?
+                        ((apic->irq_dest_mode == 0) ?
                                 HT_IRQ_LOW_DM_PHYSICAL :
                                 HT_IRQ_LOW_DM_LOGICAL) |
                         HT_IRQ_LOW_RQEOI_EDGE |
-                        ((INT_DELIVERY_MODE != dest_LowestPrio) ?
+                        ((apic->irq_delivery_mode != dest_LowestPrio) ?
                                 HT_IRQ_LOW_MT_FIXED :
                                 HT_IRQ_LOW_MT_ARBITRATED) |
                         HT_IRQ_LOW_IRQ_MASKED;
@@ -3760,7 +3744,7 @@ int arch_setup_ht_irq(unsigned int irq, struct pci_dev *dev)
 }
 #endif /* CONFIG_HT_IRQ */
 
-#ifdef CONFIG_X86_64
+#ifdef CONFIG_X86_UV
 /*
  * Re-target the irq to the specified CPU and enable the specified MMR located
  * on the specified blade to allow the sending of MSIs to the specified CPU.
@@ -3792,12 +3776,12 @@ int arch_enable_uv_irq(char *irq_name, unsigned int irq, int cpu, int mmr_blade,
         BUG_ON(sizeof(struct uv_IO_APIC_route_entry) != sizeof(unsigned long));
 
         entry->vector = cfg->vector;
-        entry->delivery_mode = INT_DELIVERY_MODE;
-        entry->dest_mode = INT_DEST_MODE;
+        entry->delivery_mode = apic->irq_delivery_mode;
+        entry->dest_mode = apic->irq_dest_mode;
         entry->polarity = 0;
         entry->trigger = 0;
         entry->mask = 0;
-        entry->dest = cpu_mask_to_apicid(eligible_cpu);
+        entry->dest = apic->cpu_mask_to_apicid(eligible_cpu);
 
         mmr_pnode = uv_blade_to_pnode(mmr_blade);
         uv_write_global_mmr64(mmr_pnode, mmr_offset, mmr_value);
@@ -3840,16 +3824,48 @@ int __init io_apic_get_redir_entries (int ioapic)
 
 void __init probe_nr_irqs_gsi(void)
 {
-        int idx;
         int nr = 0;
 
-        for (idx = 0; idx < nr_ioapics; idx++)
-                nr += io_apic_get_redir_entries(idx) + 1;
-
-        if (nr > nr_irqs_gsi)
+        nr = acpi_probe_gsi();
+        if (nr > nr_irqs_gsi) {
                 nr_irqs_gsi = nr;
+        } else {
+                /* for acpi=off or acpi is not compiled in */
+                int idx;
+
+                nr = 0;
+                for (idx = 0; idx < nr_ioapics; idx++)
+                        nr += io_apic_get_redir_entries(idx) + 1;
+
+                if (nr > nr_irqs_gsi)
+                        nr_irqs_gsi = nr;
+        }
+
+        printk(KERN_DEBUG "nr_irqs_gsi: %d\n", nr_irqs_gsi);
 }
 
+#ifdef CONFIG_SPARSE_IRQ
+int __init arch_probe_nr_irqs(void)
+{
+        int nr;
+
+        if (nr_irqs > (NR_VECTORS * nr_cpu_ids))
+                nr_irqs = NR_VECTORS * nr_cpu_ids;
+
+        nr = nr_irqs_gsi + 8 * nr_cpu_ids;
+#if defined(CONFIG_PCI_MSI) || defined(CONFIG_HT_IRQ)
+        /*
+         * for MSI and HT dyn irq
+         */
+        nr += nr_irqs_gsi * 16;
+#endif
+        if (nr < nr_irqs)
+                nr_irqs = nr;
+
+        return 0;
+}
+#endif
+
 /* --------------------------------------------------------------------------
                           ACPI-based IOAPIC Configuration
    -------------------------------------------------------------------------- */
@@ -3875,7 +3891,7 @@ int __init io_apic_get_unique_id(int ioapic, int apic_id)
          */
 
         if (physids_empty(apic_id_map))
-                apic_id_map = ioapic_phys_id_map(phys_cpu_present_map);
+                apic_id_map = apic->ioapic_phys_id_map(phys_cpu_present_map);
 
         spin_lock_irqsave(&ioapic_lock, flags);
         reg_00.raw = io_apic_read(ioapic, 0);
@@ -3891,10 +3907,10 @@ int __init io_apic_get_unique_id(int ioapic, int apic_id)
          * Every APIC in a system must have a unique ID or we get lots of nice
          * 'stuck on smp_invalidate_needed IPI wait' messages.
          */
-        if (check_apicid_used(apic_id_map, apic_id)) {
+        if (apic->check_apicid_used(apic_id_map, apic_id)) {
 
                 for (i = 0; i < get_physical_broadcast(); i++) {
-                        if (!check_apicid_used(apic_id_map, i))
+                        if (!apic->check_apicid_used(apic_id_map, i))
                                 break;
                 }
 
@@ -3907,7 +3923,7 @@ int __init io_apic_get_unique_id(int ioapic, int apic_id)
                 apic_id = i;
         }
 
-        tmp = apicid_to_cpu_present(apic_id);
+        tmp = apic->apicid_to_cpu_present(apic_id);
         physids_or(apic_id_map, apic_id_map, tmp);
 
         if (reg_00.bits.ID != apic_id) {
@@ -3984,8 +4000,8 @@ int acpi_get_override_irq(int bus_irq, int *trigger, int *polarity)
                 return -1;
 
         for (i = 0; i < mp_irq_entries; i++)
-                if (mp_irqs[i].mp_irqtype == mp_INT &&
-                    mp_irqs[i].mp_srcbusirq == bus_irq)
+                if (mp_irqs[i].irqtype == mp_INT &&
+                    mp_irqs[i].srcbusirq == bus_irq)
                         break;
         if (i >= mp_irq_entries)
                 return -1;
@@ -4000,7 +4016,7 @@ int acpi_get_override_irq(int bus_irq, int *trigger, int *polarity)
 /*
  * This function currently is only a helper for the i386 smp boot process where
  * we need to reprogram the ioredtbls to cater for the cpus which have come online
- * so mask in all cases should simply be TARGET_CPUS
+ * so mask in all cases should simply be apic->target_cpus()
  */
 #ifdef CONFIG_SMP
 void __init setup_ioapic_dest(void)
@@ -4039,9 +4055,9 @@ void __init setup_ioapic_dest(void)
                          */
                         if (desc->status &
                             (IRQ_NO_BALANCING | IRQ_AFFINITY_SET))
-                                mask = &desc->affinity;
+                                mask = desc->affinity;
                         else
-                                mask = TARGET_CPUS;
+                                mask = apic->target_cpus();
 
 #ifdef CONFIG_INTR_REMAP
                         if (intr_remapping_enabled)
@@ -4100,7 +4116,7 @@ void __init ioapic_init_mappings(void)
         ioapic_res = ioapic_setup_resources();
         for (i = 0; i < nr_ioapics; i++) {
                 if (smp_found_config) {
-                        ioapic_phys = mp_ioapics[i].mp_apicaddr;
+                        ioapic_phys = mp_ioapics[i].apicaddr;
 #ifdef CONFIG_X86_32
                         if (!ioapic_phys) {
                                 printk(KERN_ERR
diff --git a/arch/x86/kernel/ioport.c b/arch/x86/kernel/ioport.c
index b12208f4dfe..e41980a373a 100644
--- a/arch/x86/kernel/ioport.c
+++ b/arch/x86/kernel/ioport.c
@@ -131,9 +131,8 @@ static int do_iopl(unsigned int level, struct pt_regs *regs)
 }
 
 #ifdef CONFIG_X86_32
-asmlinkage long sys_iopl(unsigned long regsp)
+long sys_iopl(struct pt_regs *regs)
 {
-        struct pt_regs *regs = (struct pt_regs *)&regsp;
         unsigned int level = regs->bx;
         struct thread_struct *t = &current->thread;
         int rc;
diff --git a/arch/x86/kernel/ipi.c b/arch/x86/kernel/ipi.c
index 285bbf8831f..dbf5445727a 100644
--- a/arch/x86/kernel/ipi.c
+++ b/arch/x86/kernel/ipi.c
@@ -17,147 +17,121 @@
 #include <asm/mmu_context.h>
 #include <asm/apic.h>
 #include <asm/proto.h>
+#include <asm/ipi.h>
 
-#ifdef CONFIG_X86_32
-#include <mach_apic.h>
-#include <mach_ipi.h>
-
-/*
- * the following functions deal with sending IPIs between CPUs.
- *
- * We use 'broadcast', CPU->CPU IPIs and self-IPIs too.
- */
-
-static inline int __prepare_ICR(unsigned int shortcut, int vector)
+void default_send_IPI_mask_sequence_phys(const struct cpumask *mask, int vector)
 {
-        unsigned int icr = shortcut | APIC_DEST_LOGICAL;
-
-        switch (vector) {
-        default:
-                icr |= APIC_DM_FIXED | vector;
-                break;
-        case NMI_VECTOR:
-                icr |= APIC_DM_NMI;
-                break;
+        unsigned long query_cpu;
+        unsigned long flags;
+
+        /*
+         * Hack. The clustered APIC addressing mode doesn't allow us to send
+         * to an arbitrary mask, so I do a unicast to each CPU instead.
+         * - mbligh
+         */
+        local_irq_save(flags);
+        for_each_cpu(query_cpu, mask) {
+                __default_send_IPI_dest_field(per_cpu(x86_cpu_to_apicid,
+                                query_cpu), vector, APIC_DEST_PHYSICAL);
         }
-        return icr;
+        local_irq_restore(flags);
 }
 
-static inline int __prepare_ICR2(unsigned int mask)
+void default_send_IPI_mask_allbutself_phys(const struct cpumask *mask,
+                                                 int vector)
 {
-        return SET_APIC_DEST_FIELD(mask);
-}
+        unsigned int this_cpu = smp_processor_id();
+        unsigned int query_cpu;
+        unsigned long flags;
 
-void __send_IPI_shortcut(unsigned int shortcut, int vector)
-{
-        /*
-         * Subtle. In the case of the 'never do double writes' workaround
-         * we have to lock out interrupts to be safe.  As we don't care
-         * of the value read we use an atomic rmw access to avoid costly
-         * cli/sti.  Otherwise we use an even cheaper single atomic write
-         * to the APIC.
-         */
-        unsigned int cfg;
+        /* See Hack comment above */
 
-        /*
-         * Wait for idle.
-         */
-        apic_wait_icr_idle();
+        local_irq_save(flags);
+        for_each_cpu(query_cpu, mask) {
+                if (query_cpu == this_cpu)
+                        continue;
+                __default_send_IPI_dest_field(per_cpu(x86_cpu_to_apicid,
+                                 query_cpu), vector, APIC_DEST_PHYSICAL);
+        }
+        local_irq_restore(flags);
+}
 
-        /*
-         * No need to touch the target chip field
-         */
-        cfg = __prepare_ICR(shortcut, vector);
+void default_send_IPI_mask_sequence_logical(const struct cpumask *mask,
+                                                 int vector)
+{
+        unsigned long flags;
+        unsigned int query_cpu;
 
         /*
-         * Send the IPI. The write to APIC_ICR fires this off.
+         * Hack. The clustered APIC addressing mode doesn't allow us to send
+         * to an arbitrary mask, so I do a unicasts to each CPU instead. This
+         * should be modified to do 1 message per cluster ID - mbligh
          */
-        apic_write(APIC_ICR, cfg);
-}
 
-void send_IPI_self(int vector)
-{
-        __send_IPI_shortcut(APIC_DEST_SELF, vector);
+        local_irq_save(flags);
+        for_each_cpu(query_cpu, mask)
+                __default_send_IPI_dest_field(
+                        apic->cpu_to_logical_apicid(query_cpu), vector,
+                        apic->dest_logical);
+        local_irq_restore(flags);
 }
 
-/*
- * This is used to send an IPI with no shorthand notation (the destination is
- * specified in bits 56 to 63 of the ICR).
- */
-static inline void __send_IPI_dest_field(unsigned long mask, int vector)
+void default_send_IPI_mask_allbutself_logical(const struct cpumask *mask,
+                                                 int vector)
 {
-        unsigned long cfg;
-
-        /*
-         * Wait for idle.
-         */
-        if (unlikely(vector == NMI_VECTOR))
-                safe_apic_wait_icr_idle();
-        else
-                apic_wait_icr_idle();
-
-        /*
-         * prepare target chip field
-         */
-        cfg = __prepare_ICR2(mask);
-        apic_write(APIC_ICR2, cfg);
+        unsigned long flags;
+        unsigned int query_cpu;
+        unsigned int this_cpu = smp_processor_id();
 
-        /*
-         * program the ICR
-         */
-        cfg = __prepare_ICR(0, vector);
+        /* See Hack comment above */
 
-        /*
-         * Send the IPI. The write to APIC_ICR fires this off.
-         */
-        apic_write(APIC_ICR, cfg);
+        local_irq_save(flags);
+        for_each_cpu(query_cpu, mask) {
+                if (query_cpu == this_cpu)
+                        continue;
+                __default_send_IPI_dest_field(
+                        apic->cpu_to_logical_apicid(query_cpu), vector,
+                        apic->dest_logical);
+                }
+        local_irq_restore(flags);
 }
 
+#ifdef CONFIG_X86_32
+
 /*
  * This is only used on smaller machines.
  */
-void send_IPI_mask_bitmask(const struct cpumask *cpumask, int vector)
+void default_send_IPI_mask_logical(const struct cpumask *cpumask, int vector)
 {
         unsigned long mask = cpumask_bits(cpumask)[0];
         unsigned long flags;
 
         local_irq_save(flags);
         WARN_ON(mask & ~cpumask_bits(cpu_online_mask)[0]);
-        __send_IPI_dest_field(mask, vector);
+        __default_send_IPI_dest_field(mask, vector, apic->dest_logical);
         local_irq_restore(flags);
 }
 
-void send_IPI_mask_sequence(const struct cpumask *mask, int vector)
+void default_send_IPI_allbutself(int vector)
 {
-        unsigned long flags;
-        unsigned int query_cpu;
-
         /*
-         * Hack. The clustered APIC addressing mode doesn't allow us to send
-         * to an arbitrary mask, so I do a unicasts to each CPU instead. This
-         * should be modified to do 1 message per cluster ID - mbligh
+         * if there are no other CPUs in the system then we get an APIC send
+         * error if we try to broadcast, thus avoid sending IPIs in this case.
          */
+        if (!(num_online_cpus() > 1))
+                return;
 
-        local_irq_save(flags);
-        for_each_cpu(query_cpu, mask)
-                __send_IPI_dest_field(cpu_to_logical_apicid(query_cpu), vector);
-        local_irq_restore(flags);
+        __default_local_send_IPI_allbutself(vector);
 }
 
-void send_IPI_mask_allbutself(const struct cpumask *mask, int vector)
+void default_send_IPI_all(int vector)
 {
-        unsigned long flags;
-        unsigned int query_cpu;
-        unsigned int this_cpu = smp_processor_id();
-
-        /* See Hack comment above */
+        __default_local_send_IPI_all(vector);
+}
 
-        local_irq_save(flags);
-        for_each_cpu(query_cpu, mask)
-                if (query_cpu != this_cpu)
-                        __send_IPI_dest_field(cpu_to_logical_apicid(query_cpu),
-                                              vector);
-        local_irq_restore(flags);
+void default_send_IPI_self(int vector)
+{
+        __default_send_IPI_shortcut(APIC_DEST_SELF, vector, apic->dest_logical);
 }
 
 /* must come after the send_IPI functions above for inlining */
diff --git a/arch/x86/kernel/irq.c b/arch/x86/kernel/irq.c
index 3973e2df7f8..f13ca1650aa 100644
--- a/arch/x86/kernel/irq.c
+++ b/arch/x86/kernel/irq.c
@@ -6,10 +6,12 @@
 #include <linux/kernel_stat.h>
 #include <linux/seq_file.h>
 #include <linux/smp.h>
+#include <linux/ftrace.h>
 
 #include <asm/apic.h>
 #include <asm/io_apic.h>
 #include <asm/irq.h>
+#include <asm/idle.h>
 
 atomic_t irq_err_count;
 
@@ -36,11 +38,7 @@ void ack_bad_irq(unsigned int irq)
 #endif
 }
 
-#ifdef CONFIG_X86_32
-# define irq_stats(x)           (&per_cpu(irq_stat, x))
-#else
-# define irq_stats(x)           cpu_pda(x)
-#endif
+#define irq_stats(x)            (&per_cpu(irq_stat, x))
 /*
  * /proc/interrupts printing:
  */
@@ -192,4 +190,40 @@ u64 arch_irq_stat(void)
         return sum;
 }
 
+
+/*
+ * do_IRQ handles all normal device IRQ's (the special
+ * SMP cross-CPU interrupts have their own specific
+ * handlers).
+ */
+unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
+{
+        struct pt_regs *old_regs = set_irq_regs(regs);
+
+        /* high bit used in ret_from_ code  */
+        unsigned vector = ~regs->orig_ax;
+        unsigned irq;
+
+        exit_idle();
+        irq_enter();
+
+        irq = __get_cpu_var(vector_irq)[vector];
+
+        if (!handle_irq(irq, regs)) {
+#ifdef CONFIG_X86_64
+                if (!disable_apic)
+                        ack_APIC_irq();
+#endif
+
+                if (printk_ratelimit())
+                        printk(KERN_EMERG "%s: %d.%d No irq handler for vector (irq %d)\n",
+                               __func__, smp_processor_id(), vector, irq);
+        }
+
+        irq_exit();
+
+        set_irq_regs(old_regs);
+        return 1;
+}
+
 EXPORT_SYMBOL_GPL(vector_used_by_percpu_irq);
diff --git a/arch/x86/kernel/irq_32.c b/arch/x86/kernel/irq_32.c
index 74b9ff7341e..4beb9a13873 100644
--- a/arch/x86/kernel/irq_32.c
+++ b/arch/x86/kernel/irq_32.c
@@ -191,33 +191,16 @@ static inline int
 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq) { return 0; }
 #endif
 
-/*
- * do_IRQ handles all normal device IRQ's (the special
- * SMP cross-CPU interrupts have their own specific
- * handlers).
- */
-unsigned int do_IRQ(struct pt_regs *regs)
+bool handle_irq(unsigned irq, struct pt_regs *regs)
 {
-        struct pt_regs *old_regs;
-        /* high bit used in ret_from_ code */
-        int overflow;
-        unsigned vector = ~regs->orig_ax;
         struct irq_desc *desc;
-        unsigned irq;
-
-
-        old_regs = set_irq_regs(regs);
-        irq_enter();
-        irq = __get_cpu_var(vector_irq)[vector];
+        int overflow;
 
         overflow = check_stack_overflow();
 
         desc = irq_to_desc(irq);
-        if (unlikely(!desc)) {
-                printk(KERN_EMERG "%s: cannot handle IRQ %d vector %#x cpu %d\n",
-                                        __func__, irq, vector, smp_processor_id());
-                BUG();
-        }
+        if (unlikely(!desc))
+                return false;
 
         if (!execute_on_irq_stack(overflow, desc, irq)) {
                 if (unlikely(overflow))
@@ -225,13 +208,11 @@ unsigned int do_IRQ(struct pt_regs *regs)
                 desc->handle_irq(irq, desc);
         }
 
-        irq_exit();
-        set_irq_regs(old_regs);
-        return 1;
+        return true;
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
-#include <mach_apic.h>
+#include <asm/genapic.h>
 
 /* A cpu has been removed from cpu_online_mask.  Reset irq affinities. */
 void fixup_irqs(void)
@@ -248,7 +229,7 @@ void fixup_irqs(void)
                 if (irq == 2)
                         continue;
 
-                affinity = &desc->affinity;
+                affinity = desc->affinity;
                 if (cpumask_any_and(affinity, cpu_online_mask) >= nr_cpu_ids) {
                         printk("Breaking affinity for irq %i\n", irq);
                         affinity = cpu_all_mask;
diff --git a/arch/x86/kernel/irq_64.c b/arch/x86/kernel/irq_64.c
index 63c88e6ec02..977d8b43a0d 100644
--- a/arch/x86/kernel/irq_64.c
+++ b/arch/x86/kernel/irq_64.c
@@ -18,6 +18,13 @@
 #include <linux/smp.h>
 #include <asm/io_apic.h>
 #include <asm/idle.h>
+#include <asm/apic.h>
+
+DEFINE_PER_CPU_SHARED_ALIGNED(irq_cpustat_t, irq_stat);
+EXPORT_PER_CPU_SYMBOL(irq_stat);
+
+DEFINE_PER_CPU(struct pt_regs *, irq_regs);
+EXPORT_PER_CPU_SYMBOL(irq_regs);
 
 /*
  * Probabilistic stack overflow check:
@@ -41,42 +48,18 @@ static inline void stack_overflow_check(struct pt_regs *regs)
 #endif
 }
 
-/*
- * do_IRQ handles all normal device IRQ's (the special
- * SMP cross-CPU interrupts have their own specific
- * handlers).
- */
-asmlinkage unsigned int __irq_entry do_IRQ(struct pt_regs *regs)
+bool handle_irq(unsigned irq, struct pt_regs *regs)
 {
-        struct pt_regs *old_regs = set_irq_regs(regs);
         struct irq_desc *desc;
 
-        /* high bit used in ret_from_ code  */
-        unsigned vector = ~regs->orig_ax;
-        unsigned irq;
-
-        exit_idle();
-        irq_enter();
-        irq = __get_cpu_var(vector_irq)[vector];
-
         stack_overflow_check(regs);
 
         desc = irq_to_desc(irq);
-        if (likely(desc))
-                generic_handle_irq_desc(irq, desc);
-        else {
-                if (!disable_apic)
-                        ack_APIC_irq();
-
-                if (printk_ratelimit())
-                        printk(KERN_EMERG "%s: %d.%d No irq handler for vector\n",
-                                __func__, smp_processor_id(), vector);
-        }
-
-        irq_exit();
+        if (unlikely(!desc))
+                return false;
 
-        set_irq_regs(old_regs);
-        return 1;
+        generic_handle_irq_desc(irq, desc);
+        return true;
 }
 
 #ifdef CONFIG_HOTPLUG_CPU
@@ -100,7 +83,7 @@ void fixup_irqs(void)
                 /* interrupt's are disabled at this point */
                 spin_lock(&desc->lock);
 
-                affinity = &desc->affinity;
+                affinity = desc->affinity;
                 if (!irq_has_action(irq) ||
                     cpumask_equal(affinity, cpu_online_mask)) {
                         spin_unlock(&desc->lock);
diff --git a/arch/x86/kernel/irqinit_32.c b/arch/x86/kernel/irqinit_32.c
index 1507ad4e674..bf629cadec1 100644
--- a/arch/x86/kernel/irqinit_32.c
+++ b/arch/x86/kernel/irqinit_32.c
@@ -149,8 +149,15 @@ void __init native_init_IRQ(void)
          */
         alloc_intr_gate(RESCHEDULE_VECTOR, reschedule_interrupt);
 
-        /* IPI for invalidation */
-        alloc_intr_gate(INVALIDATE_TLB_VECTOR, invalidate_interrupt);
+        /* IPIs for invalidation */
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+0, invalidate_interrupt0);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+1, invalidate_interrupt1);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+2, invalidate_interrupt2);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+3, invalidate_interrupt3);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+4, invalidate_interrupt4);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+5, invalidate_interrupt5);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+6, invalidate_interrupt6);
+        alloc_intr_gate(INVALIDATE_TLB_VECTOR_START+7, invalidate_interrupt7);
 
         /* IPI for generic function call */
         alloc_intr_gate(CALL_FUNCTION_VECTOR, call_function_interrupt);
diff --git a/arch/x86/kernel/kgdb.c b/arch/x86/kernel/kgdb.c
index 10435a120d2..5c4f5548384 100644
--- a/arch/x86/kernel/kgdb.c
+++ b/arch/x86/kernel/kgdb.c
@@ -46,7 +46,7 @@
 #include <asm/apicdef.h>
 #include <asm/system.h>
 
-#include <mach_ipi.h>
+#include <asm/genapic.h>
 
 /*
  * Put the error code here just in case the user cares:
@@ -347,7 +347,7 @@ void kgdb_post_primary_code(struct pt_regs *regs, int e_vector, int err_code)
  */
 void kgdb_roundup_cpus(unsigned long flags)
 {
-        send_IPI_allbutself(APIC_DM_NMI);
+        apic->send_IPI_allbutself(APIC_DM_NMI);
 }
 #endif
 
diff --git a/arch/x86/kernel/machine_kexec_64.c b/arch/x86/kernel/machine_kexec_64.c
index c43caa3a91f..6993d51b7fd 100644
--- a/arch/x86/kernel/machine_kexec_64.c
+++ b/arch/x86/kernel/machine_kexec_64.c
@@ -18,15 +18,6 @@
 #include <asm/mmu_context.h>
 #include <asm/io.h>
 
-#define PAGE_ALIGNED __attribute__ ((__aligned__(PAGE_SIZE)))
-static u64 kexec_pgd[512] PAGE_ALIGNED;
-static u64 kexec_pud0[512] PAGE_ALIGNED;
-static u64 kexec_pmd0[512] PAGE_ALIGNED;
-static u64 kexec_pte0[512] PAGE_ALIGNED;
-static u64 kexec_pud1[512] PAGE_ALIGNED;
-static u64 kexec_pmd1[512] PAGE_ALIGNED;
-static u64 kexec_pte1[512] PAGE_ALIGNED;
-
 static void init_level2_page(pmd_t *level2p, unsigned long addr)
 {
         unsigned long end_addr;
@@ -107,12 +98,65 @@ out:
         return result;
 }
 
+static void free_transition_pgtable(struct kimage *image)
+{
+        free_page((unsigned long)image->arch.pud);
+        free_page((unsigned long)image->arch.pmd);
+        free_page((unsigned long)image->arch.pte);
+}
+
+static int init_transition_pgtable(struct kimage *image, pgd_t *pgd)
+{
+        pud_t *pud;
+        pmd_t *pmd;
+        pte_t *pte;
+        unsigned long vaddr, paddr;
+        int result = -ENOMEM;
+
+        vaddr = (unsigned long)relocate_kernel;
+        paddr = __pa(page_address(image->control_code_page)+PAGE_SIZE);
+        pgd += pgd_index(vaddr);
+        if (!pgd_present(*pgd)) {
+                pud = (pud_t *)get_zeroed_page(GFP_KERNEL);
+                if (!pud)
+                        goto err;
+                image->arch.pud = pud;
+                set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE));
+        }
+        pud = pud_offset(pgd, vaddr);
+        if (!pud_present(*pud)) {
+                pmd = (pmd_t *)get_zeroed_page(GFP_KERNEL);
+                if (!pmd)
+                        goto err;
+                image->arch.pmd = pmd;
+                set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE));
+        }
+        pmd = pmd_offset(pud, vaddr);
+        if (!pmd_present(*pmd)) {
+                pte = (pte_t *)get_zeroed_page(GFP_KERNEL);
+                if (!pte)
+                        goto err;
+                image->arch.pte = pte;
+                set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
+        }
+        pte = pte_offset_kernel(pmd, vaddr);
+        set_pte(pte, pfn_pte(paddr >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
+        return 0;
+err:
+        free_transition_pgtable(image);
+        return result;
+}
+
 
 static int init_pgtable(struct kimage *image, unsigned long start_pgtable)
 {
         pgd_t *level4p;
+        int result;
         level4p = (pgd_t *)__va(start_pgtable);
-        return init_level4_page(image, level4p, 0, max_pfn << PAGE_SHIFT);
+        result = init_level4_page(image, level4p, 0, max_pfn << PAGE_SHIFT);
+        if (result)
+                return result;
+        return init_transition_pgtable(image, level4p);
 }
 
 static void set_idt(void *newidt, u16 limit)
@@ -174,7 +218,7 @@ int machine_kexec_prepare(struct kimage *image)
 
 void machine_kexec_cleanup(struct kimage *image)
 {
-        return;
+        free_transition_pgtable(image);
 }
 
 /*
@@ -195,22 +239,6 @@ void machine_kexec(struct kimage *image)
         memcpy(control_page, relocate_kernel, PAGE_SIZE);
 
         page_list[PA_CONTROL_PAGE] = virt_to_phys(control_page);
-        page_list[VA_CONTROL_PAGE] = (unsigned long)relocate_kernel;
-        page_list[PA_PGD] = virt_to_phys(&kexec_pgd);
-        page_list[VA_PGD] = (unsigned long)kexec_pgd;
-        page_list[PA_PUD_0] = virt_to_phys(&kexec_pud0);
-        page_list[VA_PUD_0] = (unsigned long)kexec_pud0;
-        page_list[PA_PMD_0] = virt_to_phys(&kexec_pmd0);
-        page_list[VA_PMD_0] = (unsigned long)kexec_pmd0;
-        page_list[PA_PTE_0] = virt_to_phys(&kexec_pte0);
-        page_list[VA_PTE_0] = (unsigned long)kexec_pte0;
-        page_list[PA_PUD_1] = virt_to_phys(&kexec_pud1);
-        page_list[VA_PUD_1] = (unsigned long)kexec_pud1;
-        page_list[PA_PMD_1] = virt_to_phys(&kexec_pmd1);
-        page_list[VA_PMD_1] = (unsigned long)kexec_pmd1;
-        page_list[PA_PTE_1] = virt_to_phys(&kexec_pte1);
-        page_list[VA_PTE_1] = (unsigned long)kexec_pte1;
-
         page_list[PA_TABLE_PAGE] =
           (unsigned long)__pa(page_address(image->control_code_page));
 
diff --git a/arch/x86/kernel/microcode_intel.c b/arch/x86/kernel/microcode_intel.c
index b7f4c929e61..5e9f4fc5138 100644
--- a/arch/x86/kernel/microcode_intel.c
+++ b/arch/x86/kernel/microcode_intel.c
@@ -87,9 +87,9 @@
 #include <linux/cpu.h>
 #include <linux/firmware.h>
 #include <linux/platform_device.h>
+#include <linux/uaccess.h>
 
 #include <asm/msr.h>
-#include <asm/uaccess.h>
 #include <asm/processor.h>
 #include <asm/microcode.h>
 
@@ -196,7 +196,7 @@ static inline int update_match_cpu(struct cpu_signature *csig, int sig, int pf)
         return (!sigmatch(sig, csig->sig, pf, csig->pf)) ? 0 : 1;
 }
 
-static inline int 
+static inline int
 update_match_revision(struct microcode_header_intel *mc_header, int rev)
 {
         return (mc_header->rev <= rev) ? 0 : 1;
@@ -442,8 +442,8 @@ static int request_microcode_fw(int cpu, struct device *device)
                 return ret;
         }
 
-        ret = generic_load_microcode(cpu, (void*)firmware->data, firmware->size,
-                        &get_ucode_fw);
+        ret = generic_load_microcode(cpu, (void *)firmware->data,
+                                     firmware->size, &get_ucode_fw);
 
         release_firmware(firmware);
 
@@ -460,7 +460,7 @@ static int request_microcode_user(int cpu, const void __user *buf, size_t size)
         /* We should bind the task to the CPU */
         BUG_ON(cpu != raw_smp_processor_id());
 
-        return generic_load_microcode(cpu, (void*)buf, size, &get_ucode_user);
+        return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
 }
 
 static void microcode_fini_cpu(int cpu)
diff --git a/arch/x86/kernel/module_32.c b/arch/x86/kernel/module_32.c
index 3db0a5442eb..0edd819050e 100644
--- a/arch/x86/kernel/module_32.c
+++ b/arch/x86/kernel/module_32.c
@@ -42,7 +42,7 @@ void module_free(struct module *mod, void *module_region)
 {
         vfree(module_region);
         /* FIXME: If module_region == mod->init_region, trim exception
-           table entries. */
+           table entries. */
 }
 
 /* We don't need anything special. */
@@ -113,13 +113,13 @@ int module_finalize(const Elf_Ehdr *hdr,
                 *para = NULL;
         char *secstrings = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
 
-        for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) { 
+        for (s = sechdrs; s < sechdrs + hdr->e_shnum; s++) {
                 if (!strcmp(".text", secstrings + s->sh_name))
                         text = s;
                 if (!strcmp(".altinstructions", secstrings + s->sh_name))
                         alt = s;
                 if (!strcmp(".smp_locks", secstrings + s->sh_name))
-                        locks= s;
+                        locks = s;
                 if (!strcmp(".parainstructions", secstrings + s->sh_name))
                         para = s;
         }
diff --git a/arch/x86/kernel/module_64.c b/arch/x86/kernel/module_64.c
index 6ba87830d4b..c23880b90b5 100644
--- a/arch/x86/kernel/module_64.c
+++ b/arch/x86/kernel/module_64.c
@@ -30,14 +30,14 @@
 #include <asm/page.h>
 #include <asm/pgtable.h>
 
-#define DEBUGP(fmt...) 
+#define DEBUGP(fmt...)
 
 #ifndef CONFIG_UML
 void module_free(struct module *mod, void *module_region)
 {
         vfree(module_region);
         /* FIXME: If module_region == mod->init_region, trim exception
-           table entries. */
+           table entries. */
 }
 
 void *module_alloc(unsigned long size)
@@ -77,7 +77,7 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
         Elf64_Rela *rel = (void *)sechdrs[relsec].sh_addr;
         Elf64_Sym *sym;
         void *loc;
-        u64 val; 
+        u64 val;
 
         DEBUGP("Applying relocate section %u to %u\n", relsec,
                sechdrs[relsec].sh_info);
@@ -91,11 +91,11 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                 sym = (Elf64_Sym *)sechdrs[symindex].sh_addr
                         + ELF64_R_SYM(rel[i].r_info);
 
-                DEBUGP("type %d st_value %Lx r_addend %Lx loc %Lx\n",
-                       (int)ELF64_R_TYPE(rel[i].r_info), 
-                       sym->st_value, rel[i].r_addend, (u64)loc);
+                DEBUGP("type %d st_value %Lx r_addend %Lx loc %Lx\n",
+                        (int)ELF64_R_TYPE(rel[i].r_info),
+                        sym->st_value, rel[i].r_addend, (u64)loc);
 
-                val = sym->st_value + rel[i].r_addend; 
+                val = sym->st_value + rel[i].r_addend;
 
                 switch (ELF64_R_TYPE(rel[i].r_info)) {
                 case R_X86_64_NONE:
@@ -113,16 +113,16 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
                         if ((s64)val != *(s32 *)loc)
                                 goto overflow;
                         break;
-                case R_X86_64_PC32: 
+                case R_X86_64_PC32:
                         val -= (u64)loc;
                         *(u32 *)loc = val;
 #if 0
                         if ((s64)val != *(s32 *)loc)
-                                goto overflow; 
+                                goto overflow;
 #endif
                         break;
                 default:
-                        printk(KERN_ERR "module %s: Unknown rela relocation: %Lu\n",
+                        printk(KERN_ERR "module %s: Unknown rela relocation: %llu\n",
                                me->name, ELF64_R_TYPE(rel[i].r_info));
                         return -ENOEXEC;
                 }
@@ -130,7 +130,7 @@ int apply_relocate_add(Elf64_Shdr *sechdrs,
         return 0;
 
 overflow:
-        printk(KERN_ERR "overflow in relocation type %d val %Lx\n", 
+        printk(KERN_ERR "overflow in relocation type %d val %Lx\n",
                (int)ELF64_R_TYPE(rel[i].r_info), val);
         printk(KERN_ERR "`%s' likely not compiled with -mcmodel=kernel\n",
                me->name);
@@ -143,13 +143,13 @@ int apply_relocate(Elf_Shdr *sechdrs,
                    unsigned int relsec,
                    struct module *me)
 {
-        printk("non add relocation not supported\n");
+        printk(KERN_ERR "non add relocation not supported\n");
         return -ENOSYS;
-} 
+}
 
 int module_finalize(const Elf_Ehdr *hdr,
-                    const Elf_Shdr *sechdrs,
-                    struct module *me)
+                    const Elf_Shdr *sechdrs,
+                    struct module *me)
 {
         const Elf_Shdr *s, *text = NULL, *alt = NULL, *locks = NULL,
                 *para = NULL;
@@ -161,7 +161,7 @@ int module_finalize(const Elf_Ehdr *hdr,
                 if (!strcmp(".altinstructions", secstrings + s->sh_name))
                         alt = s;
                 if (!strcmp(".smp_locks", secstrings + s->sh_name))
-                        locks= s;
+                        locks = s;
                 if (!strcmp(".parainstructions", secstrings + s->sh_name))
                         para = s;
         }
diff --git a/arch/x86/kernel/mpparse.c b/arch/x86/kernel/mpparse.c
index a649a4ccad4..20076445319 100644
--- a/arch/x86/kernel/mpparse.c
+++ b/arch/x86/kernel/mpparse.c
@@ -3,7 +3,7 @@
  *      compliant MP-table parsing routines.
  *
  *      (c) 1995 Alan Cox, Building #3 <alan@lxorguk.ukuu.org.uk>
- *      (c) 1998, 1999, 2000 Ingo Molnar <mingo@redhat.com>
+ *      (c) 1998, 1999, 2000, 2009 Ingo Molnar <mingo@redhat.com>
  *      (c) 2008 Alexey Starikovskiy <astarikovskiy@suse.de>
  */
 
@@ -29,12 +29,7 @@
 #include <asm/setup.h>
 #include <asm/smp.h>
 
-#include <mach_apic.h>
-#ifdef CONFIG_X86_32
-#include <mach_apicdef.h>
-#include <mach_mpparse.h>
-#endif
-
+#include <asm/genapic.h>
 /*
  * Checksum an MP configuration block.
  */
@@ -144,11 +139,11 @@ static void __init MP_ioapic_info(struct mpc_ioapic *m)
         if (bad_ioapic(m->apicaddr))
                 return;
 
-        mp_ioapics[nr_ioapics].mp_apicaddr = m->apicaddr;
-        mp_ioapics[nr_ioapics].mp_apicid = m->apicid;
-        mp_ioapics[nr_ioapics].mp_type = m->type;
-        mp_ioapics[nr_ioapics].mp_apicver = m->apicver;
-        mp_ioapics[nr_ioapics].mp_flags = m->flags;
+        mp_ioapics[nr_ioapics].apicaddr = m->apicaddr;
+        mp_ioapics[nr_ioapics].apicid = m->apicid;
+        mp_ioapics[nr_ioapics].type = m->type;
+        mp_ioapics[nr_ioapics].apicver = m->apicver;
+        mp_ioapics[nr_ioapics].flags = m->flags;
         nr_ioapics++;
 }
 
@@ -160,55 +155,55 @@ static void print_MP_intsrc_info(struct mpc_intsrc *m)
                 m->srcbusirq, m->dstapic, m->dstirq);
 }
 
-static void __init print_mp_irq_info(struct mp_config_intsrc *mp_irq)
+static void __init print_mp_irq_info(struct mpc_intsrc *mp_irq)
 {
         apic_printk(APIC_VERBOSE, "Int: type %d, pol %d, trig %d, bus %02x,"
                 " IRQ %02x, APIC ID %x, APIC INT %02x\n",
-                mp_irq->mp_irqtype, mp_irq->mp_irqflag & 3,
-                (mp_irq->mp_irqflag >> 2) & 3, mp_irq->mp_srcbus,
-                mp_irq->mp_srcbusirq, mp_irq->mp_dstapic, mp_irq->mp_dstirq);
+                mp_irq->irqtype, mp_irq->irqflag & 3,
+                (mp_irq->irqflag >> 2) & 3, mp_irq->srcbus,
+                mp_irq->srcbusirq, mp_irq->dstapic, mp_irq->dstirq);
 }
 
 static void __init assign_to_mp_irq(struct mpc_intsrc *m,
-                                    struct mp_config_intsrc *mp_irq)
+                                    struct mpc_intsrc *mp_irq)
 {
-        mp_irq->mp_dstapic = m->dstapic;
-        mp_irq->mp_type = m->type;
-        mp_irq->mp_irqtype = m->irqtype;
-        mp_irq->mp_irqflag = m->irqflag;
-        mp_irq->mp_srcbus = m->srcbus;
-        mp_irq->mp_srcbusirq = m->srcbusirq;
-        mp_irq->mp_dstirq = m->dstirq;
+        mp_irq->dstapic = m->dstapic;
+        mp_irq->type = m->type;
+        mp_irq->irqtype = m->irqtype;
+        mp_irq->irqflag = m->irqflag;
+        mp_irq->srcbus = m->srcbus;
+        mp_irq->srcbusirq = m->srcbusirq;
+        mp_irq->dstirq = m->dstirq;
 }
 
-static void __init assign_to_mpc_intsrc(struct mp_config_intsrc *mp_irq,
+static void __init assign_to_mpc_intsrc(struct mpc_intsrc *mp_irq,
                                         struct mpc_intsrc *m)
 {
-        m->dstapic = mp_irq->mp_dstapic;
-        m->type = mp_irq->mp_type;
-        m->irqtype = mp_irq->mp_irqtype;
-        m->irqflag = mp_irq->mp_irqflag;
-        m->srcbus = mp_irq->mp_srcbus;
-        m->srcbusirq = mp_irq->mp_srcbusirq;
-        m->dstirq = mp_irq->mp_dstirq;
+        m->dstapic = mp_irq->dstapic;
+        m->type = mp_irq->type;
+        m->irqtype = mp_irq->irqtype;
+        m->irqflag = mp_irq->irqflag;
+        m->srcbus = mp_irq->srcbus;
+        m->srcbusirq = mp_irq->srcbusirq;
+        m->dstirq = mp_irq->dstirq;
 }
 
-static int __init mp_irq_mpc_intsrc_cmp(struct mp_config_intsrc *mp_irq,
+static int __init mp_irq_mpc_intsrc_cmp(struct mpc_intsrc *mp_irq,
                                         struct mpc_intsrc *m)
 {
-        if (mp_irq->mp_dstapic != m->dstapic)
+        if (mp_irq->dstapic != m->dstapic)
                 return 1;
-        if (mp_irq->mp_type != m->type)
+        if (mp_irq->type != m->type)
                 return 2;
-        if (mp_irq->mp_irqtype != m->irqtype)
+        if (mp_irq->irqtype != m->irqtype)
                 return 3;
-        if (mp_irq->mp_irqflag != m->irqflag)
+        if (mp_irq->irqflag != m->irqflag)
                 return 4;
-        if (mp_irq->mp_srcbus != m->srcbus)
+        if (mp_irq->srcbus != m->srcbus)
                 return 5;
-        if (mp_irq->mp_srcbusirq != m->srcbusirq)
+        if (mp_irq->srcbusirq != m->srcbusirq)
                 return 6;
-        if (mp_irq->mp_dstirq != m->dstirq)
+        if (mp_irq->dstirq != m->dstirq)
                 return 7;
 
         return 0;
@@ -292,16 +287,7 @@ static int __init smp_read_mpc(struct mpc_table *mpc, unsigned early)
                 return 0;
 
 #ifdef CONFIG_X86_32
-        /*
-         * need to make sure summit and es7000's mps_oem_check is safe to be
-         * called early via genericarch 's mps_oem_check
-         */
-        if (early) {
-#ifdef CONFIG_X86_NUMAQ
-                numaq_mps_oem_check(mpc, oem, str);
-#endif
-        } else
-                mps_oem_check(mpc, oem, str);
+        generic_mps_oem_check(mpc, oem, str);
 #endif
         /* save the local APIC address, it might be non-default */
         if (!acpi_lapic)
@@ -386,13 +372,13 @@ static int __init smp_read_mpc(struct mpc_table *mpc, unsigned early)
                         (*x86_quirks->mpc_record)++;
         }
 
-#ifdef CONFIG_X86_GENERICARCH
-       generic_bigsmp_probe();
+#ifdef CONFIG_X86_BIGSMP
+        generic_bigsmp_probe();
 #endif
 
-#ifdef CONFIG_X86_32
-        setup_apic_routing();
-#endif
+        if (apic->setup_apic_routing)
+                apic->setup_apic_routing();
+
         if (!num_processors)
                 printk(KERN_ERR "MPTABLE: no processors registered!\n");
         return num_processors;
@@ -417,7 +403,7 @@ static void __init construct_default_ioirq_mptable(int mpc_default_type)
         intsrc.type = MP_INTSRC;
         intsrc.irqflag = 0;     /* conforming */
         intsrc.srcbus = 0;
-        intsrc.dstapic = mp_ioapics[0].mp_apicid;
+        intsrc.dstapic = mp_ioapics[0].apicid;
 
         intsrc.irqtype = mp_INT;
 
@@ -570,14 +556,14 @@ static inline void __init construct_default_ISA_mptable(int mpc_default_type)
         }
 }
 
-static struct intel_mp_floating *mpf_found;
+static struct mpf_intel *mpf_found;
 
 /*
  * Scan the memory blocks for an SMP configuration block.
  */
 static void __init __get_smp_config(unsigned int early)
 {
-        struct intel_mp_floating *mpf = mpf_found;
+        struct mpf_intel *mpf = mpf_found;
 
         if (!mpf)
                 return;
@@ -598,9 +584,9 @@ static void __init __get_smp_config(unsigned int early)
         }
 
         printk(KERN_INFO "Intel MultiProcessor Specification v1.%d\n",
-               mpf->mpf_specification);
+               mpf->specification);
 #if defined(CONFIG_X86_LOCAL_APIC) && defined(CONFIG_X86_32)
-        if (mpf->mpf_feature2 & (1 << 7)) {
+        if (mpf->feature2 & (1 << 7)) {
                 printk(KERN_INFO "    IMCR and PIC compatibility mode.\n");
                 pic_mode = 1;
         } else {
@@ -611,7 +597,7 @@ static void __init __get_smp_config(unsigned int early)
         /*
          * Now see if we need to read further.
          */
-        if (mpf->mpf_feature1 != 0) {
+        if (mpf->feature1 != 0) {
                 if (early) {
                         /*
                          * local APIC has default address
@@ -621,16 +607,16 @@ static void __init __get_smp_config(unsigned int early)
                 }
 
                 printk(KERN_INFO "Default MP configuration #%d\n",
-                       mpf->mpf_feature1);
-                construct_default_ISA_mptable(mpf->mpf_feature1);
+                       mpf->feature1);
+                construct_default_ISA_mptable(mpf->feature1);
 
-        } else if (mpf->mpf_physptr) {
+        } else if (mpf->physptr) {
 
                 /*
                  * Read the physical hardware table.  Anything here will
                  * override the defaults.
                  */
-                if (!smp_read_mpc(phys_to_virt(mpf->mpf_physptr), early)) {
+                if (!smp_read_mpc(phys_to_virt(mpf->physptr), early)) {
 #ifdef CONFIG_X86_LOCAL_APIC
                         smp_found_config = 0;
 #endif
@@ -688,32 +674,32 @@ static int __init smp_scan_config(unsigned long base, unsigned long length,
                                   unsigned reserve)
 {
         unsigned int *bp = phys_to_virt(base);
-        struct intel_mp_floating *mpf;
+        struct mpf_intel *mpf;
 
         apic_printk(APIC_VERBOSE, "Scan SMP from %p for %ld bytes.\n",
                         bp, length);
         BUILD_BUG_ON(sizeof(*mpf) != 16);
 
         while (length > 0) {
-                mpf = (struct intel_mp_floating *)bp;
+                mpf = (struct mpf_intel *)bp;
                 if ((*bp == SMP_MAGIC_IDENT) &&
-                    (mpf->mpf_length == 1) &&
+                    (mpf->length == 1) &&
                     !mpf_checksum((unsigned char *)bp, 16) &&
-                    ((mpf->mpf_specification == 1)
-                     || (mpf->mpf_specification == 4))) {
+                    ((mpf->specification == 1)
+                     || (mpf->specification == 4))) {
 #ifdef CONFIG_X86_LOCAL_APIC
                         smp_found_config = 1;
 #endif
                         mpf_found = mpf;
 
-                        printk(KERN_INFO "found SMP MP-table at [%p] %08lx\n",
-                               mpf, virt_to_phys(mpf));
+                        printk(KERN_INFO "found SMP MP-table at [%p] %llx\n",
+                               mpf, (u64)virt_to_phys(mpf));
 
                         if (!reserve)
                                 return 1;
                         reserve_bootmem_generic(virt_to_phys(mpf), PAGE_SIZE,
                                         BOOTMEM_DEFAULT);
-                        if (mpf->mpf_physptr) {
+                        if (mpf->physptr) {
                                 unsigned long size = PAGE_SIZE;
 #ifdef CONFIG_X86_32
                                 /*
@@ -722,14 +708,14 @@ static int __init smp_scan_config(unsigned long base, unsigned long length,
                                  * the bottom is mapped now.
                                  * PC-9800's MPC table places on the very last
                                  * of physical memory; so that simply reserving
-                                 * PAGE_SIZE from mpg->mpf_physptr yields BUG()
+                                 * PAGE_SIZE from mpf->physptr yields BUG()
                                  * in reserve_bootmem.
                                  */
                                 unsigned long end = max_low_pfn * PAGE_SIZE;
-                                if (mpf->mpf_physptr + size > end)
-                                        size = end - mpf->mpf_physptr;
+                                if (mpf->physptr + size > end)
+                                        size = end - mpf->physptr;
 #endif
-                                reserve_bootmem_generic(mpf->mpf_physptr, size,
+                                reserve_bootmem_generic(mpf->physptr, size,
                                                 BOOTMEM_DEFAULT);
                         }
 
@@ -809,15 +795,15 @@ static int  __init get_MP_intsrc_index(struct mpc_intsrc *m)
         /* not legacy */
 
         for (i = 0; i < mp_irq_entries; i++) {
-                if (mp_irqs[i].mp_irqtype != mp_INT)
+                if (mp_irqs[i].irqtype != mp_INT)
                         continue;
 
-                if (mp_irqs[i].mp_irqflag != 0x0f)
+                if (mp_irqs[i].irqflag != 0x0f)
                         continue;
 
-                if (mp_irqs[i].mp_srcbus != m->srcbus)
+                if (mp_irqs[i].srcbus != m->srcbus)
                         continue;
-                if (mp_irqs[i].mp_srcbusirq != m->srcbusirq)
+                if (mp_irqs[i].srcbusirq != m->srcbusirq)
                         continue;
                 if (irq_used[i]) {
                         /* already claimed */
@@ -922,10 +908,10 @@ static int  __init replace_intsrc_all(struct mpc_table *mpc,
                 if (irq_used[i])
                         continue;
 
-                if (mp_irqs[i].mp_irqtype != mp_INT)
+                if (mp_irqs[i].irqtype != mp_INT)
                         continue;
 
-                if (mp_irqs[i].mp_irqflag != 0x0f)
+                if (mp_irqs[i].irqflag != 0x0f)
                         continue;
 
                 if (nr_m_spare > 0) {
@@ -1001,7 +987,7 @@ static int __init update_mp_table(void)
 {
         char str[16];
         char oem[10];
-        struct intel_mp_floating *mpf;
+        struct mpf_intel *mpf;
         struct mpc_table *mpc, *mpc_new;
 
         if (!enable_update_mptable)
@@ -1014,19 +1000,19 @@ static int __init update_mp_table(void)
         /*
          * Now see if we need to go further.
          */
-        if (mpf->mpf_feature1 != 0)
+        if (mpf->feature1 != 0)
                 return 0;
 
-        if (!mpf->mpf_physptr)
+        if (!mpf->physptr)
                 return 0;
 
-        mpc = phys_to_virt(mpf->mpf_physptr);
+        mpc = phys_to_virt(mpf->physptr);
 
         if (!smp_check_mpc(mpc, oem, str))
                 return 0;
 
-        printk(KERN_INFO "mpf: %lx\n", virt_to_phys(mpf));
-        printk(KERN_INFO "mpf_physptr: %x\n", mpf->mpf_physptr);
+        printk(KERN_INFO "mpf: %llx\n", (u64)virt_to_phys(mpf));
+        printk(KERN_INFO "physptr: %x\n", mpf->physptr);
 
         if (mpc_new_phys && mpc->length > mpc_new_length) {
                 mpc_new_phys = 0;
@@ -1047,23 +1033,23 @@ static int __init update_mp_table(void)
                 }
                 printk(KERN_INFO "use in-positon replacing\n");
         } else {
-                mpf->mpf_physptr = mpc_new_phys;
+                mpf->physptr = mpc_new_phys;
                 mpc_new = phys_to_virt(mpc_new_phys);
                 memcpy(mpc_new, mpc, mpc->length);
                 mpc = mpc_new;
                 /* check if we can modify that */
-                if (mpc_new_phys - mpf->mpf_physptr) {
-                        struct intel_mp_floating *mpf_new;
+                if (mpc_new_phys - mpf->physptr) {
+                        struct mpf_intel *mpf_new;
                         /* steal 16 bytes from [0, 1k) */
                         printk(KERN_INFO "mpf new: %x\n", 0x400 - 16);
                         mpf_new = phys_to_virt(0x400 - 16);
                         memcpy(mpf_new, mpf, 16);
                         mpf = mpf_new;
-                        mpf->mpf_physptr = mpc_new_phys;
+                        mpf->physptr = mpc_new_phys;
                 }
-                mpf->mpf_checksum = 0;
-                mpf->mpf_checksum -= mpf_checksum((unsigned char *)mpf, 16);
-                printk(KERN_INFO "mpf_physptr new: %x\n", mpf->mpf_physptr);
+                mpf->checksum = 0;
+                mpf->checksum -= mpf_checksum((unsigned char *)mpf, 16);
+                printk(KERN_INFO "physptr new: %x\n", mpf->physptr);
         }
 
         /*
diff --git a/arch/x86/kernel/msr.c b/arch/x86/kernel/msr.c
index 726266695b2..3cf3413ec62 100644
--- a/arch/x86/kernel/msr.c
+++ b/arch/x86/kernel/msr.c
@@ -35,10 +35,10 @@
 #include <linux/device.h>
 #include <linux/cpu.h>
 #include <linux/notifier.h>
+#include <linux/uaccess.h>
 
 #include <asm/processor.h>
 #include <asm/msr.h>
-#include <asm/uaccess.h>
 #include <asm/system.h>
 
 static struct class *msr_class;
diff --git a/arch/x86/kernel/nmi.c b/arch/x86/kernel/nmi.c
index 7228979f1e7..bdfad80c3cf 100644
--- a/arch/x86/kernel/nmi.c
+++ b/arch/x86/kernel/nmi.c
@@ -34,7 +34,7 @@
 
 #include <asm/mce.h>
 
-#include <mach_traps.h>
+#include <asm/mach_traps.h>
 
 int unknown_nmi_panic;
 int nmi_watchdog_enabled;
@@ -61,11 +61,7 @@ static int endflag __initdata;
 
 static inline unsigned int get_nmi_count(int cpu)
 {
-#ifdef CONFIG_X86_64
-        return cpu_pda(cpu)->__nmi_count;
-#else
-        return nmi_count(cpu);
-#endif
+        return per_cpu(irq_stat, cpu).__nmi_count;
 }
 
 static inline int mce_in_progress(void)
@@ -82,12 +78,8 @@ static inline int mce_in_progress(void)
  */
 static inline unsigned int get_timer_irqs(int cpu)
 {
-#ifdef CONFIG_X86_64
-        return read_pda(apic_timer_irqs) + read_pda(irq0_irqs);
-#else
         return per_cpu(irq_stat, cpu).apic_timer_irqs +
                 per_cpu(irq_stat, cpu).irq0_irqs;
-#endif
 }
 
 #ifdef CONFIG_SMP
diff --git a/arch/x86/kernel/numaq_32.c b/arch/x86/kernel/numaq_32.c
index f2191d4f271..0cc41a1d255 100644
--- a/arch/x86/kernel/numaq_32.c
+++ b/arch/x86/kernel/numaq_32.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2002, IBM Corp.
  *
- * All rights reserved.          
+ * All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -23,17 +23,18 @@
  * Send feedback to <gone@us.ibm.com>
  */
 
-#include <linux/mm.h>
+#include <linux/nodemask.h>
 #include <linux/bootmem.h>
 #include <linux/mmzone.h>
 #include <linux/module.h>
-#include <linux/nodemask.h>
-#include <asm/numaq.h>
-#include <asm/topology.h>
+#include <linux/mm.h>
+
 #include <asm/processor.h>
+#include <asm/topology.h>
 #include <asm/genapic.h>
-#include <asm/e820.h>
+#include <asm/numaq.h>
 #include <asm/setup.h>
+#include <asm/e820.h>
 
 #define MB_TO_PAGES(addr) ((addr) << (20 - PAGE_SHIFT))
 
@@ -91,19 +92,20 @@ static int __init numaq_pre_time_init(void)
 }
 
 int found_numaq;
+
 /*
  * Have to match translation table entries to main table entries by counter
  * hence the mpc_record variable .... can't see a less disgusting way of
  * doing this ....
  */
 struct mpc_config_translation {
-        unsigned char mpc_type;
-        unsigned char trans_len;
-        unsigned char trans_type;
-        unsigned char trans_quad;
-        unsigned char trans_global;
-        unsigned char trans_local;
-        unsigned short trans_reserved;
+        unsigned char           mpc_type;
+        unsigned char           trans_len;
+        unsigned char           trans_type;
+        unsigned char           trans_quad;
+        unsigned char           trans_global;
+        unsigned char           trans_local;
+        unsigned short          trans_reserved;
 };
 
 /* x86_quirks member */
@@ -236,7 +238,7 @@ static int __init numaq_setup_ioapic_ids(void)
 
 static int __init numaq_update_genapic(void)
 {
-        genapic->wakeup_cpu = wakeup_secondary_cpu_via_nmi;
+        apic->wakeup_cpu = wakeup_secondary_cpu_via_nmi;
 
         return 0;
 }
@@ -291,3 +293,280 @@ int __init get_memcfg_numaq(void)
         smp_dump_qct();
         return 1;
 }
+
+/*
+ * APIC driver for the IBM NUMAQ chipset.
+ */
+#define APIC_DEFINITION 1
+#include <linux/threads.h>
+#include <linux/cpumask.h>
+#include <asm/mpspec.h>
+#include <asm/genapic.h>
+#include <asm/fixmap.h>
+#include <asm/apicdef.h>
+#include <asm/ipi.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/init.h>
+#include <linux/numa.h>
+#include <linux/smp.h>
+#include <asm/numaq.h>
+#include <asm/io.h>
+#include <linux/mmzone.h>
+#include <linux/nodemask.h>
+
+#define NUMAQ_APIC_DFR_VALUE    (APIC_DFR_CLUSTER)
+
+static inline unsigned int numaq_get_apic_id(unsigned long x)
+{
+        return (x >> 24) & 0x0F;
+}
+
+static inline void numaq_send_IPI_mask(const struct cpumask *mask, int vector)
+{
+        default_send_IPI_mask_sequence_logical(mask, vector);
+}
+
+static inline void numaq_send_IPI_allbutself(int vector)
+{
+        default_send_IPI_mask_allbutself_logical(cpu_online_mask, vector);
+}
+
+static inline void numaq_send_IPI_all(int vector)
+{
+        numaq_send_IPI_mask(cpu_online_mask, vector);
+}
+
+extern void numaq_mps_oem_check(struct mpc_table *, char *, char *);
+
+#define NUMAQ_TRAMPOLINE_PHYS_LOW (0x8)
+#define NUMAQ_TRAMPOLINE_PHYS_HIGH (0xa)
+
+/*
+ * Because we use NMIs rather than the INIT-STARTUP sequence to
+ * bootstrap the CPUs, the APIC may be in a weird state. Kick it:
+ */
+static inline void numaq_smp_callin_clear_local_apic(void)
+{
+        clear_local_APIC();
+}
+
+static inline void
+numaq_store_NMI_vector(unsigned short *high, unsigned short *low)
+{
+        printk("Storing NMI vector\n");
+        *high =
+          *((volatile unsigned short *)phys_to_virt(NUMAQ_TRAMPOLINE_PHYS_HIGH));
+        *low =
+          *((volatile unsigned short *)phys_to_virt(NUMAQ_TRAMPOLINE_PHYS_LOW));
+}
+
+static inline const cpumask_t *numaq_target_cpus(void)
+{
+        return &CPU_MASK_ALL;
+}
+
+static inline unsigned long
+numaq_check_apicid_used(physid_mask_t bitmap, int apicid)
+{
+        return physid_isset(apicid, bitmap);
+}
+
+static inline unsigned long numaq_check_apicid_present(int bit)
+{
+        return physid_isset(bit, phys_cpu_present_map);
+}
+
+#define apicid_cluster(apicid) (apicid & 0xF0)
+
+static inline int numaq_apic_id_registered(void)
+{
+        return 1;
+}
+
+static inline void numaq_init_apic_ldr(void)
+{
+        /* Already done in NUMA-Q firmware */
+}
+
+static inline void numaq_setup_apic_routing(void)
+{
+        printk("Enabling APIC mode:  %s.  Using %d I/O APICs\n",
+                "NUMA-Q", nr_ioapics);
+}
+
+/*
+ * Skip adding the timer int on secondary nodes, which causes
+ * a small but painful rift in the time-space continuum.
+ */
+static inline int numaq_multi_timer_check(int apic, int irq)
+{
+        return apic != 0 && irq == 0;
+}
+
+static inline physid_mask_t numaq_ioapic_phys_id_map(physid_mask_t phys_map)
+{
+        /* We don't have a good way to do this yet - hack */
+        return physids_promote(0xFUL);
+}
+
+/* Mapping from cpu number to logical apicid */
+extern u8 cpu_2_logical_apicid[];
+
+static inline int numaq_cpu_to_logical_apicid(int cpu)
+{
+        if (cpu >= nr_cpu_ids)
+                return BAD_APICID;
+        return (int)cpu_2_logical_apicid[cpu];
+}
+
+/*
+ * Supporting over 60 cpus on NUMA-Q requires a locality-dependent
+ * cpu to APIC ID relation to properly interact with the intelligent
+ * mode of the cluster controller.
+ */
+static inline int numaq_cpu_present_to_apicid(int mps_cpu)
+{
+        if (mps_cpu < 60)
+                return ((mps_cpu >> 2) << 4) | (1 << (mps_cpu & 0x3));
+        else
+                return BAD_APICID;
+}
+
+static inline int numaq_apicid_to_node(int logical_apicid) 
+{
+        return logical_apicid >> 4;
+}
+
+static inline physid_mask_t numaq_apicid_to_cpu_present(int logical_apicid)
+{
+        int node = numaq_apicid_to_node(logical_apicid);
+        int cpu = __ffs(logical_apicid & 0xf);
+
+        return physid_mask_of_physid(cpu + 4*node);
+}
+
+/* Where the IO area was mapped on multiquad, always 0 otherwise */
+void *xquad_portio;
+
+static inline int numaq_check_phys_apicid_present(int boot_cpu_physical_apicid)
+{
+        return 1;
+}
+
+/*
+ * We use physical apicids here, not logical, so just return the default
+ * physical broadcast to stop people from breaking us
+ */
+static inline unsigned int numaq_cpu_mask_to_apicid(const cpumask_t *cpumask)
+{
+        return 0x0F;
+}
+
+static inline unsigned int
+numaq_cpu_mask_to_apicid_and(const struct cpumask *cpumask,
+                             const struct cpumask *andmask)
+{
+        return 0x0F;
+}
+
+/* No NUMA-Q box has a HT CPU, but it can't hurt to use the default code. */
+static inline int numaq_phys_pkg_id(int cpuid_apic, int index_msb)
+{
+        return cpuid_apic >> index_msb;
+}
+static int __numaq_mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
+{
+        numaq_mps_oem_check(mpc, oem, productid);
+        return found_numaq;
+}
+
+static int probe_numaq(void)
+{
+        /* already know from get_memcfg_numaq() */
+        return found_numaq;
+}
+
+static void numaq_vector_allocation_domain(int cpu, cpumask_t *retmask)
+{
+        /* Careful. Some cpus do not strictly honor the set of cpus
+         * specified in the interrupt destination when using lowest
+         * priority interrupt delivery mode.
+         *
+         * In particular there was a hyperthreading cpu observed to
+         * deliver interrupts to the wrong hyperthread when only one
+         * hyperthread was specified in the interrupt desitination.
+         */
+        *retmask = (cpumask_t){ { [0] = APIC_ALL_CPUS, } };
+}
+
+static void numaq_setup_portio_remap(void)
+{
+        int num_quads = num_online_nodes();
+
+        if (num_quads <= 1)
+                return;
+
+        printk("Remapping cross-quad port I/O for %d quads\n", num_quads);
+        xquad_portio = ioremap(XQUAD_PORTIO_BASE, num_quads*XQUAD_PORTIO_QUAD);
+        printk("xquad_portio vaddr 0x%08lx, len %08lx\n",
+                (u_long) xquad_portio, (u_long) num_quads*XQUAD_PORTIO_QUAD);
+}
+
+struct genapic apic_numaq = {
+
+        .name                           = "NUMAQ",
+        .probe                          = probe_numaq,
+        .acpi_madt_oem_check            = NULL,
+        .apic_id_registered             = numaq_apic_id_registered,
+
+        .irq_delivery_mode              = dest_LowestPrio,
+        /* physical delivery on LOCAL quad: */
+        .irq_dest_mode                  = 0,
+
+        .target_cpus                    = numaq_target_cpus,
+        .disable_esr                    = 1,
+        .dest_logical                   = APIC_DEST_LOGICAL,
+        .check_apicid_used              = numaq_check_apicid_used,
+        .check_apicid_present           = numaq_check_apicid_present,
+
+        .vector_allocation_domain       = numaq_vector_allocation_domain,
+        .init_apic_ldr                  = numaq_init_apic_ldr,
+
+        .ioapic_phys_id_map             = numaq_ioapic_phys_id_map,
+        .setup_apic_routing             = numaq_setup_apic_routing,
+        .multi_timer_check              = numaq_multi_timer_check,
+        .apicid_to_node                 = numaq_apicid_to_node,
+        .cpu_to_logical_apicid          = numaq_cpu_to_logical_apicid,
+        .cpu_present_to_apicid          = numaq_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = numaq_apicid_to_cpu_present,
+        .setup_portio_remap             = numaq_setup_portio_remap,
+        .check_phys_apicid_present      = numaq_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = numaq_phys_pkg_id,
+        .mps_oem_check                  = __numaq_mps_oem_check,
+
+        .get_apic_id                    = numaq_get_apic_id,
+        .set_apic_id                    = NULL,
+        .apic_id_mask                   = 0x0F << 24,
+
+        .cpu_mask_to_apicid             = numaq_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = numaq_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = numaq_send_IPI_mask,
+        .send_IPI_mask_allbutself       = NULL,
+        .send_IPI_allbutself            = numaq_send_IPI_allbutself,
+        .send_IPI_all                   = numaq_send_IPI_all,
+        .send_IPI_self                  = default_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = NUMAQ_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = NUMAQ_TRAMPOLINE_PHYS_HIGH,
+
+        /* We don't do anything here because we use NMI's to boot instead */
+        .wait_for_init_deassert         = NULL,
+
+        .smp_callin_clear_local_apic    = numaq_smp_callin_clear_local_apic,
+        .store_NMI_vector               = numaq_store_NMI_vector,
+        .inquire_remote_apic            = NULL,
+};
diff --git a/arch/x86/kernel/paravirt-spinlocks.c b/arch/x86/kernel/paravirt-spinlocks.c
index 95777b0faa7..3a7c5a44082 100644
--- a/arch/x86/kernel/paravirt-spinlocks.c
+++ b/arch/x86/kernel/paravirt-spinlocks.c
@@ -26,13 +26,3 @@ struct pv_lock_ops pv_lock_ops = {
 };
 EXPORT_SYMBOL(pv_lock_ops);
 
-void __init paravirt_use_bytelocks(void)
-{
-#ifdef CONFIG_SMP
-        pv_lock_ops.spin_is_locked = __byte_spin_is_locked;
-        pv_lock_ops.spin_is_contended = __byte_spin_is_contended;
-        pv_lock_ops.spin_lock = __byte_spin_lock;
-        pv_lock_ops.spin_trylock = __byte_spin_trylock;
-        pv_lock_ops.spin_unlock = __byte_spin_unlock;
-#endif
-}
diff --git a/arch/x86/kernel/paravirt.c b/arch/x86/kernel/paravirt.c
index e4c8fb60887..6dc4dca255e 100644
--- a/arch/x86/kernel/paravirt.c
+++ b/arch/x86/kernel/paravirt.c
@@ -44,6 +44,17 @@ void _paravirt_nop(void)
 {
 }
 
+/* identity function, which can be inlined */
+u32 _paravirt_ident_32(u32 x)
+{
+        return x;
+}
+
+u64 _paravirt_ident_64(u64 x)
+{
+        return x;
+}
+
 static void __init default_banner(void)
 {
         printk(KERN_INFO "Booting paravirtualized kernel on %s\n",
@@ -138,9 +149,16 @@ unsigned paravirt_patch_default(u8 type, u16 clobbers, void *insnbuf,
         if (opfunc == NULL)
                 /* If there's no function, patch it with a ud2a (BUG) */
                 ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
-        else if (opfunc == paravirt_nop)
+        else if (opfunc == _paravirt_nop)
                 /* If the operation is a nop, then nop the callsite */
                 ret = paravirt_patch_nop();
+
+        /* identity functions just return their single argument */
+        else if (opfunc == _paravirt_ident_32)
+                ret = paravirt_patch_ident_32(insnbuf, len);
+        else if (opfunc == _paravirt_ident_64)
+                ret = paravirt_patch_ident_64(insnbuf, len);
+
         else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
                  type == PARAVIRT_PATCH(pv_cpu_ops.irq_enable_sysexit) ||
                  type == PARAVIRT_PATCH(pv_cpu_ops.usergs_sysret32) ||
@@ -268,6 +286,32 @@ enum paravirt_lazy_mode paravirt_get_lazy_mode(void)
         return __get_cpu_var(paravirt_lazy_mode);
 }
 
+void arch_flush_lazy_mmu_mode(void)
+{
+        preempt_disable();
+
+        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_MMU) {
+                WARN_ON(preempt_count() == 1);
+                arch_leave_lazy_mmu_mode();
+                arch_enter_lazy_mmu_mode();
+        }
+
+        preempt_enable();
+}
+
+void arch_flush_lazy_cpu_mode(void)
+{
+        preempt_disable();
+
+        if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU) {
+                WARN_ON(preempt_count() == 1);
+                arch_leave_lazy_cpu_mode();
+                arch_enter_lazy_cpu_mode();
+        }
+
+        preempt_enable();
+}
+
 struct pv_info pv_info = {
         .name = "bare hardware",
         .paravirt_enabled = 0,
@@ -292,10 +336,10 @@ struct pv_time_ops pv_time_ops = {
 
 struct pv_irq_ops pv_irq_ops = {
         .init_IRQ = native_init_IRQ,
-        .save_fl = native_save_fl,
-        .restore_fl = native_restore_fl,
-        .irq_disable = native_irq_disable,
-        .irq_enable = native_irq_enable,
+        .save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
+        .restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
+        .irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
+        .irq_enable = __PV_IS_CALLEE_SAVE(native_irq_enable),
         .safe_halt = native_safe_halt,
         .halt = native_halt,
 #ifdef CONFIG_X86_64
@@ -373,6 +417,14 @@ struct pv_apic_ops pv_apic_ops = {
 #endif
 };
 
+#if defined(CONFIG_X86_32) && !defined(CONFIG_X86_PAE)
+/* 32-bit pagetable entries */
+#define PTE_IDENT       __PV_IS_CALLEE_SAVE(_paravirt_ident_32)
+#else
+/* 64-bit pagetable entries */
+#define PTE_IDENT       __PV_IS_CALLEE_SAVE(_paravirt_ident_64)
+#endif
+
 struct pv_mmu_ops pv_mmu_ops = {
 #ifndef CONFIG_X86_64
         .pagetable_setup_start = native_pagetable_setup_start,
@@ -424,22 +476,23 @@ struct pv_mmu_ops pv_mmu_ops = {
         .pmd_clear = native_pmd_clear,
 #endif
         .set_pud = native_set_pud,
-        .pmd_val = native_pmd_val,
-        .make_pmd = native_make_pmd,
+
+        .pmd_val = PTE_IDENT,
+        .make_pmd = PTE_IDENT,
 
 #if PAGETABLE_LEVELS == 4
-        .pud_val = native_pud_val,
-        .make_pud = native_make_pud,
+        .pud_val = PTE_IDENT,
+        .make_pud = PTE_IDENT,
+
         .set_pgd = native_set_pgd,
 #endif
 #endif /* PAGETABLE_LEVELS >= 3 */
 
-        .pte_val = native_pte_val,
-        .pte_flags = native_pte_flags,
-        .pgd_val = native_pgd_val,
+        .pte_val = PTE_IDENT,
+        .pgd_val = PTE_IDENT,
 
-        .make_pte = native_make_pte,
-        .make_pgd = native_make_pgd,
+        .make_pte = PTE_IDENT,
+        .make_pgd = PTE_IDENT,
 
         .dup_mmap = paravirt_nop,
         .exit_mmap = paravirt_nop,
diff --git a/arch/x86/kernel/paravirt_patch_32.c b/arch/x86/kernel/paravirt_patch_32.c
index 9fe644f4861..d9f32e6d6ab 100644
--- a/arch/x86/kernel/paravirt_patch_32.c
+++ b/arch/x86/kernel/paravirt_patch_32.c
@@ -12,6 +12,18 @@ DEF_NATIVE(pv_mmu_ops, read_cr3, "mov %cr3, %eax");
 DEF_NATIVE(pv_cpu_ops, clts, "clts");
 DEF_NATIVE(pv_cpu_ops, read_tsc, "rdtsc");
 
+unsigned paravirt_patch_ident_32(void *insnbuf, unsigned len)
+{
+        /* arg in %eax, return in %eax */
+        return 0;
+}
+
+unsigned paravirt_patch_ident_64(void *insnbuf, unsigned len)
+{
+        /* arg in %edx:%eax, return in %edx:%eax */
+        return 0;
+}
+
 unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
                       unsigned long addr, unsigned len)
 {
diff --git a/arch/x86/kernel/paravirt_patch_64.c b/arch/x86/kernel/paravirt_patch_64.c
index 061d01df9ae..3f08f34f93e 100644
--- a/arch/x86/kernel/paravirt_patch_64.c
+++ b/arch/x86/kernel/paravirt_patch_64.c
@@ -19,6 +19,21 @@ DEF_NATIVE(pv_cpu_ops, usergs_sysret64, "swapgs; sysretq");
 DEF_NATIVE(pv_cpu_ops, usergs_sysret32, "swapgs; sysretl");
 DEF_NATIVE(pv_cpu_ops, swapgs, "swapgs");
 
+DEF_NATIVE(, mov32, "mov %edi, %eax");
+DEF_NATIVE(, mov64, "mov %rdi, %rax");
+
+unsigned paravirt_patch_ident_32(void *insnbuf, unsigned len)
+{
+        return paravirt_patch_insns(insnbuf, len,
+                                    start__mov32, end__mov32);
+}
+
+unsigned paravirt_patch_ident_64(void *insnbuf, unsigned len)
+{
+        return paravirt_patch_insns(insnbuf, len,
+                                    start__mov64, end__mov64);
+}
+
 unsigned native_patch(u8 type, u16 clobbers, void *ibuf,
                       unsigned long addr, unsigned len)
 {
diff --git a/arch/x86/kernel/probe_32.c b/arch/x86/kernel/probe_32.c
new file mode 100644
index 00000000000..22337b75de6
--- /dev/null
+++ b/arch/x86/kernel/probe_32.c
@@ -0,0 +1,411 @@
+/*
+ * Default generic APIC driver. This handles up to 8 CPUs.
+ *
+ * Copyright 2003 Andi Kleen, SuSE Labs.
+ * Subject to the GNU Public License, v.2
+ *
+ * Generic x86 APIC driver probe layer.
+ */
+#include <linux/threads.h>
+#include <linux/cpumask.h>
+#include <linux/string.h>
+#include <linux/kernel.h>
+#include <linux/ctype.h>
+#include <linux/init.h>
+#include <linux/errno.h>
+#include <asm/fixmap.h>
+#include <asm/mpspec.h>
+#include <asm/apicdef.h>
+#include <asm/genapic.h>
+#include <asm/setup.h>
+
+#include <linux/threads.h>
+#include <linux/cpumask.h>
+#include <asm/mpspec.h>
+#include <asm/genapic.h>
+#include <asm/fixmap.h>
+#include <asm/apicdef.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/smp.h>
+#include <linux/init.h>
+#include <asm/genapic.h>
+#include <asm/ipi.h>
+
+#include <linux/smp.h>
+#include <linux/init.h>
+#include <linux/interrupt.h>
+#include <asm/acpi.h>
+#include <asm/arch_hooks.h>
+#include <asm/e820.h>
+#include <asm/setup.h>
+
+#include <asm/genapic.h>
+
+#ifdef CONFIG_HOTPLUG_CPU
+#define DEFAULT_SEND_IPI        (1)
+#else
+#define DEFAULT_SEND_IPI        (0)
+#endif
+
+int no_broadcast = DEFAULT_SEND_IPI;
+
+#ifdef CONFIG_X86_LOCAL_APIC
+
+static void default_vector_allocation_domain(int cpu, struct cpumask *retmask)
+{
+        /*
+         * Careful. Some cpus do not strictly honor the set of cpus
+         * specified in the interrupt destination when using lowest
+         * priority interrupt delivery mode.
+         *
+         * In particular there was a hyperthreading cpu observed to
+         * deliver interrupts to the wrong hyperthread when only one
+         * hyperthread was specified in the interrupt desitination.
+         */
+        *retmask = (cpumask_t) { { [0] = APIC_ALL_CPUS } };
+}
+
+/* should be called last. */
+static int probe_default(void)
+{
+        return 1;
+}
+
+struct genapic apic_default = {
+
+        .name                           = "default",
+        .probe                          = probe_default,
+        .acpi_madt_oem_check            = NULL,
+        .apic_id_registered             = default_apic_id_registered,
+
+        .irq_delivery_mode              = dest_LowestPrio,
+        /* logical delivery broadcast to all CPUs: */
+        .irq_dest_mode                  = 1,
+
+        .target_cpus                    = default_target_cpus,
+        .disable_esr                    = 0,
+        .dest_logical                   = APIC_DEST_LOGICAL,
+        .check_apicid_used              = default_check_apicid_used,
+        .check_apicid_present           = default_check_apicid_present,
+
+        .vector_allocation_domain       = default_vector_allocation_domain,
+        .init_apic_ldr                  = default_init_apic_ldr,
+
+        .ioapic_phys_id_map             = default_ioapic_phys_id_map,
+        .setup_apic_routing             = default_setup_apic_routing,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = default_apicid_to_node,
+        .cpu_to_logical_apicid          = default_cpu_to_logical_apicid,
+        .cpu_present_to_apicid          = default_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = default_apicid_to_cpu_present,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = default_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = default_phys_pkg_id,
+        .mps_oem_check                  = NULL,
+
+        .get_apic_id                    = default_get_apic_id,
+        .set_apic_id                    = NULL,
+        .apic_id_mask                   = 0x0F << 24,
+
+        .cpu_mask_to_apicid             = default_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = default_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = default_send_IPI_mask_logical,
+        .send_IPI_mask_allbutself       = default_send_IPI_mask_allbutself_logical,
+        .send_IPI_allbutself            = default_send_IPI_allbutself,
+        .send_IPI_all                   = default_send_IPI_all,
+        .send_IPI_self                  = default_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+
+        .wait_for_init_deassert         = default_wait_for_init_deassert,
+
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = default_inquire_remote_apic,
+};
+
+extern struct genapic apic_numaq;
+extern struct genapic apic_summit;
+extern struct genapic apic_bigsmp;
+extern struct genapic apic_es7000;
+extern struct genapic apic_default;
+
+struct genapic *apic = &apic_default;
+
+static struct genapic *apic_probe[] __initdata = {
+#ifdef CONFIG_X86_NUMAQ
+        &apic_numaq,
+#endif
+#ifdef CONFIG_X86_SUMMIT
+        &apic_summit,
+#endif
+#ifdef CONFIG_X86_BIGSMP
+        &apic_bigsmp,
+#endif
+#ifdef CONFIG_X86_ES7000
+        &apic_es7000,
+#endif
+        &apic_default,  /* must be last */
+        NULL,
+};
+
+static int cmdline_apic __initdata;
+static int __init parse_apic(char *arg)
+{
+        int i;
+
+        if (!arg)
+                return -EINVAL;
+
+        for (i = 0; apic_probe[i]; i++) {
+                if (!strcmp(apic_probe[i]->name, arg)) {
+                        apic = apic_probe[i];
+                        cmdline_apic = 1;
+                        return 0;
+                }
+        }
+
+        if (x86_quirks->update_genapic)
+                x86_quirks->update_genapic();
+
+        /* Parsed again by __setup for debug/verbose */
+        return 0;
+}
+early_param("apic", parse_apic);
+
+void __init generic_bigsmp_probe(void)
+{
+#ifdef CONFIG_X86_BIGSMP
+        /*
+         * This routine is used to switch to bigsmp mode when
+         * - There is no apic= option specified by the user
+         * - generic_apic_probe() has chosen apic_default as the sub_arch
+         * - we find more than 8 CPUs in acpi LAPIC listing with xAPIC support
+         */
+
+        if (!cmdline_apic && apic == &apic_default) {
+                if (apic_bigsmp.probe()) {
+                        apic = &apic_bigsmp;
+                        if (x86_quirks->update_genapic)
+                                x86_quirks->update_genapic();
+                        printk(KERN_INFO "Overriding APIC driver with %s\n",
+                               apic->name);
+                }
+        }
+#endif
+}
+
+void __init generic_apic_probe(void)
+{
+        if (!cmdline_apic) {
+                int i;
+                for (i = 0; apic_probe[i]; i++) {
+                        if (apic_probe[i]->probe()) {
+                                apic = apic_probe[i];
+                                break;
+                        }
+                }
+                /* Not visible without early console */
+                if (!apic_probe[i])
+                        panic("Didn't find an APIC driver");
+
+                if (x86_quirks->update_genapic)
+                        x86_quirks->update_genapic();
+        }
+        printk(KERN_INFO "Using APIC driver %s\n", apic->name);
+}
+
+/* These functions can switch the APIC even after the initial ->probe() */
+
+int __init
+generic_mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
+{
+        int i;
+
+        for (i = 0; apic_probe[i]; ++i) {
+                if (!apic_probe[i]->mps_oem_check)
+                        continue;
+                if (!apic_probe[i]->mps_oem_check(mpc, oem, productid))
+                        continue;
+
+                if (!cmdline_apic) {
+                        apic = apic_probe[i];
+                        if (x86_quirks->update_genapic)
+                                x86_quirks->update_genapic();
+                        printk(KERN_INFO "Switched to APIC driver `%s'.\n",
+                               apic->name);
+                }
+                return 1;
+        }
+        return 0;
+}
+
+int __init default_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+{
+        int i;
+
+        for (i = 0; apic_probe[i]; ++i) {
+                if (!apic_probe[i]->acpi_madt_oem_check)
+                        continue;
+                if (!apic_probe[i]->acpi_madt_oem_check(oem_id, oem_table_id))
+                        continue;
+
+                if (!cmdline_apic) {
+                        apic = apic_probe[i];
+                        if (x86_quirks->update_genapic)
+                                x86_quirks->update_genapic();
+                        printk(KERN_INFO "Switched to APIC driver `%s'.\n",
+                               apic->name);
+                }
+                return 1;
+        }
+        return 0;
+}
+
+#endif /* CONFIG_X86_LOCAL_APIC */
+
+/**
+ * pre_intr_init_hook - initialisation prior to setting up interrupt vectors
+ *
+ * Description:
+ *      Perform any necessary interrupt initialisation prior to setting up
+ *      the "ordinary" interrupt call gates.  For legacy reasons, the ISA
+ *      interrupts should be initialised here if the machine emulates a PC
+ *      in any way.
+ **/
+void __init pre_intr_init_hook(void)
+{
+        if (x86_quirks->arch_pre_intr_init) {
+                if (x86_quirks->arch_pre_intr_init())
+                        return;
+        }
+        init_ISA_irqs();
+}
+
+/**
+ * intr_init_hook - post gate setup interrupt initialisation
+ *
+ * Description:
+ *      Fill in any interrupts that may have been left out by the general
+ *      init_IRQ() routine.  interrupts having to do with the machine rather
+ *      than the devices on the I/O bus (like APIC interrupts in intel MP
+ *      systems) are started here.
+ **/
+void __init intr_init_hook(void)
+{
+        if (x86_quirks->arch_intr_init) {
+                if (x86_quirks->arch_intr_init())
+                        return;
+        }
+}
+
+/**
+ * pre_setup_arch_hook - hook called prior to any setup_arch() execution
+ *
+ * Description:
+ *      generally used to activate any machine specific identification
+ *      routines that may be needed before setup_arch() runs.  On Voyager
+ *      this is used to get the board revision and type.
+ **/
+void __init pre_setup_arch_hook(void)
+{
+}
+
+/**
+ * trap_init_hook - initialise system specific traps
+ *
+ * Description:
+ *      Called as the final act of trap_init().  Used in VISWS to initialise
+ *      the various board specific APIC traps.
+ **/
+void __init trap_init_hook(void)
+{
+        if (x86_quirks->arch_trap_init) {
+                if (x86_quirks->arch_trap_init())
+                        return;
+        }
+}
+
+static struct irqaction irq0  = {
+        .handler = timer_interrupt,
+        .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_IRQPOLL,
+        .mask = CPU_MASK_NONE,
+        .name = "timer"
+};
+
+/**
+ * pre_time_init_hook - do any specific initialisations before.
+ *
+ **/
+void __init pre_time_init_hook(void)
+{
+        if (x86_quirks->arch_pre_time_init)
+                x86_quirks->arch_pre_time_init();
+}
+
+/**
+ * time_init_hook - do any specific initialisations for the system timer.
+ *
+ * Description:
+ *      Must plug the system timer interrupt source at HZ into the IRQ listed
+ *      in irq_vectors.h:TIMER_IRQ
+ **/
+void __init time_init_hook(void)
+{
+        if (x86_quirks->arch_time_init) {
+                /*
+                 * A nonzero return code does not mean failure, it means
+                 * that the architecture quirk does not want any
+                 * generic (timer) setup to be performed after this:
+                 */
+                if (x86_quirks->arch_time_init())
+                        return;
+        }
+
+        irq0.mask = cpumask_of_cpu(0);
+        setup_irq(0, &irq0);
+}
+
+#ifdef CONFIG_MCA
+/**
+ * mca_nmi_hook - hook into MCA specific NMI chain
+ *
+ * Description:
+ *      The MCA (Microchannel Architecture) has an NMI chain for NMI sources
+ *      along the MCA bus.  Use this to hook into that chain if you will need
+ *      it.
+ **/
+void mca_nmi_hook(void)
+{
+        /*
+         * If I recall correctly, there's a whole bunch of other things that
+         * we can do to check for NMI problems, but that's all I know about
+         * at the moment.
+         */
+        pr_warning("NMI generated from unknown source!\n");
+}
+#endif
+
+static __init int no_ipi_broadcast(char *str)
+{
+        get_option(&str, &no_broadcast);
+        pr_info("Using %s mode\n",
+                no_broadcast ? "No IPI Broadcast" : "IPI Broadcast");
+        return 1;
+}
+__setup("no_ipi_broadcast=", no_ipi_broadcast);
+
+static int __init print_ipi_mode(void)
+{
+        pr_info("Using IPI %s mode\n",
+                no_broadcast ? "No-Shortcut" : "Shortcut");
+        return 0;
+}
+
+late_initcall(print_ipi_mode);
+
diff --git a/arch/x86/kernel/probe_roms_32.c b/arch/x86/kernel/probe_roms_32.c
index 675a48c404a..071e7fea42e 100644
--- a/arch/x86/kernel/probe_roms_32.c
+++ b/arch/x86/kernel/probe_roms_32.c
@@ -18,7 +18,7 @@
 #include <asm/setup.h>
 #include <asm/sections.h>
 #include <asm/io.h>
-#include <setup_arch.h>
+#include <asm/setup_arch.h>
 
 static struct resource system_rom_resource = {
         .name   = "System ROM",
diff --git a/arch/x86/kernel/process.c b/arch/x86/kernel/process.c
index e68bb9e3086..87b69d4fac1 100644
--- a/arch/x86/kernel/process.c
+++ b/arch/x86/kernel/process.c
@@ -180,6 +180,9 @@ void mwait_idle_with_hints(unsigned long ax, unsigned long cx)
 
         trace_power_start(&it, POWER_CSTATE, (ax>>4)+1);
         if (!need_resched()) {
+                if (cpu_has(&current_cpu_data, X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
+
                 __monitor((void *)&current_thread_info()->flags, 0, 0);
                 smp_mb();
                 if (!need_resched())
@@ -194,6 +197,9 @@ static void mwait_idle(void)
         struct power_trace it;
         if (!need_resched()) {
                 trace_power_start(&it, POWER_CSTATE, 1);
+                if (cpu_has(&current_cpu_data, X86_FEATURE_CLFLUSH_MONITOR))
+                        clflush((void *)&current_thread_info()->flags);
+
                 __monitor((void *)&current_thread_info()->flags, 0, 0);
                 smp_mb();
                 if (!need_resched())
@@ -344,7 +350,7 @@ static void c1e_idle(void)
 
 void __cpuinit select_idle_routine(const struct cpuinfo_x86 *c)
 {
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_SMP
         if (pm_idle == poll_idle && smp_num_siblings > 1) {
                 printk(KERN_WARNING "WARNING: polling idle and HT enabled,"
                         " performance may degrade.\n");
diff --git a/arch/x86/kernel/process_32.c b/arch/x86/kernel/process_32.c
index a546f55c77b..fec79ad85dc 100644
--- a/arch/x86/kernel/process_32.c
+++ b/arch/x86/kernel/process_32.c
@@ -11,6 +11,7 @@
 
 #include <stdarg.h>
 
+#include <linux/stackprotector.h>
 #include <linux/cpu.h>
 #include <linux/errno.h>
 #include <linux/sched.h>
@@ -66,9 +67,6 @@ asmlinkage void ret_from_fork(void) __asm__("ret_from_fork");
 DEFINE_PER_CPU(struct task_struct *, current_task) = &init_task;
 EXPORT_PER_CPU_SYMBOL(current_task);
 
-DEFINE_PER_CPU(int, cpu_number);
-EXPORT_PER_CPU_SYMBOL(cpu_number);
-
 /*
  * Return saved PC of a blocked thread.
  */
@@ -94,6 +92,15 @@ void cpu_idle(void)
 {
         int cpu = smp_processor_id();
 
+        /*
+         * If we're the non-boot CPU, nothing set the stack canary up
+         * for us.  CPU0 already has it initialized but no harm in
+         * doing it again.  This is a good place for updating it, as
+         * we wont ever return from this function (so the invalid
+         * canaries already on the stack wont ever trigger).
+         */
+        boot_init_stack_canary();
+
         current_thread_info()->status |= TS_POLLING;
 
         /* endless idle loop with no priority at all */
@@ -111,7 +118,6 @@ void cpu_idle(void)
                                 play_dead();
 
                         local_irq_disable();
-                        __get_cpu_var(irq_stat).idle_timestamp = jiffies;
                         /* Don't trace irqs off for idle */
                         stop_critical_timings();
                         pm_idle();
@@ -135,7 +141,7 @@ void __show_regs(struct pt_regs *regs, int all)
         if (user_mode_vm(regs)) {
                 sp = regs->sp;
                 ss = regs->ss & 0xffff;
-                savesegment(gs, gs);
+                gs = get_user_gs(regs);
         } else {
                 sp = (unsigned long) (&regs->sp);
                 savesegment(ss, ss);
@@ -216,6 +222,7 @@ int kernel_thread(int (*fn)(void *), void *arg, unsigned long flags)
         regs.ds = __USER_DS;
         regs.es = __USER_DS;
         regs.fs = __KERNEL_PERCPU;
+        regs.gs = __KERNEL_STACK_CANARY;
         regs.orig_ax = -1;
         regs.ip = (unsigned long) kernel_thread_helper;
         regs.cs = __KERNEL_CS | get_kernel_rpl();
@@ -308,7 +315,7 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
 
         p->thread.ip = (unsigned long) ret_from_fork;
 
-        savesegment(gs, p->thread.gs);
+        task_user_gs(p) = get_user_gs(regs);
 
         tsk = current;
         if (unlikely(test_tsk_thread_flag(tsk, TIF_IO_BITMAP))) {
@@ -346,7 +353,7 @@ int copy_thread(int nr, unsigned long clone_flags, unsigned long sp,
 void
 start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
 {
-        __asm__("movl %0, %%gs" : : "r"(0));
+        set_user_gs(regs, 0);
         regs->fs                = 0;
         set_fs(USER_DS);
         regs->ds                = __USER_DS;
@@ -543,7 +550,7 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
          * used %fs or %gs (it does not today), or if the kernel is
          * running inside of a hypervisor layer.
          */
-        savesegment(gs, prev->gs);
+        lazy_save_gs(prev->gs);
 
         /*
          * Load the per-thread Thread-Local Storage descriptor.
@@ -589,31 +596,31 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
          * Restore %gs if needed (which is common)
          */
         if (prev->gs | next->gs)
-                loadsegment(gs, next->gs);
+                lazy_load_gs(next->gs);
 
-        x86_write_percpu(current_task, next_p);
+        percpu_write(current_task, next_p);
 
         return prev_p;
 }
 
-asmlinkage int sys_fork(struct pt_regs regs)
+int sys_fork(struct pt_regs *regs)
 {
-        return do_fork(SIGCHLD, regs.sp, &regs, 0, NULL, NULL);
+        return do_fork(SIGCHLD, regs->sp, regs, 0, NULL, NULL);
 }
 
-asmlinkage int sys_clone(struct pt_regs regs)
+int sys_clone(struct pt_regs *regs)
 {
         unsigned long clone_flags;
         unsigned long newsp;
         int __user *parent_tidptr, *child_tidptr;
 
-        clone_flags = regs.bx;
-        newsp = regs.cx;
-        parent_tidptr = (int __user *)regs.dx;
-        child_tidptr = (int __user *)regs.di;
+        clone_flags = regs->bx;
+        newsp = regs->cx;
+        parent_tidptr = (int __user *)regs->dx;
+        child_tidptr = (int __user *)regs->di;
         if (!newsp)
-                newsp = regs.sp;
-        return do_fork(clone_flags, newsp, &regs, 0, parent_tidptr, child_tidptr);
+                newsp = regs->sp;
+        return do_fork(clone_flags, newsp, regs, 0, parent_tidptr, child_tidptr);
 }
 
 /*
@@ -626,27 +633,27 @@ asmlinkage int sys_clone(struct pt_regs regs)
  * do not have enough call-clobbered registers to hold all
  * the information you need.
  */
-asmlinkage int sys_vfork(struct pt_regs regs)
+int sys_vfork(struct pt_regs *regs)
 {
-        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, regs.sp, &regs, 0, NULL, NULL);
+        return do_fork(CLONE_VFORK | CLONE_VM | SIGCHLD, regs->sp, regs, 0, NULL, NULL);
 }
 
 /*
  * sys_execve() executes a new program.
  */
-asmlinkage int sys_execve(struct pt_regs regs)
+int sys_execve(struct pt_regs *regs)
 {
         int error;
         char *filename;
 
-        filename = getname((char __user *) regs.bx);
+        filename = getname((char __user *) regs->bx);
         error = PTR_ERR(filename);
         if (IS_ERR(filename))
                 goto out;
         error = do_execve(filename,
-                        (char __user * __user *) regs.cx,
-                        (char __user * __user *) regs.dx,
-                        &regs);
+                        (char __user * __user *) regs->cx,
+                        (char __user * __user *) regs->dx,
+                        regs);
         if (error == 0) {
                 /* Make sure we don't return using sysenter.. */
                 set_thread_flag(TIF_IRET);
diff --git a/arch/x86/kernel/process_64.c b/arch/x86/kernel/process_64.c
index 416fb9282f4..836ef6575f0 100644
--- a/arch/x86/kernel/process_64.c
+++ b/arch/x86/kernel/process_64.c
@@ -16,6 +16,7 @@
 
 #include <stdarg.h>
 
+#include <linux/stackprotector.h>
 #include <linux/cpu.h>
 #include <linux/errno.h>
 #include <linux/sched.h>
@@ -40,13 +41,13 @@
 #include <linux/uaccess.h>
 #include <linux/io.h>
 #include <linux/ftrace.h>
+#include <linux/dmi.h>
 
 #include <asm/pgtable.h>
 #include <asm/system.h>
 #include <asm/processor.h>
 #include <asm/i387.h>
 #include <asm/mmu_context.h>
-#include <asm/pda.h>
 #include <asm/prctl.h>
 #include <asm/desc.h>
 #include <asm/proto.h>
@@ -57,6 +58,12 @@
 
 asmlinkage extern void ret_from_fork(void);
 
+DEFINE_PER_CPU(struct task_struct *, current_task) = &init_task;
+EXPORT_PER_CPU_SYMBOL(current_task);
+
+DEFINE_PER_CPU(unsigned long, old_rsp);
+static DEFINE_PER_CPU(unsigned char, is_idle);
+
 unsigned long kernel_thread_flags = CLONE_VM | CLONE_UNTRACED;
 
 static ATOMIC_NOTIFIER_HEAD(idle_notifier);
@@ -75,13 +82,13 @@ EXPORT_SYMBOL_GPL(idle_notifier_unregister);
 
 void enter_idle(void)
 {
-        write_pda(isidle, 1);
+        percpu_write(is_idle, 1);
         atomic_notifier_call_chain(&idle_notifier, IDLE_START, NULL);
 }
 
 static void __exit_idle(void)
 {
-        if (test_and_clear_bit_pda(0, isidle) == 0)
+        if (x86_test_and_clear_bit_percpu(0, is_idle) == 0)
                 return;
         atomic_notifier_call_chain(&idle_notifier, IDLE_END, NULL);
 }
@@ -111,6 +118,16 @@ static inline void play_dead(void)
 void cpu_idle(void)
 {
         current_thread_info()->status |= TS_POLLING;
+
+        /*
+         * If we're the non-boot CPU, nothing set the stack canary up
+         * for us.  CPU0 already has it initialized but no harm in
+         * doing it again.  This is a good place for updating it, as
+         * we wont ever return from this function (so the invalid
+         * canaries already on the stack wont ever trigger).
+         */
+        boot_init_stack_canary();
+
         /* endless idle loop with no priority at all */
         while (1) {
                 tick_nohz_stop_sched_tick(1);
@@ -151,14 +168,18 @@ void __show_regs(struct pt_regs *regs, int all)
         unsigned long d0, d1, d2, d3, d6, d7;
         unsigned int fsindex, gsindex;
         unsigned int ds, cs, es;
+        const char *board;
 
         printk("\n");
         print_modules();
-        printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s\n",
+        board = dmi_get_system_info(DMI_PRODUCT_NAME);
+        if (!board)
+                board = "";
+        printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
                 current->pid, current->comm, print_tainted(),
                 init_utsname()->release,
                 (int)strcspn(init_utsname()->version, " "),
-                init_utsname()->version);
+                init_utsname()->version, board);
         printk(KERN_INFO "RIP: %04lx:[<%016lx>] ", regs->cs & 0xffff, regs->ip);
         printk_address(regs->ip, 1);
         printk(KERN_INFO "RSP: %04lx:%016lx  EFLAGS: %08lx\n", regs->ss,
@@ -392,7 +413,7 @@ start_thread(struct pt_regs *regs, unsigned long new_ip, unsigned long new_sp)
         load_gs_index(0);
         regs->ip                = new_ip;
         regs->sp                = new_sp;
-        write_pda(oldrsp, new_sp);
+        percpu_write(old_rsp, new_sp);
         regs->cs                = __USER_CS;
         regs->ss                = __USER_DS;
         regs->flags             = 0x200;
@@ -613,21 +634,13 @@ __switch_to(struct task_struct *prev_p, struct task_struct *next_p)
         /*
          * Switch the PDA and FPU contexts.
          */
-        prev->usersp = read_pda(oldrsp);
-        write_pda(oldrsp, next->usersp);
-        write_pda(pcurrent, next_p);
+        prev->usersp = percpu_read(old_rsp);
+        percpu_write(old_rsp, next->usersp);
+        percpu_write(current_task, next_p);
 
-        write_pda(kernelstack,
+        percpu_write(kernel_stack,
                   (unsigned long)task_stack_page(next_p) +
-                  THREAD_SIZE - PDA_STACKOFFSET);
-#ifdef CONFIG_CC_STACKPROTECTOR
-        write_pda(stack_canary, next_p->stack_canary);
-        /*
-         * Build time only check to make sure the stack_canary is at
-         * offset 40 in the pda; this is a gcc ABI requirement
-         */
-        BUILD_BUG_ON(offsetof(struct x8664_pda, stack_canary) != 40);
-#endif
+                  THREAD_SIZE - KERNEL_STACK_OFFSET);
 
         /*
          * Now maybe reload the debug registers and handle I/O bitmaps
diff --git a/arch/x86/kernel/ptrace.c b/arch/x86/kernel/ptrace.c
index 0a5df5f82fb..d2f7cd5b2c8 100644
--- a/arch/x86/kernel/ptrace.c
+++ b/arch/x86/kernel/ptrace.c
@@ -75,10 +75,7 @@ static inline bool invalid_selector(u16 value)
 static unsigned long *pt_regs_access(struct pt_regs *regs, unsigned long regno)
 {
         BUILD_BUG_ON(offsetof(struct pt_regs, bx) != 0);
-        regno >>= 2;
-        if (regno > FS)
-                --regno;
-        return &regs->bx + regno;
+        return &regs->bx + (regno >> 2);
 }
 
 static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
@@ -90,9 +87,10 @@ static u16 get_segment_reg(struct task_struct *task, unsigned long offset)
         if (offset != offsetof(struct user_regs_struct, gs))
                 retval = *pt_regs_access(task_pt_regs(task), offset);
         else {
-                retval = task->thread.gs;
                 if (task == current)
-                        savesegment(gs, retval);
+                        retval = get_user_gs(task_pt_regs(task));
+                else
+                        retval = task_user_gs(task);
         }
         return retval;
 }
@@ -126,13 +124,10 @@ static int set_segment_reg(struct task_struct *task,
                 break;
 
         case offsetof(struct user_regs_struct, gs):
-                task->thread.gs = value;
                 if (task == current)
-                        /*
-                         * The user-mode %gs is not affected by
-                         * kernel entry, so we must update the CPU.
-                         */
-                        loadsegment(gs, value);
+                        set_user_gs(task_pt_regs(task), value);
+                else
+                        task_user_gs(task) = value;
         }
 
         return 0;
@@ -810,12 +805,16 @@ static void ptrace_bts_untrace(struct task_struct *child)
 
 static void ptrace_bts_detach(struct task_struct *child)
 {
-        if (unlikely(child->bts)) {
-                ds_release_bts(child->bts);
-                child->bts = NULL;
-
-                ptrace_bts_free_buffer(child);
-        }
+        /*
+         * Ptrace_detach() races with ptrace_untrace() in case
+         * the child dies and is reaped by another thread.
+         *
+         * We only do the memory accounting at this point and
+         * leave the buffer deallocation and the bts tracer
+         * release to ptrace_bts_untrace() which will be called
+         * later on with tasklist_lock held.
+         */
+        release_locked_buffer(child->bts_buffer, child->bts_size);
 }
 #else
 static inline void ptrace_bts_fork(struct task_struct *tsk) {}
diff --git a/arch/x86/kernel/reboot.c b/arch/x86/kernel/reboot.c
index 2b46eb41643..32e8f0af292 100644
--- a/arch/x86/kernel/reboot.c
+++ b/arch/x86/kernel/reboot.c
@@ -14,6 +14,7 @@
 #include <asm/reboot.h>
 #include <asm/pci_x86.h>
 #include <asm/virtext.h>
+#include <asm/cpu.h>
 
 #ifdef CONFIG_X86_32
 # include <linux/dmi.h>
@@ -23,7 +24,7 @@
 # include <asm/iommu.h>
 #endif
 
-#include <mach_ipi.h>
+#include <asm/genapic.h>
 
 /*
  * Power off function, if any
@@ -650,7 +651,7 @@ static int crash_nmi_callback(struct notifier_block *self,
 
 static void smp_send_nmi_allbutself(void)
 {
-        send_IPI_allbutself(NMI_VECTOR);
+        apic->send_IPI_allbutself(NMI_VECTOR);
 }
 
 static struct notifier_block crash_nmi_nb = {
diff --git a/arch/x86/kernel/relocate_kernel_64.S b/arch/x86/kernel/relocate_kernel_64.S
index f5afe665a82..b0bbdd4829c 100644
--- a/arch/x86/kernel/relocate_kernel_64.S
+++ b/arch/x86/kernel/relocate_kernel_64.S
@@ -29,122 +29,6 @@ relocate_kernel:
          * %rdx start address
          */
 
-        /* map the control page at its virtual address */
-
-        movq    $0x0000ff8000000000, %r10        /* mask */
-        mov     $(39 - 3), %cl                   /* bits to shift */
-        movq    PTR(VA_CONTROL_PAGE)(%rsi), %r11 /* address to map */
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PGD)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_PUD_0)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        shrq    $9, %r10
-        sub     $9, %cl
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PUD_0)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_PMD_0)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        shrq    $9, %r10
-        sub     $9, %cl
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PMD_0)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_PTE_0)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        shrq    $9, %r10
-        sub     $9, %cl
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PTE_0)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_CONTROL_PAGE)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        /* identity map the control page at its physical address */
-
-        movq    $0x0000ff8000000000, %r10        /* mask */
-        mov     $(39 - 3), %cl                   /* bits to shift */
-        movq    PTR(PA_CONTROL_PAGE)(%rsi), %r11 /* address to map */
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PGD)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_PUD_1)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        shrq    $9, %r10
-        sub     $9, %cl
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PUD_1)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_PMD_1)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        shrq    $9, %r10
-        sub     $9, %cl
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PMD_1)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_PTE_1)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-        shrq    $9, %r10
-        sub     $9, %cl
-
-        movq    %r11, %r9
-        andq    %r10, %r9
-        shrq    %cl, %r9
-
-        movq    PTR(VA_PTE_1)(%rsi), %r8
-        addq    %r8, %r9
-        movq    PTR(PA_CONTROL_PAGE)(%rsi), %r8
-        orq     $PAGE_ATTR, %r8
-        movq    %r8, (%r9)
-
-relocate_new_kernel:
-        /* %rdi indirection_page
-         * %rsi page_list
-         * %rdx start address
-         */
-
         /* zero out flags, and disable interrupts */
         pushq $0
         popfq
@@ -156,9 +40,8 @@ relocate_new_kernel:
         /* get physical address of page table now too */
         movq    PTR(PA_TABLE_PAGE)(%rsi), %rcx
 
-        /* switch to new set of page tables */
-        movq    PTR(PA_PGD)(%rsi), %r9
-        movq    %r9, %cr3
+        /* Switch to the identity mapped page tables */
+        movq    %rcx, %cr3
 
         /* setup a new stack at the end of the physical control page */
         lea     PAGE_SIZE(%r8), %rsp
@@ -194,9 +77,7 @@ identity_mapped:
         jmp 1f
 1:
 
-        /* Switch to the identity mapped page tables,
-         * and flush the TLB.
-        */
+        /* Flush the TLB (needed?) */
         movq    %rcx, %cr3
 
         /* Do the copies */
diff --git a/arch/x86/kernel/setup.c b/arch/x86/kernel/setup.c
index ae0d8042cf6..8fce6c71451 100644
--- a/arch/x86/kernel/setup.c
+++ b/arch/x86/kernel/setup.c
@@ -81,7 +81,7 @@
 #include <asm/io_apic.h>
 #include <asm/ist.h>
 #include <asm/vmi.h>
-#include <setup_arch.h>
+#include <asm/setup_arch.h>
 #include <asm/bios_ebda.h>
 #include <asm/cacheflush.h>
 #include <asm/processor.h>
@@ -89,7 +89,7 @@
 
 #include <asm/system.h>
 #include <asm/vsyscall.h>
-#include <asm/smp.h>
+#include <asm/cpu.h>
 #include <asm/desc.h>
 #include <asm/dma.h>
 #include <asm/iommu.h>
@@ -97,7 +97,7 @@
 #include <asm/mmu_context.h>
 #include <asm/proto.h>
 
-#include <mach_apic.h>
+#include <asm/genapic.h>
 #include <asm/paravirt.h>
 #include <asm/hypervisor.h>
 
@@ -112,6 +112,20 @@
 #define ARCH_SETUP
 #endif
 
+unsigned int boot_cpu_id __read_mostly;
+
+#ifdef CONFIG_X86_64
+int default_cpu_present_to_apicid(int mps_cpu)
+{
+        return __default_cpu_present_to_apicid(mps_cpu);
+}
+
+int default_check_phys_apicid_present(int boot_cpu_physical_apicid)
+{
+        return __default_check_phys_apicid_present(boot_cpu_physical_apicid);
+}
+#endif
+
 #ifndef CONFIG_DEBUG_BOOT_PARAMS
 struct boot_params __initdata boot_params;
 #else
@@ -588,10 +602,9 @@ early_param("elfcorehdr", setup_elfcorehdr);
 
 static int __init default_update_genapic(void)
 {
-#ifdef CONFIG_X86_SMP
-# if defined(CONFIG_X86_GENERICARCH) || defined(CONFIG_X86_64)
-        genapic->wakeup_cpu = wakeup_secondary_cpu_via_init;
-# endif
+#ifdef CONFIG_SMP
+        if (!apic->wakeup_cpu)
+                apic->wakeup_cpu = wakeup_secondary_cpu_via_init;
 #endif
 
         return 0;
@@ -607,7 +620,7 @@ struct x86_quirks *x86_quirks __initdata = &default_x86_quirks;
 static int __init dmi_low_memory_corruption(const struct dmi_system_id *d)
 {
         printk(KERN_NOTICE
-                "%s detected: BIOS may corrupt low RAM, working it around.\n",
+                "%s detected: BIOS may corrupt low RAM, working around it.\n",
                 d->ident);
 
         e820_update_range(0, 0x10000, E820_RAM, E820_RESERVED);
@@ -892,12 +905,11 @@ void __init setup_arch(char **cmdline_p)
          */
         acpi_reserve_bootmem();
 #endif
-#ifdef CONFIG_X86_FIND_SMP_CONFIG
         /*
          * Find and reserve possible boot-time SMP configuration:
          */
         find_smp_config();
-#endif
+
         reserve_crashkernel();
 
 #ifdef CONFIG_X86_64
@@ -924,9 +936,7 @@ void __init setup_arch(char **cmdline_p)
         map_vsyscall();
 #endif
 
-#ifdef CONFIG_X86_GENERICARCH
         generic_apic_probe();
-#endif
 
         early_quirks();
 
diff --git a/arch/x86/kernel/setup_percpu.c b/arch/x86/kernel/setup_percpu.c
index 01161077a49..d992e6cff73 100644
--- a/arch/x86/kernel/setup_percpu.c
+++ b/arch/x86/kernel/setup_percpu.c
@@ -13,145 +13,47 @@
 #include <asm/mpspec.h>
 #include <asm/apicdef.h>
 #include <asm/highmem.h>
+#include <asm/proto.h>
+#include <asm/cpumask.h>
+#include <asm/cpu.h>
+#include <asm/stackprotector.h>
 
-#ifdef CONFIG_X86_LOCAL_APIC
-unsigned int num_processors;
-unsigned disabled_cpus __cpuinitdata;
-/* Processor that is doing the boot up */
-unsigned int boot_cpu_physical_apicid = -1U;
-EXPORT_SYMBOL(boot_cpu_physical_apicid);
-unsigned int max_physical_apicid;
-
-/* Bitmask of physically existing CPUs */
-physid_mask_t phys_cpu_present_map;
-#endif
-
-/* map cpu index to physical APIC ID */
-DEFINE_EARLY_PER_CPU(u16, x86_cpu_to_apicid, BAD_APICID);
-DEFINE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid, BAD_APICID);
-EXPORT_EARLY_PER_CPU_SYMBOL(x86_cpu_to_apicid);
-EXPORT_EARLY_PER_CPU_SYMBOL(x86_bios_cpu_apicid);
-
-#if defined(CONFIG_NUMA) && defined(CONFIG_X86_64)
-#define X86_64_NUMA     1
-
-/* map cpu index to node index */
-DEFINE_EARLY_PER_CPU(int, x86_cpu_to_node_map, NUMA_NO_NODE);
-EXPORT_EARLY_PER_CPU_SYMBOL(x86_cpu_to_node_map);
-
-/* which logical CPUs are on which nodes */
-cpumask_t *node_to_cpumask_map;
-EXPORT_SYMBOL(node_to_cpumask_map);
-
-/* setup node_to_cpumask_map */
-static void __init setup_node_to_cpumask_map(void);
-
+#ifdef CONFIG_DEBUG_PER_CPU_MAPS
+# define DBG(x...) printk(KERN_DEBUG x)
 #else
-static inline void setup_node_to_cpumask_map(void) { }
+# define DBG(x...)
 #endif
 
-#if defined(CONFIG_HAVE_SETUP_PER_CPU_AREA) && defined(CONFIG_X86_SMP)
-/*
- * Copy data used in early init routines from the initial arrays to the
- * per cpu data areas.  These arrays then become expendable and the
- * *_early_ptr's are zeroed indicating that the static arrays are gone.
- */
-static void __init setup_per_cpu_maps(void)
-{
-        int cpu;
+DEFINE_PER_CPU(int, cpu_number);
+EXPORT_PER_CPU_SYMBOL(cpu_number);
 
-        for_each_possible_cpu(cpu) {
-                per_cpu(x86_cpu_to_apicid, cpu) =
-                                early_per_cpu_map(x86_cpu_to_apicid, cpu);
-                per_cpu(x86_bios_cpu_apicid, cpu) =
-                                early_per_cpu_map(x86_bios_cpu_apicid, cpu);
-#ifdef X86_64_NUMA
-                per_cpu(x86_cpu_to_node_map, cpu) =
-                                early_per_cpu_map(x86_cpu_to_node_map, cpu);
+#ifdef CONFIG_X86_64
+#define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
+#else
+#define BOOT_PERCPU_OFFSET 0
 #endif
-        }
 
-        /* indicate the early static arrays will soon be gone */
-        early_per_cpu_ptr(x86_cpu_to_apicid) = NULL;
-        early_per_cpu_ptr(x86_bios_cpu_apicid) = NULL;
-#ifdef X86_64_NUMA
-        early_per_cpu_ptr(x86_cpu_to_node_map) = NULL;
-#endif
-}
+DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
+EXPORT_PER_CPU_SYMBOL(this_cpu_off);
 
-#ifdef CONFIG_X86_32
-/*
- * Great future not-so-futuristic plan: make i386 and x86_64 do it
- * the same way
- */
-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly;
+unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
+        [0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
+};
 EXPORT_SYMBOL(__per_cpu_offset);
-static inline void setup_cpu_pda_map(void) { }
-
-#elif !defined(CONFIG_SMP)
-static inline void setup_cpu_pda_map(void) { }
-
-#else /* CONFIG_SMP && CONFIG_X86_64 */
-
-/*
- * Allocate cpu_pda pointer table and array via alloc_bootmem.
- */
-static void __init setup_cpu_pda_map(void)
-{
-        char *pda;
-        struct x8664_pda **new_cpu_pda;
-        unsigned long size;
-        int cpu;
-
-        size = roundup(sizeof(struct x8664_pda), cache_line_size());
-
-        /* allocate cpu_pda array and pointer table */
-        {
-                unsigned long tsize = nr_cpu_ids * sizeof(void *);
-                unsigned long asize = size * (nr_cpu_ids - 1);
 
-                tsize = roundup(tsize, cache_line_size());
-                new_cpu_pda = alloc_bootmem(tsize + asize);
-                pda = (char *)new_cpu_pda + tsize;
-        }
-
-        /* initialize pointer table to static pda's */
-        for_each_possible_cpu(cpu) {
-                if (cpu == 0) {
-                        /* leave boot cpu pda in place */
-                        new_cpu_pda[0] = cpu_pda(0);
-                        continue;
-                }
-                new_cpu_pda[cpu] = (struct x8664_pda *)pda;
-                new_cpu_pda[cpu]->in_bootmem = 1;
-                pda += size;
-        }
-
-        /* point to new pointer table */
-        _cpu_pda = new_cpu_pda;
-}
-
-#endif /* CONFIG_SMP && CONFIG_X86_64 */
-
-#ifdef CONFIG_X86_64
-
-/* correctly size the local cpu masks */
-static void __init setup_cpu_local_masks(void)
+static inline void setup_percpu_segment(int cpu)
 {
-        alloc_bootmem_cpumask_var(&cpu_initialized_mask);
-        alloc_bootmem_cpumask_var(&cpu_callin_mask);
-        alloc_bootmem_cpumask_var(&cpu_callout_mask);
-        alloc_bootmem_cpumask_var(&cpu_sibling_setup_mask);
-}
-
-#else /* CONFIG_X86_32 */
+#ifdef CONFIG_X86_32
+        struct desc_struct gdt;
 
-static inline void setup_cpu_local_masks(void)
-{
+        pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
+                        0x2 | DESCTYPE_S, 0x8);
+        gdt.s = 1;
+        write_gdt_entry(get_cpu_gdt_table(cpu),
+                        GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
+#endif
 }
 
-#endif /* CONFIG_X86_32 */
-
 /*
  * Great future plan:
  * Declare PDA itself and support (irqstack,tss,pgd) as per cpu data.
@@ -159,18 +61,12 @@ static inline void setup_cpu_local_masks(void)
  */
 void __init setup_per_cpu_areas(void)
 {
-        ssize_t size, old_size;
+        ssize_t size;
         char *ptr;
         int cpu;
-        unsigned long align = 1;
-
-        /* Setup cpu_pda map */
-        setup_cpu_pda_map();
 
         /* Copy section for each CPU (we discard the original) */
-        old_size = PERCPU_ENOUGH_ROOM;
-        align = max_t(unsigned long, PAGE_SIZE, align);
-        size = roundup(old_size, align);
+        size = roundup(PERCPU_ENOUGH_ROOM, PAGE_SIZE);
 
         pr_info("NR_CPUS:%d nr_cpumask_bits:%d nr_cpu_ids:%d nr_node_ids:%d\n",
                 NR_CPUS, nr_cpumask_bits, nr_cpu_ids, nr_node_ids);
@@ -179,30 +75,68 @@ void __init setup_per_cpu_areas(void)
 
         for_each_possible_cpu(cpu) {
 #ifndef CONFIG_NEED_MULTIPLE_NODES
-                ptr = __alloc_bootmem(size, align,
-                                 __pa(MAX_DMA_ADDRESS));
+                ptr = alloc_bootmem_pages(size);
 #else
                 int node = early_cpu_to_node(cpu);
                 if (!node_online(node) || !NODE_DATA(node)) {
-                        ptr = __alloc_bootmem(size, align,
-                                         __pa(MAX_DMA_ADDRESS));
+                        ptr = alloc_bootmem_pages(size);
                         pr_info("cpu %d has no node %d or node-local memory\n",
                                 cpu, node);
                         pr_debug("per cpu data for cpu%d at %016lx\n",
                                  cpu, __pa(ptr));
                 } else {
-                        ptr = __alloc_bootmem_node(NODE_DATA(node), size, align,
-                                                        __pa(MAX_DMA_ADDRESS));
+                        ptr = alloc_bootmem_pages_node(NODE_DATA(node), size);
                         pr_debug("per cpu data for cpu%d on node%d at %016lx\n",
                                 cpu, node, __pa(ptr));
                 }
 #endif
+
+                memcpy(ptr, __per_cpu_load, __per_cpu_end - __per_cpu_start);
                 per_cpu_offset(cpu) = ptr - __per_cpu_start;
-                memcpy(ptr, __per_cpu_start, __per_cpu_end - __per_cpu_start);
+                per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
+                per_cpu(cpu_number, cpu) = cpu;
+                setup_percpu_segment(cpu);
+                setup_stack_canary_segment(cpu);
+                /*
+                 * Copy data used in early init routines from the
+                 * initial arrays to the per cpu data areas.  These
+                 * arrays then become expendable and the *_early_ptr's
+                 * are zeroed indicating that the static arrays are
+                 * gone.
+                 */
+#ifdef CONFIG_X86_LOCAL_APIC
+                per_cpu(x86_cpu_to_apicid, cpu) =
+                        early_per_cpu_map(x86_cpu_to_apicid, cpu);
+                per_cpu(x86_bios_cpu_apicid, cpu) =
+                        early_per_cpu_map(x86_bios_cpu_apicid, cpu);
+#endif
+#ifdef CONFIG_X86_64
+                per_cpu(irq_stack_ptr, cpu) =
+                        per_cpu(irq_stack_union.irq_stack, cpu) +
+                        IRQ_STACK_SIZE - 64;
+#ifdef CONFIG_NUMA
+                per_cpu(x86_cpu_to_node_map, cpu) =
+                        early_per_cpu_map(x86_cpu_to_node_map, cpu);
+#endif
+#endif
+                /*
+                 * Up to this point, the boot CPU has been using .data.init
+                 * area.  Reload any changed state for the boot CPU.
+                 */
+                if (cpu == boot_cpu_id)
+                        switch_to_new_gdt(cpu);
+
+                DBG("PERCPU: cpu %4d %p\n", cpu, ptr);
         }
 
-        /* Setup percpu data maps */
-        setup_per_cpu_maps();
+        /* indicate the early static arrays will soon be gone */
+#ifdef CONFIG_X86_LOCAL_APIC
+        early_per_cpu_ptr(x86_cpu_to_apicid) = NULL;
+        early_per_cpu_ptr(x86_bios_cpu_apicid) = NULL;
+#endif
+#if defined(CONFIG_X86_64) && defined(CONFIG_NUMA)
+        early_per_cpu_ptr(x86_cpu_to_node_map) = NULL;
+#endif
 
         /* Setup node to cpumask map */
         setup_node_to_cpumask_map();
@@ -210,199 +144,3 @@ void __init setup_per_cpu_areas(void)
         /* Setup cpu initialized, callin, callout masks */
         setup_cpu_local_masks();
 }
-
-#endif
-
-#ifdef X86_64_NUMA
-
-/*
- * Allocate node_to_cpumask_map based on number of available nodes
- * Requires node_possible_map to be valid.
- *
- * Note: node_to_cpumask() is not valid until after this is done.
- */
-static void __init setup_node_to_cpumask_map(void)
-{
-        unsigned int node, num = 0;
-        cpumask_t *map;
-
-        /* setup nr_node_ids if not done yet */
-        if (nr_node_ids == MAX_NUMNODES) {
-                for_each_node_mask(node, node_possible_map)
-                        num = node;
-                nr_node_ids = num + 1;
-        }
-
-        /* allocate the map */
-        map = alloc_bootmem_low(nr_node_ids * sizeof(cpumask_t));
-
-        pr_debug("Node to cpumask map at %p for %d nodes\n",
-                 map, nr_node_ids);
-
-        /* node_to_cpumask() will now work */
-        node_to_cpumask_map = map;
-}
-
-void __cpuinit numa_set_node(int cpu, int node)
-{
-        int *cpu_to_node_map = early_per_cpu_ptr(x86_cpu_to_node_map);
-
-        if (cpu_pda(cpu) && node != NUMA_NO_NODE)
-                cpu_pda(cpu)->nodenumber = node;
-
-        if (cpu_to_node_map)
-                cpu_to_node_map[cpu] = node;
-
-        else if (per_cpu_offset(cpu))
-                per_cpu(x86_cpu_to_node_map, cpu) = node;
-
-        else
-                pr_debug("Setting node for non-present cpu %d\n", cpu);
-}
-
-void __cpuinit numa_clear_node(int cpu)
-{
-        numa_set_node(cpu, NUMA_NO_NODE);
-}
-
-#ifndef CONFIG_DEBUG_PER_CPU_MAPS
-
-void __cpuinit numa_add_cpu(int cpu)
-{
-        cpu_set(cpu, node_to_cpumask_map[early_cpu_to_node(cpu)]);
-}
-
-void __cpuinit numa_remove_cpu(int cpu)
-{
-        cpu_clear(cpu, node_to_cpumask_map[cpu_to_node(cpu)]);
-}
-
-#else /* CONFIG_DEBUG_PER_CPU_MAPS */
-
-/*
- * --------- debug versions of the numa functions ---------
- */
-static void __cpuinit numa_set_cpumask(int cpu, int enable)
-{
-        int node = cpu_to_node(cpu);
-        cpumask_t *mask;
-        char buf[64];
-
-        if (node_to_cpumask_map == NULL) {
-                printk(KERN_ERR "node_to_cpumask_map NULL\n");
-                dump_stack();
-                return;
-        }
-
-        mask = &node_to_cpumask_map[node];
-        if (enable)
-                cpu_set(cpu, *mask);
-        else
-                cpu_clear(cpu, *mask);
-
-        cpulist_scnprintf(buf, sizeof(buf), mask);
-        printk(KERN_DEBUG "%s cpu %d node %d: mask now %s\n",
-                enable ? "numa_add_cpu" : "numa_remove_cpu", cpu, node, buf);
-}
-
-void __cpuinit numa_add_cpu(int cpu)
-{
-        numa_set_cpumask(cpu, 1);
-}
-
-void __cpuinit numa_remove_cpu(int cpu)
-{
-        numa_set_cpumask(cpu, 0);
-}
-
-int cpu_to_node(int cpu)
-{
-        if (early_per_cpu_ptr(x86_cpu_to_node_map)) {
-                printk(KERN_WARNING
-                        "cpu_to_node(%d): usage too early!\n", cpu);
-                dump_stack();
-                return early_per_cpu_ptr(x86_cpu_to_node_map)[cpu];
-        }
-        return per_cpu(x86_cpu_to_node_map, cpu);
-}
-EXPORT_SYMBOL(cpu_to_node);
-
-/*
- * Same function as cpu_to_node() but used if called before the
- * per_cpu areas are setup.
- */
-int early_cpu_to_node(int cpu)
-{
-        if (early_per_cpu_ptr(x86_cpu_to_node_map))
-                return early_per_cpu_ptr(x86_cpu_to_node_map)[cpu];
-
-        if (!per_cpu_offset(cpu)) {
-                printk(KERN_WARNING
-                        "early_cpu_to_node(%d): no per_cpu area!\n", cpu);
-                dump_stack();
-                return NUMA_NO_NODE;
-        }
-        return per_cpu(x86_cpu_to_node_map, cpu);
-}
-
-
-/* empty cpumask */
-static const cpumask_t cpu_mask_none;
-
-/*
- * Returns a pointer to the bitmask of CPUs on Node 'node'.
- */
-const cpumask_t *cpumask_of_node(int node)
-{
-        if (node_to_cpumask_map == NULL) {
-                printk(KERN_WARNING
-                        "cpumask_of_node(%d): no node_to_cpumask_map!\n",
-                        node);
-                dump_stack();
-                return (const cpumask_t *)&cpu_online_map;
-        }
-        if (node >= nr_node_ids) {
-                printk(KERN_WARNING
-                        "cpumask_of_node(%d): node > nr_node_ids(%d)\n",
-                        node, nr_node_ids);
-                dump_stack();
-                return &cpu_mask_none;
-        }
-        return &node_to_cpumask_map[node];
-}
-EXPORT_SYMBOL(cpumask_of_node);
-
-/*
- * Returns a bitmask of CPUs on Node 'node'.
- *
- * Side note: this function creates the returned cpumask on the stack
- * so with a high NR_CPUS count, excessive stack space is used.  The
- * node_to_cpumask_ptr function should be used whenever possible.
- */
-cpumask_t node_to_cpumask(int node)
-{
-        if (node_to_cpumask_map == NULL) {
-                printk(KERN_WARNING
-                        "node_to_cpumask(%d): no node_to_cpumask_map!\n", node);
-                dump_stack();
-                return cpu_online_map;
-        }
-        if (node >= nr_node_ids) {
-                printk(KERN_WARNING
-                        "node_to_cpumask(%d): node > nr_node_ids(%d)\n",
-                        node, nr_node_ids);
-                dump_stack();
-                return cpu_mask_none;
-        }
-        return node_to_cpumask_map[node];
-}
-EXPORT_SYMBOL(node_to_cpumask);
-
-/*
- * --------- end of debug versions of the numa functions ---------
- */
-
-#endif /* CONFIG_DEBUG_PER_CPU_MAPS */
-
-#endif /* X86_64_NUMA */
-
diff --git a/arch/x86/kernel/signal.c b/arch/x86/kernel/signal.c
index df0587f24c5..7cdcd16885e 100644
--- a/arch/x86/kernel/signal.c
+++ b/arch/x86/kernel/signal.c
@@ -50,27 +50,23 @@
 # define FIX_EFLAGS     __FIX_EFLAGS
 #endif
 
-#define COPY(x)                 {               \
-        err |= __get_user(regs->x, &sc->x);     \
-}
+#define COPY(x)                 do {                    \
+        get_user_ex(regs->x, &sc->x);                   \
+} while (0)
 
-#define COPY_SEG(seg)           {                       \
-                unsigned short tmp;                     \
-                err |= __get_user(tmp, &sc->seg);       \
-                regs->seg = tmp;                        \
-}
+#define GET_SEG(seg)            ({                      \
+        unsigned short tmp;                             \
+        get_user_ex(tmp, &sc->seg);                     \
+        tmp;                                            \
+})
 
-#define COPY_SEG_CPL3(seg)      {                       \
-                unsigned short tmp;                     \
-                err |= __get_user(tmp, &sc->seg);       \
-                regs->seg = tmp | 3;                    \
-}
+#define COPY_SEG(seg)           do {                    \
+        regs->seg = GET_SEG(seg);                       \
+} while (0)
 
-#define GET_SEG(seg)            {                       \
-                unsigned short tmp;                     \
-                err |= __get_user(tmp, &sc->seg);       \
-                loadsegment(seg, tmp);                  \
-}
+#define COPY_SEG_CPL3(seg)      do {                    \
+        regs->seg = GET_SEG(seg) | 3;                   \
+} while (0)
 
 static int
 restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
@@ -83,45 +79,49 @@ restore_sigcontext(struct pt_regs *regs, struct sigcontext __user *sc,
         /* Always make any pending restarted system calls return -EINTR */
         current_thread_info()->restart_block.fn = do_no_restart_syscall;
 
+        get_user_try {
+
 #ifdef CONFIG_X86_32
-        GET_SEG(gs);
-        COPY_SEG(fs);
-        COPY_SEG(es);
-        COPY_SEG(ds);
+                set_user_gs(regs, GET_SEG(gs));
+                COPY_SEG(fs);
+                COPY_SEG(es);
+                COPY_SEG(ds);
 #endif /* CONFIG_X86_32 */
 
-        COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
-        COPY(dx); COPY(cx); COPY(ip);
+                COPY(di); COPY(si); COPY(bp); COPY(sp); COPY(bx);
+                COPY(dx); COPY(cx); COPY(ip);
 
 #ifdef CONFIG_X86_64
-        COPY(r8);
-        COPY(r9);
-        COPY(r10);
-        COPY(r11);
-        COPY(r12);
-        COPY(r13);
-        COPY(r14);
-        COPY(r15);
+                COPY(r8);
+                COPY(r9);
+                COPY(r10);
+                COPY(r11);
+                COPY(r12);
+                COPY(r13);
+                COPY(r14);
+                COPY(r15);
 #endif /* CONFIG_X86_64 */
 
 #ifdef CONFIG_X86_32
-        COPY_SEG_CPL3(cs);
-        COPY_SEG_CPL3(ss);
+                COPY_SEG_CPL3(cs);
+                COPY_SEG_CPL3(ss);
 #else /* !CONFIG_X86_32 */
-        /* Kernel saves and restores only the CS segment register on signals,
-         * which is the bare minimum needed to allow mixed 32/64-bit code.
-         * App's signal handler can save/restore other segments if needed. */
-        COPY_SEG_CPL3(cs);
+                /* Kernel saves and restores only the CS segment register on signals,
+                 * which is the bare minimum needed to allow mixed 32/64-bit code.
+                 * App's signal handler can save/restore other segments if needed. */
+                COPY_SEG_CPL3(cs);
 #endif /* CONFIG_X86_32 */
 
-        err |= __get_user(tmpflags, &sc->flags);
-        regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
-        regs->orig_ax = -1;             /* disable syscall checks */
+                get_user_ex(tmpflags, &sc->flags);
+                regs->flags = (regs->flags & ~FIX_EFLAGS) | (tmpflags & FIX_EFLAGS);
+                regs->orig_ax = -1;             /* disable syscall checks */
+
+                get_user_ex(buf, &sc->fpstate);
+                err |= restore_i387_xstate(buf);
 
-        err |= __get_user(buf, &sc->fpstate);
-        err |= restore_i387_xstate(buf);
+                get_user_ex(*pax, &sc->ax);
+        } get_user_catch(err);
 
-        err |= __get_user(*pax, &sc->ax);
         return err;
 }
 
@@ -131,57 +131,55 @@ setup_sigcontext(struct sigcontext __user *sc, void __user *fpstate,
 {
         int err = 0;
 
-#ifdef CONFIG_X86_32
-        {
-                unsigned int tmp;
+        put_user_try {
 
-                savesegment(gs, tmp);
-                err |= __put_user(tmp, (unsigned int __user *)&sc->gs);
-        }
-        err |= __put_user(regs->fs, (unsigned int __user *)&sc->fs);
-        err |= __put_user(regs->es, (unsigned int __user *)&sc->es);
-        err |= __put_user(regs->ds, (unsigned int __user *)&sc->ds);
+#ifdef CONFIG_X86_32
+                put_user_ex(get_user_gs(regs), (unsigned int __user *)&sc->gs);
+                put_user_ex(regs->fs, (unsigned int __user *)&sc->fs);
+                put_user_ex(regs->es, (unsigned int __user *)&sc->es);
+                put_user_ex(regs->ds, (unsigned int __user *)&sc->ds);
 #endif /* CONFIG_X86_32 */
 
-        err |= __put_user(regs->di, &sc->di);
-        err |= __put_user(regs->si, &sc->si);
-        err |= __put_user(regs->bp, &sc->bp);
-        err |= __put_user(regs->sp, &sc->sp);
-        err |= __put_user(regs->bx, &sc->bx);
-        err |= __put_user(regs->dx, &sc->dx);
-        err |= __put_user(regs->cx, &sc->cx);
-        err |= __put_user(regs->ax, &sc->ax);
+                put_user_ex(regs->di, &sc->di);
+                put_user_ex(regs->si, &sc->si);
+                put_user_ex(regs->bp, &sc->bp);
+                put_user_ex(regs->sp, &sc->sp);
+                put_user_ex(regs->bx, &sc->bx);
+                put_user_ex(regs->dx, &sc->dx);
+                put_user_ex(regs->cx, &sc->cx);
+                put_user_ex(regs->ax, &sc->ax);
 #ifdef CONFIG_X86_64
-        err |= __put_user(regs->r8, &sc->r8);
-        err |= __put_user(regs->r9, &sc->r9);
-        err |= __put_user(regs->r10, &sc->r10);
-        err |= __put_user(regs->r11, &sc->r11);
-        err |= __put_user(regs->r12, &sc->r12);
-        err |= __put_user(regs->r13, &sc->r13);
-        err |= __put_user(regs->r14, &sc->r14);
-        err |= __put_user(regs->r15, &sc->r15);
+                put_user_ex(regs->r8, &sc->r8);
+                put_user_ex(regs->r9, &sc->r9);
+                put_user_ex(regs->r10, &sc->r10);
+                put_user_ex(regs->r11, &sc->r11);
+                put_user_ex(regs->r12, &sc->r12);
+                put_user_ex(regs->r13, &sc->r13);
+                put_user_ex(regs->r14, &sc->r14);
+                put_user_ex(regs->r15, &sc->r15);
 #endif /* CONFIG_X86_64 */
 
-        err |= __put_user(current->thread.trap_no, &sc->trapno);
-        err |= __put_user(current->thread.error_code, &sc->err);
-        err |= __put_user(regs->ip, &sc->ip);
+                put_user_ex(current->thread.trap_no, &sc->trapno);
+                put_user_ex(current->thread.error_code, &sc->err);
+                put_user_ex(regs->ip, &sc->ip);
 #ifdef CONFIG_X86_32
-        err |= __put_user(regs->cs, (unsigned int __user *)&sc->cs);
-        err |= __put_user(regs->flags, &sc->flags);
-        err |= __put_user(regs->sp, &sc->sp_at_signal);
-        err |= __put_user(regs->ss, (unsigned int __user *)&sc->ss);
+                put_user_ex(regs->cs, (unsigned int __user *)&sc->cs);
+                put_user_ex(regs->flags, &sc->flags);
+                put_user_ex(regs->sp, &sc->sp_at_signal);
+                put_user_ex(regs->ss, (unsigned int __user *)&sc->ss);
 #else /* !CONFIG_X86_32 */
-        err |= __put_user(regs->flags, &sc->flags);
-        err |= __put_user(regs->cs, &sc->cs);
-        err |= __put_user(0, &sc->gs);
-        err |= __put_user(0, &sc->fs);
+                put_user_ex(regs->flags, &sc->flags);
+                put_user_ex(regs->cs, &sc->cs);
+                put_user_ex(0, &sc->gs);
+                put_user_ex(0, &sc->fs);
 #endif /* CONFIG_X86_32 */
 
-        err |= __put_user(fpstate, &sc->fpstate);
+                put_user_ex(fpstate, &sc->fpstate);
 
-        /* non-iBCS2 extensions.. */
-        err |= __put_user(mask, &sc->oldmask);
-        err |= __put_user(current->thread.cr2, &sc->cr2);
+                /* non-iBCS2 extensions.. */
+                put_user_ex(mask, &sc->oldmask);
+                put_user_ex(current->thread.cr2, &sc->cr2);
+        } put_user_catch(err);
 
         return err;
 }
@@ -336,43 +334,41 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
         if (!access_ok(VERIFY_WRITE, frame, sizeof(*frame)))
                 return -EFAULT;
 
-        err |= __put_user(sig, &frame->sig);
-        err |= __put_user(&frame->info, &frame->pinfo);
-        err |= __put_user(&frame->uc, &frame->puc);
-        err |= copy_siginfo_to_user(&frame->info, info);
-        if (err)
-                return -EFAULT;
-
-        /* Create the ucontext.  */
-        if (cpu_has_xsave)
-                err |= __put_user(UC_FP_XSTATE, &frame->uc.uc_flags);
-        else
-                err |= __put_user(0, &frame->uc.uc_flags);
-        err |= __put_user(0, &frame->uc.uc_link);
-        err |= __put_user(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
-        err |= __put_user(sas_ss_flags(regs->sp),
-                          &frame->uc.uc_stack.ss_flags);
-        err |= __put_user(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
-        err |= setup_sigcontext(&frame->uc.uc_mcontext, fpstate,
-                                regs, set->sig[0]);
-        err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
-        if (err)
-                return -EFAULT;
+        put_user_try {
+                put_user_ex(sig, &frame->sig);
+                put_user_ex(&frame->info, &frame->pinfo);
+                put_user_ex(&frame->uc, &frame->puc);
+                err |= copy_siginfo_to_user(&frame->info, info);
 
-        /* Set up to return from userspace.  */
-        restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
-        if (ka->sa.sa_flags & SA_RESTORER)
-                restorer = ka->sa.sa_restorer;
-        err |= __put_user(restorer, &frame->pretcode);
+                /* Create the ucontext.  */
+                if (cpu_has_xsave)
+                        put_user_ex(UC_FP_XSTATE, &frame->uc.uc_flags);
+                else
+                        put_user_ex(0, &frame->uc.uc_flags);
+                put_user_ex(0, &frame->uc.uc_link);
+                put_user_ex(current->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
+                put_user_ex(sas_ss_flags(regs->sp),
+                            &frame->uc.uc_stack.ss_flags);
+                put_user_ex(current->sas_ss_size, &frame->uc.uc_stack.ss_size);
+                err |= setup_sigcontext(&frame->uc.uc_mcontext, fpstate,
+                                        regs, set->sig[0]);
+                err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+
+                /* Set up to return from userspace.  */
+                restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+                if (ka->sa.sa_flags & SA_RESTORER)
+                        restorer = ka->sa.sa_restorer;
+                put_user_ex(restorer, &frame->pretcode);
 
-        /*
-         * This is movl $__NR_rt_sigreturn, %ax ; int $0x80
-         *
-         * WE DO NOT USE IT ANY MORE! It's only left here for historical
-         * reasons and because gdb uses it as a signature to notice
-         * signal handler stack frames.
-         */
-        err |= __put_user(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
+                /*
+                 * This is movl $__NR_rt_sigreturn, %ax ; int $0x80
+                 *
+                 * WE DO NOT USE IT ANY MORE! It's only left here for historical
+                 * reasons and because gdb uses it as a signature to notice
+                 * signal handler stack frames.
+                 */
+                put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
+        } put_user_catch(err);
 
         if (err)
                 return -EFAULT;
@@ -436,28 +432,30 @@ static int __setup_rt_frame(int sig, struct k_sigaction *ka, siginfo_t *info,
                         return -EFAULT;
         }
 
-        /* Create the ucontext.  */
-        if (cpu_has_xsave)
-                err |= __put_user(UC_FP_XSTATE, &frame->uc.uc_flags);
-        else
-                err |= __put_user(0, &frame->uc.uc_flags);
-        err |= __put_user(0, &frame->uc.uc_link);
-        err |= __put_user(me->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
-        err |= __put_user(sas_ss_flags(regs->sp),
-                          &frame->uc.uc_stack.ss_flags);
-        err |= __put_user(me->sas_ss_size, &frame->uc.uc_stack.ss_size);
-        err |= setup_sigcontext(&frame->uc.uc_mcontext, fp, regs, set->sig[0]);
-        err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
-
-        /* Set up to return from userspace.  If provided, use a stub
-           already in userspace.  */
-        /* x86-64 should always use SA_RESTORER. */
-        if (ka->sa.sa_flags & SA_RESTORER) {
-                err |= __put_user(ka->sa.sa_restorer, &frame->pretcode);
-        } else {
-                /* could use a vstub here */
-                return -EFAULT;
-        }
+        put_user_try {
+                /* Create the ucontext.  */
+                if (cpu_has_xsave)
+                        put_user_ex(UC_FP_XSTATE, &frame->uc.uc_flags);
+                else
+                        put_user_ex(0, &frame->uc.uc_flags);
+                put_user_ex(0, &frame->uc.uc_link);
+                put_user_ex(me->sas_ss_sp, &frame->uc.uc_stack.ss_sp);
+                put_user_ex(sas_ss_flags(regs->sp),
+                            &frame->uc.uc_stack.ss_flags);
+                put_user_ex(me->sas_ss_size, &frame->uc.uc_stack.ss_size);
+                err |= setup_sigcontext(&frame->uc.uc_mcontext, fp, regs, set->sig[0]);
+                err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
+
+                /* Set up to return from userspace.  If provided, use a stub
+                   already in userspace.  */
+                /* x86-64 should always use SA_RESTORER. */
+                if (ka->sa.sa_flags & SA_RESTORER) {
+                        put_user_ex(ka->sa.sa_restorer, &frame->pretcode);
+                } else {
+                        /* could use a vstub here */
+                        err |= -EFAULT;
+                }
+        } put_user_catch(err);
 
         if (err)
                 return -EFAULT;
@@ -509,31 +507,41 @@ sys_sigaction(int sig, const struct old_sigaction __user *act,
               struct old_sigaction __user *oact)
 {
         struct k_sigaction new_ka, old_ka;
-        int ret;
+        int ret = 0;
 
         if (act) {
                 old_sigset_t mask;
 
-                if (!access_ok(VERIFY_READ, act, sizeof(*act)) ||
-                    __get_user(new_ka.sa.sa_handler, &act->sa_handler) ||
-                    __get_user(new_ka.sa.sa_restorer, &act->sa_restorer))
+                if (!access_ok(VERIFY_READ, act, sizeof(*act)))
                         return -EFAULT;
 
-                __get_user(new_ka.sa.sa_flags, &act->sa_flags);
-                __get_user(mask, &act->sa_mask);
+                get_user_try {
+                        get_user_ex(new_ka.sa.sa_handler, &act->sa_handler);
+                        get_user_ex(new_ka.sa.sa_flags, &act->sa_flags);
+                        get_user_ex(mask, &act->sa_mask);
+                        get_user_ex(new_ka.sa.sa_restorer, &act->sa_restorer);
+                } get_user_catch(ret);
+
+                if (ret)
+                        return -EFAULT;
                 siginitset(&new_ka.sa.sa_mask, mask);
         }
 
         ret = do_sigaction(sig, act ? &new_ka : NULL, oact ? &old_ka : NULL);
 
         if (!ret && oact) {
-                if (!access_ok(VERIFY_WRITE, oact, sizeof(*oact)) ||
-                    __put_user(old_ka.sa.sa_handler, &oact->sa_handler) ||
-                    __put_user(old_ka.sa.sa_restorer, &oact->sa_restorer))
+                if (!access_ok(VERIFY_WRITE, oact, sizeof(*oact)))
                         return -EFAULT;
 
-                __put_user(old_ka.sa.sa_flags, &oact->sa_flags);
-                __put_user(old_ka.sa.sa_mask.sig[0], &oact->sa_mask);
+                put_user_try {
+                        put_user_ex(old_ka.sa.sa_handler, &oact->sa_handler);
+                        put_user_ex(old_ka.sa.sa_flags, &oact->sa_flags);
+                        put_user_ex(old_ka.sa.sa_mask.sig[0], &oact->sa_mask);
+                        put_user_ex(old_ka.sa.sa_restorer, &oact->sa_restorer);
+                } put_user_catch(ret);
+
+                if (ret)
+                        return -EFAULT;
         }
 
         return ret;
@@ -541,14 +549,9 @@ sys_sigaction(int sig, const struct old_sigaction __user *act,
 #endif /* CONFIG_X86_32 */
 
 #ifdef CONFIG_X86_32
-asmlinkage int sys_sigaltstack(unsigned long bx)
+int sys_sigaltstack(struct pt_regs *regs)
 {
-        /*
-         * This is needed to make gcc realize it doesn't own the
-         * "struct pt_regs"
-         */
-        struct pt_regs *regs = (struct pt_regs *)&bx;
-        const stack_t __user *uss = (const stack_t __user *)bx;
+        const stack_t __user *uss = (const stack_t __user *)regs->bx;
         stack_t __user *uoss = (stack_t __user *)regs->cx;
 
         return do_sigaltstack(uss, uoss, regs->sp);
@@ -566,14 +569,12 @@ sys_sigaltstack(const stack_t __user *uss, stack_t __user *uoss,
  * Do a signal return; undo the signal stack.
  */
 #ifdef CONFIG_X86_32
-asmlinkage unsigned long sys_sigreturn(unsigned long __unused)
+unsigned long sys_sigreturn(struct pt_regs *regs)
 {
         struct sigframe __user *frame;
-        struct pt_regs *regs;
         unsigned long ax;
         sigset_t set;
 
-        regs = (struct pt_regs *) &__unused;
         frame = (struct sigframe __user *)(regs->sp - 8);
 
         if (!access_ok(VERIFY_READ, frame, sizeof(*frame)))
@@ -600,7 +601,7 @@ badframe:
 }
 #endif /* CONFIG_X86_32 */
 
-static long do_rt_sigreturn(struct pt_regs *regs)
+long sys_rt_sigreturn(struct pt_regs *regs)
 {
         struct rt_sigframe __user *frame;
         unsigned long ax;
@@ -631,25 +632,6 @@ badframe:
         return 0;
 }
 
-#ifdef CONFIG_X86_32
-/*
- * Note: do not pass in pt_regs directly as with tail-call optimization
- * GCC will incorrectly stomp on the caller's frame and corrupt user-space
- * register state:
- */
-asmlinkage int sys_rt_sigreturn(unsigned long __unused)
-{
-        struct pt_regs *regs = (struct pt_regs *)&__unused;
-
-        return do_rt_sigreturn(regs);
-}
-#else /* !CONFIG_X86_32 */
-asmlinkage long sys_rt_sigreturn(struct pt_regs *regs)
-{
-        return do_rt_sigreturn(regs);
-}
-#endif /* CONFIG_X86_32 */
-
 /*
  * OK, we're invoking a handler:
  */
diff --git a/arch/x86/kernel/smp.c b/arch/x86/kernel/smp.c
index e6faa3316bd..eaaffae31cc 100644
--- a/arch/x86/kernel/smp.c
+++ b/arch/x86/kernel/smp.c
@@ -2,7 +2,7 @@
  *      Intel SMP support routines.
  *
  *      (c) 1995 Alan Cox, Building #3 <alan@lxorguk.ukuu.org.uk>
- *      (c) 1998-99, 2000 Ingo Molnar <mingo@redhat.com>
+ *      (c) 1998-99, 2000, 2009 Ingo Molnar <mingo@redhat.com>
  *      (c) 2002,2003 Andi Kleen, SuSE Labs.
  *
  *      i386 and x86_64 integration by Glauber Costa <gcosta@redhat.com>
@@ -26,8 +26,7 @@
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
 #include <asm/proto.h>
-#include <mach_ipi.h>
-#include <mach_apic.h>
+#include <asm/genapic.h>
 /*
  *      Some notes on x86 processor bugs affecting SMP operation:
  *
@@ -118,12 +117,12 @@ static void native_smp_send_reschedule(int cpu)
                 WARN_ON(1);
                 return;
         }
-        send_IPI_mask(cpumask_of(cpu), RESCHEDULE_VECTOR);
+        apic->send_IPI_mask(cpumask_of(cpu), RESCHEDULE_VECTOR);
 }
 
 void native_send_call_func_single_ipi(int cpu)
 {
-        send_IPI_mask(cpumask_of(cpu), CALL_FUNCTION_SINGLE_VECTOR);
+        apic->send_IPI_mask(cpumask_of(cpu), CALL_FUNCTION_SINGLE_VECTOR);
 }
 
 void native_send_call_func_ipi(const struct cpumask *mask)
@@ -131,7 +130,7 @@ void native_send_call_func_ipi(const struct cpumask *mask)
         cpumask_var_t allbutself;
 
         if (!alloc_cpumask_var(&allbutself, GFP_ATOMIC)) {
-                send_IPI_mask(mask, CALL_FUNCTION_VECTOR);
+                apic->send_IPI_mask(mask, CALL_FUNCTION_VECTOR);
                 return;
         }
 
@@ -140,9 +139,9 @@ void native_send_call_func_ipi(const struct cpumask *mask)
 
         if (cpumask_equal(mask, allbutself) &&
             cpumask_equal(cpu_online_mask, cpu_callout_mask))
-                send_IPI_allbutself(CALL_FUNCTION_VECTOR);
+                apic->send_IPI_allbutself(CALL_FUNCTION_VECTOR);
         else
-                send_IPI_mask(mask, CALL_FUNCTION_VECTOR);
+                apic->send_IPI_mask(mask, CALL_FUNCTION_VECTOR);
 
         free_cpumask_var(allbutself);
 }
diff --git a/arch/x86/kernel/smpboot.c b/arch/x86/kernel/smpboot.c
index bb1a3b1fc87..af57f88186e 100644
--- a/arch/x86/kernel/smpboot.c
+++ b/arch/x86/kernel/smpboot.c
@@ -2,7 +2,7 @@
  *      x86 SMP booting functions
  *
  *      (c) 1995 Alan Cox, Building #3 <alan@lxorguk.ukuu.org.uk>
- *      (c) 1998, 1999, 2000 Ingo Molnar <mingo@redhat.com>
+ *      (c) 1998, 1999, 2000, 2009 Ingo Molnar <mingo@redhat.com>
  *      Copyright 2001 Andi Kleen, SuSE Labs.
  *
  *      Much of the core SMP work is based on previous work by Thomas Radke, to
@@ -53,7 +53,6 @@
 #include <asm/nmi.h>
 #include <asm/irq.h>
 #include <asm/idle.h>
-#include <asm/smp.h>
 #include <asm/trampoline.h>
 #include <asm/cpu.h>
 #include <asm/numa.h>
@@ -63,11 +62,11 @@
 #include <asm/vmi.h>
 #include <asm/genapic.h>
 #include <asm/setup.h>
+#include <asm/uv/uv.h>
 #include <linux/mc146818rtc.h>
 
-#include <mach_apic.h>
-#include <mach_wakecpu.h>
-#include <smpboot_hooks.h>
+#include <asm/genapic.h>
+#include <asm/smpboot_hooks.h>
 
 #ifdef CONFIG_X86_32
 u8 apicid_2_node[MAX_APICID];
@@ -163,7 +162,7 @@ static void map_cpu_to_logical_apicid(void)
 {
         int cpu = smp_processor_id();
         int apicid = logical_smp_processor_id();
-        int node = apicid_to_node(apicid);
+        int node = apic->apicid_to_node(apicid);
 
         if (!node_online(node))
                 node = first_online_node;
@@ -196,7 +195,8 @@ static void __cpuinit smp_callin(void)
          * our local APIC.  We have to wait for the IPI or we'll
          * lock up on an APIC access.
          */
-        wait_for_init_deassert(&init_deasserted);
+        if (apic->wait_for_init_deassert)
+                apic->wait_for_init_deassert(&init_deasserted);
 
         /*
          * (This works even if the APIC is not enabled.)
@@ -243,7 +243,8 @@ static void __cpuinit smp_callin(void)
          */
 
         pr_debug("CALLIN, before setup_local_APIC().\n");
-        smp_callin_clear_local_apic();
+        if (apic->smp_callin_clear_local_apic)
+                apic->smp_callin_clear_local_apic();
         setup_local_APIC();
         end_local_APIC_setup();
         map_cpu_to_logical_apicid();
@@ -583,7 +584,7 @@ wakeup_secondary_cpu_via_nmi(int logical_apicid, unsigned long start_eip)
         /* Target chip */
         /* Boot on the stack */
         /* Kick the second */
-        apic_icr_write(APIC_DM_NMI | APIC_DEST_LOGICAL, logical_apicid);
+        apic_icr_write(APIC_DM_NMI | apic->dest_logical, logical_apicid);
 
         pr_debug("Waiting for send to finish...\n");
         send_status = safe_apic_wait_icr_idle();
@@ -745,57 +746,11 @@ static void __cpuinit do_fork_idle(struct work_struct *work)
         complete(&c_idle->done);
 }
 
-#ifdef CONFIG_X86_64
-
-/* __ref because it's safe to call free_bootmem when after_bootmem == 0. */
-static void __ref free_bootmem_pda(struct x8664_pda *oldpda)
-{
-        if (!after_bootmem)
-                free_bootmem((unsigned long)oldpda, sizeof(*oldpda));
-}
-
-/*
- * Allocate node local memory for the AP pda.
- *
- * Must be called after the _cpu_pda pointer table is initialized.
- */
-int __cpuinit get_local_pda(int cpu)
-{
-        struct x8664_pda *oldpda, *newpda;
-        unsigned long size = sizeof(struct x8664_pda);
-        int node = cpu_to_node(cpu);
-
-        if (cpu_pda(cpu) && !cpu_pda(cpu)->in_bootmem)
-                return 0;
-
-        oldpda = cpu_pda(cpu);
-        newpda = kmalloc_node(size, GFP_ATOMIC, node);
-        if (!newpda) {
-                printk(KERN_ERR "Could not allocate node local PDA "
-                        "for CPU %d on node %d\n", cpu, node);
-
-                if (oldpda)
-                        return 0;       /* have a usable pda */
-                else
-                        return -1;
-        }
-
-        if (oldpda) {
-                memcpy(newpda, oldpda, size);
-                free_bootmem_pda(oldpda);
-        }
-
-        newpda->in_bootmem = 0;
-        cpu_pda(cpu) = newpda;
-        return 0;
-}
-#endif /* CONFIG_X86_64 */
-
 static int __cpuinit do_boot_cpu(int apicid, int cpu)
 /*
  * NOTE - on most systems this is a PHYSICAL apic ID, but on multiquad
  * (ie clustered apic addressing mode), this is a LOGICAL apic ID.
- * Returns zero if CPU booted OK, else error code from wakeup_secondary_cpu.
+ * Returns zero if CPU booted OK, else error code from ->wakeup_cpu.
  */
 {
         unsigned long boot_error = 0;
@@ -808,16 +763,6 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
         };
         INIT_WORK(&c_idle.work, do_fork_idle);
 
-#ifdef CONFIG_X86_64
-        /* Allocate node local memory for AP pdas */
-        if (cpu > 0) {
-                boot_error = get_local_pda(cpu);
-                if (boot_error)
-                        goto restore_state;
-                        /* if can't get pda memory, can't start cpu */
-        }
-#endif
-
         alternatives_smp_switch(1);
 
         c_idle.idle = get_idle_for_cpu(cpu);
@@ -847,14 +792,16 @@ static int __cpuinit do_boot_cpu(int apicid, int cpu)
 
         set_idle_for_cpu(cpu, c_idle.idle);
 do_rest:
-#ifdef CONFIG_X86_32
         per_cpu(current_task, cpu) = c_idle.idle;
-        init_gdt(cpu);
+#ifdef CONFIG_X86_32
         /* Stack for startup_32 can be just as for start_secondary onwards */
         irq_ctx_init(cpu);
 #else
-        cpu_pda(cpu)->pcurrent = c_idle.idle;
         clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
+        initial_gs = per_cpu_offset(cpu);
+        per_cpu(kernel_stack, cpu) =
+                (unsigned long)task_stack_page(c_idle.idle) -
+                KERNEL_STACK_OFFSET + THREAD_SIZE;
 #endif
         early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
         initial_code = (unsigned long)start_secondary;
@@ -878,7 +825,8 @@ do_rest:
 
                 pr_debug("Setting warm reset code and vector.\n");
 
-                store_NMI_vector(&nmi_high, &nmi_low);
+                if (apic->store_NMI_vector)
+                        apic->store_NMI_vector(&nmi_high, &nmi_low);
 
                 smpboot_setup_warm_reset_vector(start_ip);
                 /*
@@ -893,7 +841,7 @@ do_rest:
         /*
          * Starting actual IPI sequence...
          */
-        boot_error = wakeup_secondary_cpu(apicid, start_ip);
+        boot_error = apic->wakeup_cpu(apicid, start_ip);
 
         if (!boot_error) {
                 /*
@@ -927,13 +875,11 @@ do_rest:
                         else
                                 /* trampoline code not run */
                                 printk(KERN_ERR "Not responding.\n");
-                        if (get_uv_system_type() != UV_NON_UNIQUE_APIC)
-                                inquire_remote_apic(apicid);
+                        if (apic->inquire_remote_apic)
+                                apic->inquire_remote_apic(apicid);
                 }
         }
-#ifdef CONFIG_X86_64
-restore_state:
-#endif
+
         if (boot_error) {
                 /* Try to put things back the way they were before ... */
                 numa_remove_cpu(cpu); /* was set by numa_add_cpu */
@@ -961,7 +907,7 @@ restore_state:
 
 int __cpuinit native_cpu_up(unsigned int cpu)
 {
-        int apicid = cpu_present_to_apicid(cpu);
+        int apicid = apic->cpu_present_to_apicid(cpu);
         unsigned long flags;
         int err;
 
@@ -1054,14 +1000,14 @@ static int __init smp_sanity_check(unsigned max_cpus)
 {
         preempt_disable();
 
-#if defined(CONFIG_X86_PC) && defined(CONFIG_X86_32)
+#if !defined(CONFIG_X86_BIGSMP) && defined(CONFIG_X86_32)
         if (def_to_bigsmp && nr_cpu_ids > 8) {
                 unsigned int cpu;
                 unsigned nr;
 
                 printk(KERN_WARNING
                        "More than 8 CPUs detected - skipping them.\n"
-                       "Use CONFIG_X86_GENERICARCH and CONFIG_X86_BIGSMP.\n");
+                       "Use CONFIG_X86_BIGSMP.\n");
 
                 nr = 0;
                 for_each_present_cpu(cpu) {
@@ -1107,7 +1053,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
          * Should not be necessary because the MP table should list the boot
          * CPU too, but we do it for the sake of robustness anyway.
          */
-        if (!check_phys_apicid_present(boot_cpu_physical_apicid)) {
+        if (!apic->check_phys_apicid_present(boot_cpu_physical_apicid)) {
                 printk(KERN_NOTICE
                         "weird, boot CPU (#%d) not listed by the BIOS.\n",
                         boot_cpu_physical_apicid);
@@ -1125,6 +1071,7 @@ static int __init smp_sanity_check(unsigned max_cpus)
                 printk(KERN_ERR "... forcing use of dummy APIC emulation."
                                 "(tell your hw vendor)\n");
                 smpboot_clear_io_apic();
+                arch_disable_smp_support();
                 return -1;
         }
 
@@ -1183,7 +1130,7 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
 
 #ifdef CONFIG_X86_64
         enable_IR_x2apic();
-        setup_apic_routing();
+        default_setup_apic_routing();
 #endif
 
         if (smp_sanity_check(max_cpus) < 0) {
@@ -1218,7 +1165,8 @@ void __init native_smp_prepare_cpus(unsigned int max_cpus)
 
         map_cpu_to_logical_apicid();
 
-        setup_portio_remap();
+        if (apic->setup_portio_remap)
+                apic->setup_portio_remap();
 
         smpboot_setup_io_apic();
         /*
@@ -1240,10 +1188,7 @@ out:
 void __init native_smp_prepare_boot_cpu(void)
 {
         int me = smp_processor_id();
-#ifdef CONFIG_X86_32
-        init_gdt(me);
-#endif
-        switch_to_new_gdt();
+        switch_to_new_gdt(me);
         /* already set me in cpu_online_mask in boot_cpu_init() */
         cpumask_set_cpu(me, cpu_callout_mask);
         per_cpu(cpu_state, me) = CPU_ONLINE;
diff --git a/arch/x86/kernel/smpcommon.c b/arch/x86/kernel/smpcommon.c
deleted file mode 100644
index 397e309839d..00000000000
--- a/arch/x86/kernel/smpcommon.c
+++ /dev/null
@@ -1,30 +0,0 @@
-/*
- * SMP stuff which is common to all sub-architectures.
- */
-#include <linux/module.h>
-#include <asm/smp.h>
-
-#ifdef CONFIG_X86_32
-DEFINE_PER_CPU(unsigned long, this_cpu_off);
-EXPORT_PER_CPU_SYMBOL(this_cpu_off);
-
-/*
- * Initialize the CPU's GDT.  This is either the boot CPU doing itself
- * (still using the master per-cpu area), or a CPU doing it for a
- * secondary which will soon come up.
- */
-__cpuinit void init_gdt(int cpu)
-{
-        struct desc_struct gdt;
-
-        pack_descriptor(&gdt, __per_cpu_offset[cpu], 0xFFFFF,
-                        0x2 | DESCTYPE_S, 0x8);
-        gdt.s = 1;
-
-        write_gdt_entry(get_cpu_gdt_table(cpu),
-                        GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
-
-        per_cpu(this_cpu_off, cpu) = __per_cpu_offset[cpu];
-        per_cpu(cpu_number, cpu) = cpu;
-}
-#endif
diff --git a/arch/x86/kernel/stacktrace.c b/arch/x86/kernel/stacktrace.c
index 10786af9554..f7bddc2e37d 100644
--- a/arch/x86/kernel/stacktrace.c
+++ b/arch/x86/kernel/stacktrace.c
@@ -1,7 +1,7 @@
 /*
  * Stack trace management functions
  *
- *  Copyright (C) 2006 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
+ *  Copyright (C) 2006-2009 Red Hat, Inc., Ingo Molnar <mingo@redhat.com>
  */
 #include <linux/sched.h>
 #include <linux/stacktrace.h>
diff --git a/arch/x86/kernel/summit_32.c b/arch/x86/kernel/summit_32.c
index 7b987852e87..1e733eff9b3 100644
--- a/arch/x86/kernel/summit_32.c
+++ b/arch/x86/kernel/summit_32.c
@@ -30,8 +30,364 @@
 #include <linux/init.h>
 #include <asm/io.h>
 #include <asm/bios_ebda.h>
-#include <asm/summit/mpparse.h>
 
+/*
+ * APIC driver for the IBM "Summit" chipset.
+ */
+#define APIC_DEFINITION 1
+#include <linux/threads.h>
+#include <linux/cpumask.h>
+#include <asm/mpspec.h>
+#include <asm/apic.h>
+#include <asm/smp.h>
+#include <asm/genapic.h>
+#include <asm/fixmap.h>
+#include <asm/apicdef.h>
+#include <asm/ipi.h>
+#include <linux/kernel.h>
+#include <linux/string.h>
+#include <linux/init.h>
+#include <linux/gfp.h>
+#include <linux/smp.h>
+
+static inline unsigned summit_get_apic_id(unsigned long x)
+{
+        return (x >> 24) & 0xFF;
+}
+
+static inline void summit_send_IPI_mask(const cpumask_t *mask, int vector)
+{
+        default_send_IPI_mask_sequence_logical(mask, vector);
+}
+
+static inline void summit_send_IPI_allbutself(int vector)
+{
+        cpumask_t mask = cpu_online_map;
+        cpu_clear(smp_processor_id(), mask);
+
+        if (!cpus_empty(mask))
+                summit_send_IPI_mask(&mask, vector);
+}
+
+static inline void summit_send_IPI_all(int vector)
+{
+        summit_send_IPI_mask(&cpu_online_map, vector);
+}
+
+#include <asm/tsc.h>
+
+extern int use_cyclone;
+
+#ifdef CONFIG_X86_SUMMIT_NUMA
+extern void setup_summit(void);
+#else
+#define setup_summit()  {}
+#endif
+
+static inline int
+summit_mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
+{
+        if (!strncmp(oem, "IBM ENSW", 8) &&
+                        (!strncmp(productid, "VIGIL SMP", 9)
+                         || !strncmp(productid, "EXA", 3)
+                         || !strncmp(productid, "RUTHLESS SMP", 12))){
+                mark_tsc_unstable("Summit based system");
+                use_cyclone = 1; /*enable cyclone-timer*/
+                setup_summit();
+                return 1;
+        }
+        return 0;
+}
+
+/* Hook from generic ACPI tables.c */
+static inline int summit_acpi_madt_oem_check(char *oem_id, char *oem_table_id)
+{
+        if (!strncmp(oem_id, "IBM", 3) &&
+            (!strncmp(oem_table_id, "SERVIGIL", 8)
+             || !strncmp(oem_table_id, "EXA", 3))){
+                mark_tsc_unstable("Summit based system");
+                use_cyclone = 1; /*enable cyclone-timer*/
+                setup_summit();
+                return 1;
+        }
+        return 0;
+}
+
+struct rio_table_hdr {
+        unsigned char version;      /* Version number of this data structure           */
+                                    /* Version 3 adds chassis_num & WP_index           */
+        unsigned char num_scal_dev; /* # of Scalability devices (Twisters for Vigil)   */
+        unsigned char num_rio_dev;  /* # of RIO I/O devices (Cyclones and Winnipegs)   */
+} __attribute__((packed));
+
+struct scal_detail {
+        unsigned char node_id;      /* Scalability Node ID                             */
+        unsigned long CBAR;         /* Address of 1MB register space                   */
+        unsigned char port0node;    /* Node ID port connected to: 0xFF=None            */
+        unsigned char port0port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
+        unsigned char port1node;    /* Node ID port connected to: 0xFF = None          */
+        unsigned char port1port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
+        unsigned char port2node;    /* Node ID port connected to: 0xFF = None          */
+        unsigned char port2port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
+        unsigned char chassis_num;  /* 1 based Chassis number (1 = boot node)          */
+} __attribute__((packed));
+
+struct rio_detail {
+        unsigned char node_id;      /* RIO Node ID                                     */
+        unsigned long BBAR;         /* Address of 1MB register space                   */
+        unsigned char type;         /* Type of device                                  */
+        unsigned char owner_id;     /* For WPEG: Node ID of Cyclone that owns this WPEG*/
+                                    /* For CYC:  Node ID of Twister that owns this CYC */
+        unsigned char port0node;    /* Node ID port connected to: 0xFF=None            */
+        unsigned char port0port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
+        unsigned char port1node;    /* Node ID port connected to: 0xFF=None            */
+        unsigned char port1port;    /* Port num port connected to: 0,1,2, or 0xFF=None */
+        unsigned char first_slot;   /* For WPEG: Lowest slot number below this WPEG    */
+                                    /* For CYC:  0                                     */
+        unsigned char status;       /* For WPEG: Bit 0 = 1 : the XAPIC is used         */
+                                    /*                 = 0 : the XAPIC is not used, ie:*/
+                                    /*                     ints fwded to another XAPIC */
+                                    /*           Bits1:7 Reserved                      */
+                                    /* For CYC:  Bits0:7 Reserved                      */
+        unsigned char WP_index;     /* For WPEG: WPEG instance index - lower ones have */
+                                    /*           lower slot numbers/PCI bus numbers    */
+                                    /* For CYC:  No meaning                            */
+        unsigned char chassis_num;  /* 1 based Chassis number                          */
+                                    /* For LookOut WPEGs this field indicates the      */
+                                    /* Expansion Chassis #, enumerated from Boot       */
+                                    /* Node WPEG external port, then Boot Node CYC     */
+                                    /* external port, then Next Vigil chassis WPEG     */
+                                    /* external port, etc.                             */
+                                    /* Shared Lookouts have only 1 chassis number (the */
+                                    /* first one assigned)                             */
+} __attribute__((packed));
+
+
+typedef enum {
+        CompatTwister = 0,  /* Compatibility Twister               */
+        AltTwister    = 1,  /* Alternate Twister of internal 8-way */
+        CompatCyclone = 2,  /* Compatibility Cyclone               */
+        AltCyclone    = 3,  /* Alternate Cyclone of internal 8-way */
+        CompatWPEG    = 4,  /* Compatibility WPEG                  */
+        AltWPEG       = 5,  /* Second Planar WPEG                  */
+        LookOutAWPEG  = 6,  /* LookOut WPEG                        */
+        LookOutBWPEG  = 7,  /* LookOut WPEG                        */
+} node_type;
+
+static inline int is_WPEG(struct rio_detail *rio){
+        return (rio->type == CompatWPEG || rio->type == AltWPEG ||
+                rio->type == LookOutAWPEG || rio->type == LookOutBWPEG);
+}
+
+
+/* In clustered mode, the high nibble of APIC ID is a cluster number.
+ * The low nibble is a 4-bit bitmap. */
+#define XAPIC_DEST_CPUS_SHIFT   4
+#define XAPIC_DEST_CPUS_MASK    ((1u << XAPIC_DEST_CPUS_SHIFT) - 1)
+#define XAPIC_DEST_CLUSTER_MASK (XAPIC_DEST_CPUS_MASK << XAPIC_DEST_CPUS_SHIFT)
+
+#define SUMMIT_APIC_DFR_VALUE   (APIC_DFR_CLUSTER)
+
+static inline const cpumask_t *summit_target_cpus(void)
+{
+        /* CPU_MASK_ALL (0xff) has undefined behaviour with
+         * dest_LowestPrio mode logical clustered apic interrupt routing
+         * Just start on cpu 0.  IRQ balancing will spread load
+         */
+        return &cpumask_of_cpu(0);
+}
+
+static inline unsigned long
+summit_check_apicid_used(physid_mask_t bitmap, int apicid)
+{
+        return 0;
+}
+
+/* we don't use the phys_cpu_present_map to indicate apicid presence */
+static inline unsigned long summit_check_apicid_present(int bit)
+{
+        return 1;
+}
+
+#define apicid_cluster(apicid) ((apicid) & XAPIC_DEST_CLUSTER_MASK)
+
+extern u8 cpu_2_logical_apicid[];
+
+static inline void summit_init_apic_ldr(void)
+{
+        unsigned long val, id;
+        int count = 0;
+        u8 my_id = (u8)hard_smp_processor_id();
+        u8 my_cluster = (u8)apicid_cluster(my_id);
+#ifdef CONFIG_SMP
+        u8 lid;
+        int i;
+
+        /* Create logical APIC IDs by counting CPUs already in cluster. */
+        for (count = 0, i = nr_cpu_ids; --i >= 0; ) {
+                lid = cpu_2_logical_apicid[i];
+                if (lid != BAD_APICID && apicid_cluster(lid) == my_cluster)
+                        ++count;
+        }
+#endif
+        /* We only have a 4 wide bitmap in cluster mode.  If a deranged
+         * BIOS puts 5 CPUs in one APIC cluster, we're hosed. */
+        BUG_ON(count >= XAPIC_DEST_CPUS_SHIFT);
+        id = my_cluster | (1UL << count);
+        apic_write(APIC_DFR, SUMMIT_APIC_DFR_VALUE);
+        val = apic_read(APIC_LDR) & ~APIC_LDR_MASK;
+        val |= SET_APIC_LOGICAL_ID(id);
+        apic_write(APIC_LDR, val);
+}
+
+static inline int summit_apic_id_registered(void)
+{
+        return 1;
+}
+
+static inline void summit_setup_apic_routing(void)
+{
+        printk("Enabling APIC mode:  Summit.  Using %d I/O APICs\n",
+                                                nr_ioapics);
+}
+
+static inline int summit_apicid_to_node(int logical_apicid)
+{
+#ifdef CONFIG_SMP
+        return apicid_2_node[hard_smp_processor_id()];
+#else
+        return 0;
+#endif
+}
+
+/* Mapping from cpu number to logical apicid */
+static inline int summit_cpu_to_logical_apicid(int cpu)
+{
+#ifdef CONFIG_SMP
+        if (cpu >= nr_cpu_ids)
+                return BAD_APICID;
+        return (int)cpu_2_logical_apicid[cpu];
+#else
+        return logical_smp_processor_id();
+#endif
+}
+
+static inline int summit_cpu_present_to_apicid(int mps_cpu)
+{
+        if (mps_cpu < nr_cpu_ids)
+                return (int)per_cpu(x86_bios_cpu_apicid, mps_cpu);
+        else
+                return BAD_APICID;
+}
+
+static inline physid_mask_t
+summit_ioapic_phys_id_map(physid_mask_t phys_id_map)
+{
+        /* For clustered we don't have a good way to do this yet - hack */
+        return physids_promote(0x0F);
+}
+
+static inline physid_mask_t summit_apicid_to_cpu_present(int apicid)
+{
+        return physid_mask_of_physid(0);
+}
+
+static inline void summit_setup_portio_remap(void)
+{
+}
+
+static inline int summit_check_phys_apicid_present(int boot_cpu_physical_apicid)
+{
+        return 1;
+}
+
+static inline unsigned int summit_cpu_mask_to_apicid(const cpumask_t *cpumask)
+{
+        int cpus_found = 0;
+        int num_bits_set;
+        int apicid;
+        int cpu;
+
+        num_bits_set = cpus_weight(*cpumask);
+        /* Return id to all */
+        if (num_bits_set >= nr_cpu_ids)
+                return 0xFF;
+        /*
+         * The cpus in the mask must all be on the apic cluster.  If are not
+         * on the same apicid cluster return default value of target_cpus():
+         */
+        cpu = first_cpu(*cpumask);
+        apicid = summit_cpu_to_logical_apicid(cpu);
+
+        while (cpus_found < num_bits_set) {
+                if (cpu_isset(cpu, *cpumask)) {
+                        int new_apicid = summit_cpu_to_logical_apicid(cpu);
+
+                        if (apicid_cluster(apicid) !=
+                                        apicid_cluster(new_apicid)) {
+                                printk ("%s: Not a valid mask!\n", __func__);
+
+                                return 0xFF;
+                        }
+                        apicid = apicid | new_apicid;
+                        cpus_found++;
+                }
+                cpu++;
+        }
+        return apicid;
+}
+
+static inline unsigned int
+summit_cpu_mask_to_apicid_and(const struct cpumask *inmask,
+                              const struct cpumask *andmask)
+{
+        int apicid = summit_cpu_to_logical_apicid(0);
+        cpumask_var_t cpumask;
+
+        if (!alloc_cpumask_var(&cpumask, GFP_ATOMIC))
+                return apicid;
+
+        cpumask_and(cpumask, inmask, andmask);
+        cpumask_and(cpumask, cpumask, cpu_online_mask);
+        apicid = summit_cpu_mask_to_apicid(cpumask);
+
+        free_cpumask_var(cpumask);
+
+        return apicid;
+}
+
+/*
+ * cpuid returns the value latched in the HW at reset, not the APIC ID
+ * register's value.  For any box whose BIOS changes APIC IDs, like
+ * clustered APIC systems, we must use hard_smp_processor_id.
+ *
+ * See Intel's IA-32 SW Dev's Manual Vol2 under CPUID.
+ */
+static inline int summit_phys_pkg_id(int cpuid_apic, int index_msb)
+{
+        return hard_smp_processor_id() >> index_msb;
+}
+
+static int probe_summit(void)
+{
+        /* probed later in mptable/ACPI hooks */
+        return 0;
+}
+
+static void summit_vector_allocation_domain(int cpu, cpumask_t *retmask)
+{
+        /* Careful. Some cpus do not strictly honor the set of cpus
+         * specified in the interrupt destination when using lowest
+         * priority interrupt delivery mode.
+         *
+         * In particular there was a hyperthreading cpu observed to
+         * deliver interrupts to the wrong hyperthread when only one
+         * hyperthread was specified in the interrupt desitination.
+         */
+        *retmask = (cpumask_t){ { [0] = APIC_ALL_CPUS, } };
+}
+
+#ifdef CONFIG_X86_SUMMIT_NUMA
 static struct rio_table_hdr *rio_table_hdr __initdata;
 static struct scal_detail   *scal_devs[MAX_NUMNODES] __initdata;
 static struct rio_detail    *rio_devs[MAX_NUMNODES*4] __initdata;
@@ -186,3 +542,61 @@ void __init setup_summit(void)
                         next_wpeg = 0;
         } while (next_wpeg != 0);
 }
+#endif
+
+struct genapic apic_summit = {
+
+        .name                           = "summit",
+        .probe                          = probe_summit,
+        .acpi_madt_oem_check            = summit_acpi_madt_oem_check,
+        .apic_id_registered             = summit_apic_id_registered,
+
+        .irq_delivery_mode              = dest_LowestPrio,
+        /* logical delivery broadcast to all CPUs: */
+        .irq_dest_mode                  = 1,
+
+        .target_cpus                    = summit_target_cpus,
+        .disable_esr                    = 1,
+        .dest_logical                   = APIC_DEST_LOGICAL,
+        .check_apicid_used              = summit_check_apicid_used,
+        .check_apicid_present           = summit_check_apicid_present,
+
+        .vector_allocation_domain       = summit_vector_allocation_domain,
+        .init_apic_ldr                  = summit_init_apic_ldr,
+
+        .ioapic_phys_id_map             = summit_ioapic_phys_id_map,
+        .setup_apic_routing             = summit_setup_apic_routing,
+        .multi_timer_check              = NULL,
+        .apicid_to_node                 = summit_apicid_to_node,
+        .cpu_to_logical_apicid          = summit_cpu_to_logical_apicid,
+        .cpu_present_to_apicid          = summit_cpu_present_to_apicid,
+        .apicid_to_cpu_present          = summit_apicid_to_cpu_present,
+        .setup_portio_remap             = NULL,
+        .check_phys_apicid_present      = summit_check_phys_apicid_present,
+        .enable_apic_mode               = NULL,
+        .phys_pkg_id                    = summit_phys_pkg_id,
+        .mps_oem_check                  = summit_mps_oem_check,
+
+        .get_apic_id                    = summit_get_apic_id,
+        .set_apic_id                    = NULL,
+        .apic_id_mask                   = 0xFF << 24,
+
+        .cpu_mask_to_apicid             = summit_cpu_mask_to_apicid,
+        .cpu_mask_to_apicid_and         = summit_cpu_mask_to_apicid_and,
+
+        .send_IPI_mask                  = summit_send_IPI_mask,
+        .send_IPI_mask_allbutself       = NULL,
+        .send_IPI_allbutself            = summit_send_IPI_allbutself,
+        .send_IPI_all                   = summit_send_IPI_all,
+        .send_IPI_self                  = default_send_IPI_self,
+
+        .wakeup_cpu                     = NULL,
+        .trampoline_phys_low            = DEFAULT_TRAMPOLINE_PHYS_LOW,
+        .trampoline_phys_high           = DEFAULT_TRAMPOLINE_PHYS_HIGH,
+
+        .wait_for_init_deassert         = default_wait_for_init_deassert,
+
+        .smp_callin_clear_local_apic    = NULL,
+        .store_NMI_vector               = NULL,
+        .inquire_remote_apic            = default_inquire_remote_apic,
+};
diff --git a/arch/x86/kernel/syscall_table_32.S b/arch/x86/kernel/syscall_table_32.S
index e2e86a08f31..3bdb64829b8 100644
--- a/arch/x86/kernel/syscall_table_32.S
+++ b/arch/x86/kernel/syscall_table_32.S
@@ -1,7 +1,7 @@
 ENTRY(sys_call_table)
         .long sys_restart_syscall       /* 0 - old "setup()" system call, used for restarting */
         .long sys_exit
-        .long sys_fork
+        .long ptregs_fork
         .long sys_read
         .long sys_write
         .long sys_open          /* 5 */
@@ -10,7 +10,7 @@ ENTRY(sys_call_table)
         .long sys_creat
         .long sys_link
         .long sys_unlink        /* 10 */
-        .long sys_execve
+        .long ptregs_execve
         .long sys_chdir
         .long sys_time
         .long sys_mknod
@@ -109,17 +109,17 @@ ENTRY(sys_call_table)
         .long sys_newlstat
         .long sys_newfstat
         .long sys_uname
-        .long sys_iopl          /* 110 */
+        .long ptregs_iopl       /* 110 */
         .long sys_vhangup
         .long sys_ni_syscall    /* old "idle" system call */
-        .long sys_vm86old
+        .long ptregs_vm86old
         .long sys_wait4
         .long sys_swapoff       /* 115 */
         .long sys_sysinfo
         .long sys_ipc
         .long sys_fsync
-        .long sys_sigreturn
-        .long sys_clone         /* 120 */
+        .long ptregs_sigreturn
+        .long ptregs_clone      /* 120 */
         .long sys_setdomainname
         .long sys_newuname
         .long sys_modify_ldt
@@ -165,14 +165,14 @@ ENTRY(sys_call_table)
         .long sys_mremap
         .long sys_setresuid16
         .long sys_getresuid16   /* 165 */
-        .long sys_vm86
+        .long ptregs_vm86
         .long sys_ni_syscall    /* Old sys_query_module */
         .long sys_poll
         .long sys_nfsservctl
         .long sys_setresgid16   /* 170 */
         .long sys_getresgid16
         .long sys_prctl
-        .long sys_rt_sigreturn
+        .long ptregs_rt_sigreturn
         .long sys_rt_sigaction
         .long sys_rt_sigprocmask        /* 175 */
         .long sys_rt_sigpending
@@ -185,11 +185,11 @@ ENTRY(sys_call_table)
         .long sys_getcwd
         .long sys_capget
         .long sys_capset        /* 185 */
-        .long sys_sigaltstack
+        .long ptregs_sigaltstack
         .long sys_sendfile
         .long sys_ni_syscall    /* reserved for streams1 */
         .long sys_ni_syscall    /* reserved for streams2 */
-        .long sys_vfork         /* 190 */
+        .long ptregs_vfork      /* 190 */
         .long sys_getrlimit
         .long sys_mmap2
         .long sys_truncate64
diff --git a/arch/x86/kernel/time_32.c b/arch/x86/kernel/time_32.c
index 3985cac0ed4..764c74e871f 100644
--- a/arch/x86/kernel/time_32.c
+++ b/arch/x86/kernel/time_32.c
@@ -38,7 +38,7 @@
 #include <asm/time.h>
 #include <asm/timer.h>
 
-#include "do_timer.h"
+#include <asm/do_timer.h>
 
 int timer_ack;
 
diff --git a/arch/x86/kernel/tlb_32.c b/arch/x86/kernel/tlb_32.c
deleted file mode 100644
index ce505464224..00000000000
--- a/arch/x86/kernel/tlb_32.c
+++ /dev/null
@@ -1,256 +0,0 @@
-#include <linux/spinlock.h>
-#include <linux/cpu.h>
-#include <linux/interrupt.h>
-
-#include <asm/tlbflush.h>
-
-DEFINE_PER_CPU(struct tlb_state, cpu_tlbstate)
-                        ____cacheline_aligned = { &init_mm, 0, };
-
-/* must come after the send_IPI functions above for inlining */
-#include <mach_ipi.h>
-
-/*
- *      Smarter SMP flushing macros.
- *              c/o Linus Torvalds.
- *
- *      These mean you can really definitely utterly forget about
- *      writing to user space from interrupts. (Its not allowed anyway).
- *
- *      Optimizations Manfred Spraul <manfred@colorfullife.com>
- */
-
-static cpumask_t flush_cpumask;
-static struct mm_struct *flush_mm;
-static unsigned long flush_va;
-static DEFINE_SPINLOCK(tlbstate_lock);
-
-/*
- * We cannot call mmdrop() because we are in interrupt context,
- * instead update mm->cpu_vm_mask.
- *
- * We need to reload %cr3 since the page tables may be going
- * away from under us..
- */
-void leave_mm(int cpu)
-{
-        BUG_ON(x86_read_percpu(cpu_tlbstate.state) == TLBSTATE_OK);
-        cpu_clear(cpu, x86_read_percpu(cpu_tlbstate.active_mm)->cpu_vm_mask);
-        load_cr3(swapper_pg_dir);
-}
-EXPORT_SYMBOL_GPL(leave_mm);
-
-/*
- *
- * The flush IPI assumes that a thread switch happens in this order:
- * [cpu0: the cpu that switches]
- * 1) switch_mm() either 1a) or 1b)
- * 1a) thread switch to a different mm
- * 1a1) cpu_clear(cpu, old_mm->cpu_vm_mask);
- *      Stop ipi delivery for the old mm. This is not synchronized with
- *      the other cpus, but smp_invalidate_interrupt ignore flush ipis
- *      for the wrong mm, and in the worst case we perform a superfluous
- *      tlb flush.
- * 1a2) set cpu_tlbstate to TLBSTATE_OK
- *      Now the smp_invalidate_interrupt won't call leave_mm if cpu0
- *      was in lazy tlb mode.
- * 1a3) update cpu_tlbstate[].active_mm
- *      Now cpu0 accepts tlb flushes for the new mm.
- * 1a4) cpu_set(cpu, new_mm->cpu_vm_mask);
- *      Now the other cpus will send tlb flush ipis.
- * 1a4) change cr3.
- * 1b) thread switch without mm change
- *      cpu_tlbstate[].active_mm is correct, cpu0 already handles
- *      flush ipis.
- * 1b1) set cpu_tlbstate to TLBSTATE_OK
- * 1b2) test_and_set the cpu bit in cpu_vm_mask.
- *      Atomically set the bit [other cpus will start sending flush ipis],
- *      and test the bit.
- * 1b3) if the bit was 0: leave_mm was called, flush the tlb.
- * 2) switch %%esp, ie current
- *
- * The interrupt must handle 2 special cases:
- * - cr3 is changed before %%esp, ie. it cannot use current->{active_,}mm.
- * - the cpu performs speculative tlb reads, i.e. even if the cpu only
- *   runs in kernel space, the cpu could load tlb entries for user space
- *   pages.
- *
- * The good news is that cpu_tlbstate is local to each cpu, no
- * write/read ordering problems.
- */
-
-/*
- * TLB flush IPI:
- *
- * 1) Flush the tlb entries if the cpu uses the mm that's being flushed.
- * 2) Leave the mm if we are in the lazy tlb mode.
- */
-
-void smp_invalidate_interrupt(struct pt_regs *regs)
-{
-        unsigned long cpu;
-
-        cpu = get_cpu();
-
-        if (!cpu_isset(cpu, flush_cpumask))
-                goto out;
-                /*
-                 * This was a BUG() but until someone can quote me the
-                 * line from the intel manual that guarantees an IPI to
-                 * multiple CPUs is retried _only_ on the erroring CPUs
-                 * its staying as a return
-                 *
-                 * BUG();
-                 */
-
-        if (flush_mm == x86_read_percpu(cpu_tlbstate.active_mm)) {
-                if (x86_read_percpu(cpu_tlbstate.state) == TLBSTATE_OK) {
-                        if (flush_va == TLB_FLUSH_ALL)
-                                local_flush_tlb();
-                        else
-                                __flush_tlb_one(flush_va);
-                } else
-                        leave_mm(cpu);
-        }
-        ack_APIC_irq();
-        smp_mb__before_clear_bit();
-        cpu_clear(cpu, flush_cpumask);
-        smp_mb__after_clear_bit();
-out:
-        put_cpu_no_resched();
-        inc_irq_stat(irq_tlb_count);
-}
-
-void native_flush_tlb_others(const cpumask_t *cpumaskp, struct mm_struct *mm,
-                             unsigned long va)
-{
-        cpumask_t cpumask = *cpumaskp;
-
-        /*
-         * A couple of (to be removed) sanity checks:
-         *
-         * - current CPU must not be in mask
-         * - mask must exist :)
-         */
-        BUG_ON(cpus_empty(cpumask));
-        BUG_ON(cpu_isset(smp_processor_id(), cpumask));
-        BUG_ON(!mm);
-
-#ifdef CONFIG_HOTPLUG_CPU
-        /* If a CPU which we ran on has gone down, OK. */
-        cpus_and(cpumask, cpumask, cpu_online_map);
-        if (unlikely(cpus_empty(cpumask)))
-                return;
-#endif
-
-        /*
-         * i'm not happy about this global shared spinlock in the
-         * MM hot path, but we'll see how contended it is.
-         * AK: x86-64 has a faster method that could be ported.
-         */
-        spin_lock(&tlbstate_lock);
-
-        flush_mm = mm;
-        flush_va = va;
-        cpus_or(flush_cpumask, cpumask, flush_cpumask);
-
-        /*
-         * Make the above memory operations globally visible before
-         * sending the IPI.
-         */
-        smp_mb();
-        /*
-         * We have to send the IPI only to
-         * CPUs affected.
-         */
-        send_IPI_mask(&cpumask, INVALIDATE_TLB_VECTOR);
-
-        while (!cpus_empty(flush_cpumask))
-                /* nothing. lockup detection does not belong here */
-                cpu_relax();
-
-        flush_mm = NULL;
-        flush_va = 0;
-        spin_unlock(&tlbstate_lock);
-}
-
-void flush_tlb_current_task(void)
-{
-        struct mm_struct *mm = current->mm;
-        cpumask_t cpu_mask;
-
-        preempt_disable();
-        cpu_mask = mm->cpu_vm_mask;
-        cpu_clear(smp_processor_id(), cpu_mask);
-
-        local_flush_tlb();
-        if (!cpus_empty(cpu_mask))
-                flush_tlb_others(cpu_mask, mm, TLB_FLUSH_ALL);
-        preempt_enable();
-}
-
-void flush_tlb_mm(struct mm_struct *mm)
-{
-        cpumask_t cpu_mask;
-
-        preempt_disable();
-        cpu_mask = mm->cpu_vm_mask;
-        cpu_clear(smp_processor_id(), cpu_mask);
-
-        if (current->active_mm == mm) {
-                if (current->mm)
-                        local_flush_tlb();
-                else
-                        leave_mm(smp_processor_id());
-        }
-        if (!cpus_empty(cpu_mask))
-                flush_tlb_others(cpu_mask, mm, TLB_FLUSH_ALL);
-
-        preempt_enable();
-}
-
-void flush_tlb_page(struct vm_area_struct *vma, unsigned long va)
-{
-        struct mm_struct *mm = vma->vm_mm;
-        cpumask_t cpu_mask;
-
-        preempt_disable();
-        cpu_mask = mm->cpu_vm_mask;
-        cpu_clear(smp_processor_id(), cpu_mask);
-
-        if (current->active_mm == mm) {
-                if (current->mm)
-                        __flush_tlb_one(va);
-                 else
-                        leave_mm(smp_processor_id());
-        }
-
-        if (!cpus_empty(cpu_mask))
-                flush_tlb_others(cpu_mask, mm, va);
-
-        preempt_enable();
-}
-EXPORT_SYMBOL(flush_tlb_page);
-
-static void do_flush_tlb_all(void *info)
-{
-        unsigned long cpu = smp_processor_id();
-
-        __flush_tlb_all();
-        if (x86_read_percpu(cpu_tlbstate.state) == TLBSTATE_LAZY)
-                leave_mm(cpu);
-}
-
-void flush_tlb_all(void)
-{
-        on_each_cpu(do_flush_tlb_all, NULL, 1);
-}
-
-void reset_lazy_tlbstate(void)
-{
-        int cpu = raw_smp_processor_id();
-
-        per_cpu(cpu_tlbstate, cpu).state = 0;
-        per_cpu(cpu_tlbstate, cpu).active_mm = &init_mm;
-}
-
diff --git a/arch/x86/kernel/tlb_uv.c b/arch/x86/kernel/tlb_uv.c
index 6812b829ed8..f396e61bcb3 100644
--- a/arch/x86/kernel/tlb_uv.c
+++ b/arch/x86/kernel/tlb_uv.c
@@ -11,6 +11,7 @@
 #include <linux/kernel.h>
 
 #include <asm/mmu_context.h>
+#include <asm/uv/uv.h>
 #include <asm/uv/uv_mmrs.h>
 #include <asm/uv/uv_hub.h>
 #include <asm/uv/uv_bau.h>
@@ -19,7 +20,7 @@
 #include <asm/tsc.h>
 #include <asm/irq_vectors.h>
 
-#include <mach_apic.h>
+#include <asm/genapic.h>
 
 static struct bau_control       **uv_bau_table_bases __read_mostly;
 static int                      uv_bau_retry_limit __read_mostly;
@@ -210,14 +211,15 @@ static int uv_wait_completion(struct bau_desc *bau_desc,
  *
  * Send a broadcast and wait for a broadcast message to complete.
  *
- * The cpumaskp mask contains the cpus the broadcast was sent to.
+ * The flush_mask contains the cpus the broadcast was sent to.
  *
- * Returns 1 if all remote flushing was done. The mask is zeroed.
- * Returns 0 if some remote flushing remains to be done. The mask is left
- * unchanged.
+ * Returns NULL if all remote flushing was done. The mask is zeroed.
+ * Returns @flush_mask if some remote flushing remains to be done. The
+ * mask will have some bits still set.
  */
-int uv_flush_send_and_wait(int cpu, int this_blade, struct bau_desc *bau_desc,
-                           cpumask_t *cpumaskp)
+const struct cpumask *uv_flush_send_and_wait(int cpu, int this_blade,
+                                             struct bau_desc *bau_desc,
+                                             struct cpumask *flush_mask)
 {
         int completion_status = 0;
         int right_shift;
@@ -257,66 +259,76 @@ int uv_flush_send_and_wait(int cpu, int this_blade, struct bau_desc *bau_desc,
                  * the cpu's, all of which are still in the mask.
                  */
                 __get_cpu_var(ptcstats).ptc_i++;
-                return 0;
+                return flush_mask;
         }
 
         /*
          * Success, so clear the remote cpu's from the mask so we don't
          * use the IPI method of shootdown on them.
          */
-        for_each_cpu_mask(bit, *cpumaskp) {
+        for_each_cpu(bit, flush_mask) {
                 blade = uv_cpu_to_blade_id(bit);
                 if (blade == this_blade)
                         continue;
-                cpu_clear(bit, *cpumaskp);
+                cpumask_clear_cpu(bit, flush_mask);
         }
-        if (!cpus_empty(*cpumaskp))
-                return 0;
-        return 1;
+        if (!cpumask_empty(flush_mask))
+                return flush_mask;
+        return NULL;
 }
 
 /**
  * uv_flush_tlb_others - globally purge translation cache of a virtual
  * address or all TLB's
- * @cpumaskp: mask of all cpu's in which the address is to be removed
+ * @cpumask: mask of all cpu's in which the address is to be removed
  * @mm: mm_struct containing virtual address range
  * @va: virtual address to be removed (or TLB_FLUSH_ALL for all TLB's on cpu)
+ * @cpu: the current cpu
  *
  * This is the entry point for initiating any UV global TLB shootdown.
  *
  * Purges the translation caches of all specified processors of the given
  * virtual address, or purges all TLB's on specified processors.
  *
- * The caller has derived the cpumaskp from the mm_struct and has subtracted
- * the local cpu from the mask.  This function is called only if there
- * are bits set in the mask. (e.g. flush_tlb_page())
+ * The caller has derived the cpumask from the mm_struct.  This function
+ * is called only if there are bits set in the mask. (e.g. flush_tlb_page())
  *
- * The cpumaskp is converted into a nodemask of the nodes containing
+ * The cpumask is converted into a nodemask of the nodes containing
  * the cpus.
  *
- * Returns 1 if all remote flushing was done.
- * Returns 0 if some remote flushing remains to be done.
+ * Note that this function should be called with preemption disabled.
+ *
+ * Returns NULL if all remote flushing was done.
+ * Returns pointer to cpumask if some remote flushing remains to be
+ * done.  The returned pointer is valid till preemption is re-enabled.
  */
-int uv_flush_tlb_others(cpumask_t *cpumaskp, struct mm_struct *mm,
-                        unsigned long va)
+const struct cpumask *uv_flush_tlb_others(const struct cpumask *cpumask,
+                                          struct mm_struct *mm,
+                                          unsigned long va, unsigned int cpu)
 {
+        static DEFINE_PER_CPU(cpumask_t, flush_tlb_mask);
+        struct cpumask *flush_mask = &__get_cpu_var(flush_tlb_mask);
         int i;
         int bit;
         int blade;
-        int cpu;
+        int uv_cpu;
         int this_blade;
         int locals = 0;
         struct bau_desc *bau_desc;
 
-        cpu = uv_blade_processor_id();
+        WARN_ON(!in_atomic());
+
+        cpumask_andnot(flush_mask, cpumask, cpumask_of(cpu));
+
+        uv_cpu = uv_blade_processor_id();
         this_blade = uv_numa_blade_id();
         bau_desc = __get_cpu_var(bau_control).descriptor_base;
-        bau_desc += UV_ITEMS_PER_DESCRIPTOR * cpu;
+        bau_desc += UV_ITEMS_PER_DESCRIPTOR * uv_cpu;
 
         bau_nodes_clear(&bau_desc->distribution, UV_DISTRIBUTION_SIZE);
 
         i = 0;
-        for_each_cpu_mask(bit, *cpumaskp) {
+        for_each_cpu(bit, flush_mask) {
                 blade = uv_cpu_to_blade_id(bit);
                 BUG_ON(blade > (UV_DISTRIBUTION_SIZE - 1));
                 if (blade == this_blade) {
@@ -331,17 +343,17 @@ int uv_flush_tlb_others(cpumask_t *cpumaskp, struct mm_struct *mm,
                  * no off_node flushing; return status for local node
                  */
                 if (locals)
-                        return 0;
+                        return flush_mask;
                 else
-                        return 1;
+                        return NULL;
         }
         __get_cpu_var(ptcstats).requestor++;
         __get_cpu_var(ptcstats).ntargeted += i;
 
         bau_desc->payload.address = va;
-        bau_desc->payload.sending_cpu = smp_processor_id();
+        bau_desc->payload.sending_cpu = cpu;
 
-        return uv_flush_send_and_wait(cpu, this_blade, bau_desc, cpumaskp);
+        return uv_flush_send_and_wait(uv_cpu, this_blade, bau_desc, flush_mask);
 }
 
 /*
diff --git a/arch/x86/kernel/trampoline_64.S b/arch/x86/kernel/trampoline_64.S
index 894293c598d..95a012a4664 100644
--- a/arch/x86/kernel/trampoline_64.S
+++ b/arch/x86/kernel/trampoline_64.S
@@ -29,6 +29,7 @@
 #include <asm/page.h>
 #include <asm/msr.h>
 #include <asm/segment.h>
+#include <asm/processor-flags.h>
 
 .section .rodata, "a", @progbits
 
@@ -37,7 +38,7 @@
 ENTRY(trampoline_data)
 r_base = .
         cli                     # We should be safe anyway
-        wbinvd  
+        wbinvd
         mov     %cs, %ax        # Code and data in the same place
         mov     %ax, %ds
         mov     %ax, %es
@@ -73,9 +74,8 @@ r_base = .
         lidtl   tidt - r_base   # load idt with 0, 0
         lgdtl   tgdt - r_base   # load gdt with whatever is appropriate
 
-        xor     %ax, %ax
-        inc     %ax             # protected mode (PE) bit
-        lmsw    %ax             # into protected mode
+        mov     $X86_CR0_PE, %ax        # protected mode (PE) bit
+        lmsw    %ax                     # into protected mode
 
         # flush prefetch and jump to startup_32
         ljmpl   *(startup_32_vector - r_base)
@@ -86,9 +86,8 @@ startup_32:
         movl    $__KERNEL_DS, %eax      # Initialize the %ds segment register
         movl    %eax, %ds
 
-        xorl    %eax, %eax
-        btsl    $5, %eax                # Enable PAE mode
-        movl    %eax, %cr4
+        movl    $X86_CR4_PAE, %eax
+        movl    %eax, %cr4              # Enable PAE mode
 
                                         # Setup trampoline 4 level pagetables
         leal    (trampoline_level4_pgt - r_base)(%esi), %eax
@@ -99,9 +98,9 @@ startup_32:
         xorl    %edx, %edx
         wrmsr
 
-        xorl    %eax, %eax
-        btsl    $31, %eax               # Enable paging and in turn activate Long Mode
-        btsl    $0, %eax                # Enable protected mode
+        # Enable paging and in turn activate Long Mode
+        # Enable protected mode
+        movl    $(X86_CR0_PG | X86_CR0_PE), %eax
         movl    %eax, %cr0
 
         /*
diff --git a/arch/x86/kernel/traps.c b/arch/x86/kernel/traps.c
index 98c2d055284..bde57f0f161 100644
--- a/arch/x86/kernel/traps.c
+++ b/arch/x86/kernel/traps.c
@@ -54,12 +54,11 @@
 #include <asm/desc.h>
 #include <asm/i387.h>
 
-#include <mach_traps.h>
+#include <asm/mach_traps.h>
 
 #ifdef CONFIG_X86_64
 #include <asm/pgalloc.h>
 #include <asm/proto.h>
-#include <asm/pda.h>
 #else
 #include <asm/processor-flags.h>
 #include <asm/arch_hooks.h>
@@ -896,7 +895,7 @@ asmlinkage void math_state_restore(void)
 EXPORT_SYMBOL_GPL(math_state_restore);
 
 #ifndef CONFIG_MATH_EMULATION
-asmlinkage void math_emulate(long arg)
+void math_emulate(struct math_emu_info *info)
 {
         printk(KERN_EMERG
                 "math-emulation not enabled and no coprocessor found.\n");
@@ -907,12 +906,16 @@ asmlinkage void math_emulate(long arg)
 #endif /* CONFIG_MATH_EMULATION */
 
 dotraplinkage void __kprobes
-do_device_not_available(struct pt_regs *regs, long error)
+do_device_not_available(struct pt_regs *regs, long error_code)
 {
 #ifdef CONFIG_X86_32
         if (read_cr0() & X86_CR0_EM) {
+                struct math_emu_info info = { };
+
                 conditional_sti(regs);
-                math_emulate(0);
+
+                info.regs = regs;
+                math_emulate(&info);
         } else {
                 math_state_restore(); /* interrupts still off */
                 conditional_sti(regs);
diff --git a/arch/x86/kernel/tsc.c b/arch/x86/kernel/tsc.c
index 599e5816863..83d53ce5d4c 100644
--- a/arch/x86/kernel/tsc.c
+++ b/arch/x86/kernel/tsc.c
@@ -773,7 +773,7 @@ __cpuinit int unsynchronized_tsc(void)
         if (!cpu_has_tsc || tsc_unstable)
                 return 1;
 
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_SMP
         if (apic_is_clustered_box())
                 return 1;
 #endif
diff --git a/arch/x86/kernel/visws_quirks.c b/arch/x86/kernel/visws_quirks.c
index d801d06af06..4fd646e6dd4 100644
--- a/arch/x86/kernel/visws_quirks.c
+++ b/arch/x86/kernel/visws_quirks.c
@@ -32,9 +32,9 @@
 #include <asm/e820.h>
 #include <asm/io.h>
 
-#include <mach_ipi.h>
+#include <asm/genapic.h>
 
-#include "mach_apic.h"
+#include <asm/genapic.h>
 
 #include <linux/kernel_stat.h>
 
@@ -200,7 +200,7 @@ static void __init MP_processor_info(struct mpc_cpu *m)
                 return;
         }
 
-        apic_cpus = apicid_to_cpu_present(m->apicid);
+        apic_cpus = apic->apicid_to_cpu_present(m->apicid);
         physids_or(phys_cpu_present_map, phys_cpu_present_map, apic_cpus);
         /*
          * Validate version
diff --git a/arch/x86/kernel/vm86_32.c b/arch/x86/kernel/vm86_32.c
index 4eeb5cf9720..d7ac84e7fc1 100644
--- a/arch/x86/kernel/vm86_32.c
+++ b/arch/x86/kernel/vm86_32.c
@@ -158,7 +158,7 @@ struct pt_regs *save_v86_state(struct kernel_vm86_regs *regs)
         ret = KVM86->regs32;
 
         ret->fs = current->thread.saved_fs;
-        loadsegment(gs, current->thread.saved_gs);
+        set_user_gs(ret, current->thread.saved_gs);
 
         return ret;
 }
@@ -197,9 +197,9 @@ out:
 static int do_vm86_irq_handling(int subfunction, int irqnumber);
 static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk);
 
-asmlinkage int sys_vm86old(struct pt_regs regs)
+int sys_vm86old(struct pt_regs *regs)
 {
-        struct vm86_struct __user *v86 = (struct vm86_struct __user *)regs.bx;
+        struct vm86_struct __user *v86 = (struct vm86_struct __user *)regs->bx;
         struct kernel_vm86_struct info; /* declare this _on top_,
                                          * this avoids wasting of stack space.
                                          * This remains on the stack until we
@@ -218,7 +218,7 @@ asmlinkage int sys_vm86old(struct pt_regs regs)
         if (tmp)
                 goto out;
         memset(&info.vm86plus, 0, (int)&info.regs32 - (int)&info.vm86plus);
-        info.regs32 = &regs;
+        info.regs32 = regs;
         tsk->thread.vm86_info = v86;
         do_sys_vm86(&info, tsk);
         ret = 0;        /* we never return here */
@@ -227,7 +227,7 @@ out:
 }
 
 
-asmlinkage int sys_vm86(struct pt_regs regs)
+int sys_vm86(struct pt_regs *regs)
 {
         struct kernel_vm86_struct info; /* declare this _on top_,
                                          * this avoids wasting of stack space.
@@ -239,12 +239,12 @@ asmlinkage int sys_vm86(struct pt_regs regs)
         struct vm86plus_struct __user *v86;
 
         tsk = current;
-        switch (regs.bx) {
+        switch (regs->bx) {
         case VM86_REQUEST_IRQ:
         case VM86_FREE_IRQ:
         case VM86_GET_IRQ_BITS:
         case VM86_GET_AND_RESET_IRQ:
-                ret = do_vm86_irq_handling(regs.bx, (int)regs.cx);
+                ret = do_vm86_irq_handling(regs->bx, (int)regs->cx);
                 goto out;
         case VM86_PLUS_INSTALL_CHECK:
                 /*
@@ -261,14 +261,14 @@ asmlinkage int sys_vm86(struct pt_regs regs)
         ret = -EPERM;
         if (tsk->thread.saved_sp0)
                 goto out;
-        v86 = (struct vm86plus_struct __user *)regs.cx;
+        v86 = (struct vm86plus_struct __user *)regs->cx;
         tmp = copy_vm86_regs_from_user(&info.regs, &v86->regs,
                                        offsetof(struct kernel_vm86_struct, regs32) -
                                        sizeof(info.regs));
         ret = -EFAULT;
         if (tmp)
                 goto out;
-        info.regs32 = &regs;
+        info.regs32 = regs;
         info.vm86plus.is_vm86pus = 1;
         tsk->thread.vm86_info = (struct vm86_struct __user *)v86;
         do_sys_vm86(&info, tsk);
@@ -323,7 +323,7 @@ static void do_sys_vm86(struct kernel_vm86_struct *info, struct task_struct *tsk
         info->regs32->ax = 0;
         tsk->thread.saved_sp0 = tsk->thread.sp0;
         tsk->thread.saved_fs = info->regs32->fs;
-        savesegment(gs, tsk->thread.saved_gs);
+        tsk->thread.saved_gs = get_user_gs(info->regs32);
 
         tss = &per_cpu(init_tss, get_cpu());
         tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
diff --git a/arch/x86/kernel/vmi_32.c b/arch/x86/kernel/vmi_32.c
index 1d3302cc2dd..f052c84ecbe 100644
--- a/arch/x86/kernel/vmi_32.c
+++ b/arch/x86/kernel/vmi_32.c
@@ -321,6 +321,16 @@ static void vmi_release_pmd(unsigned long pfn)
 }
 
 /*
+ * We use the pgd_free hook for releasing the pgd page:
+ */
+static void vmi_pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+        unsigned long pfn = __pa(pgd) >> PAGE_SHIFT;
+
+        vmi_ops.release_page(pfn, VMI_PAGE_L2);
+}
+
+/*
  * Helper macros for MMU update flags.  We can defer updates until a flush
  * or page invalidation only if the update is to the current address space
  * (otherwise, there is no flush).  We must check against init_mm, since
@@ -670,10 +680,11 @@ static inline int __init activate_vmi(void)
         para_fill(pv_mmu_ops.write_cr2, SetCR2);
         para_fill(pv_mmu_ops.write_cr3, SetCR3);
         para_fill(pv_cpu_ops.write_cr4, SetCR4);
-        para_fill(pv_irq_ops.save_fl, GetInterruptMask);
-        para_fill(pv_irq_ops.restore_fl, SetInterruptMask);
-        para_fill(pv_irq_ops.irq_disable, DisableInterrupts);
-        para_fill(pv_irq_ops.irq_enable, EnableInterrupts);
+
+        para_fill(pv_irq_ops.save_fl.func, GetInterruptMask);
+        para_fill(pv_irq_ops.restore_fl.func, SetInterruptMask);
+        para_fill(pv_irq_ops.irq_disable.func, DisableInterrupts);
+        para_fill(pv_irq_ops.irq_enable.func, EnableInterrupts);
 
         para_fill(pv_cpu_ops.wbinvd, WBINVD);
         para_fill(pv_cpu_ops.read_tsc, RDTSC);
@@ -762,6 +773,7 @@ static inline int __init activate_vmi(void)
         if (vmi_ops.release_page) {
                 pv_mmu_ops.release_pte = vmi_release_pte;
                 pv_mmu_ops.release_pmd = vmi_release_pmd;
+                pv_mmu_ops.pgd_free = vmi_pgd_free;
         }
 
         /* Set linear is needed in all cases */
diff --git a/arch/x86/kernel/vmiclock_32.c b/arch/x86/kernel/vmiclock_32.c
index c4c1f9e0940..a4791ef412d 100644
--- a/arch/x86/kernel/vmiclock_32.c
+++ b/arch/x86/kernel/vmiclock_32.c
@@ -256,7 +256,7 @@ void __devinit vmi_time_bsp_init(void)
          */
         clockevents_notify(CLOCK_EVT_NOTIFY_SUSPEND, NULL);
         local_irq_disable();
-#ifdef CONFIG_X86_SMP
+#ifdef CONFIG_SMP
         /*
          * XXX handle_percpu_irq only defined for SMP; we need to switch over
          * to using it, since this is a local interrupt, which each CPU must
diff --git a/arch/x86/kernel/vmlinux_32.lds.S b/arch/x86/kernel/vmlinux_32.lds.S
index 82c67559dde..3eba7f7bac0 100644
--- a/arch/x86/kernel/vmlinux_32.lds.S
+++ b/arch/x86/kernel/vmlinux_32.lds.S
@@ -178,14 +178,7 @@ SECTIONS
         __initramfs_end = .;
   }
 #endif
-  . = ALIGN(PAGE_SIZE);
-  .data.percpu  : AT(ADDR(.data.percpu) - LOAD_OFFSET) {
-        __per_cpu_start = .;
-        *(.data.percpu.page_aligned)
-        *(.data.percpu)
-        *(.data.percpu.shared_aligned)
-        __per_cpu_end = .;
-  }
+  PERCPU(PAGE_SIZE)
   . = ALIGN(PAGE_SIZE);
   /* freed after init ends here */
 
diff --git a/arch/x86/kernel/vmlinux_64.lds.S b/arch/x86/kernel/vmlinux_64.lds.S
index 1a614c0e6be..087a7f2c639 100644
--- a/arch/x86/kernel/vmlinux_64.lds.S
+++ b/arch/x86/kernel/vmlinux_64.lds.S
@@ -5,6 +5,7 @@
 #define LOAD_OFFSET __START_KERNEL_map
 
 #include <asm-generic/vmlinux.lds.h>
+#include <asm/asm-offsets.h>
 #include <asm/page.h>
 
 #undef i386     /* in case the preprocessor is a 32bit one */
@@ -13,12 +14,15 @@ OUTPUT_FORMAT("elf64-x86-64", "elf64-x86-64", "elf64-x86-64")
 OUTPUT_ARCH(i386:x86-64)
 ENTRY(phys_startup_64)
 jiffies_64 = jiffies;
-_proxy_pda = 1;
 PHDRS {
         text PT_LOAD FLAGS(5);  /* R_E */
         data PT_LOAD FLAGS(7);  /* RWE */
         user PT_LOAD FLAGS(7);  /* RWE */
         data.init PT_LOAD FLAGS(7);     /* RWE */
+#ifdef CONFIG_SMP
+        percpu PT_LOAD FLAGS(7);        /* RWE */
+#endif
+        data.init2 PT_LOAD FLAGS(7);    /* RWE */
         note PT_NOTE FLAGS(0);  /* ___ */
 }
 SECTIONS
@@ -208,14 +212,28 @@ SECTIONS
   __initramfs_end = .;
 #endif
 
+#ifdef CONFIG_SMP
+  /*
+   * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
+   * output PHDR, so the next output section - __data_nosave - should
+   * start another section data.init2.  Also, pda should be at the head of
+   * percpu area.  Preallocate it and define the percpu offset symbol
+   * so that it can be accessed as a percpu variable.
+   */
+  . = ALIGN(PAGE_SIZE);
+  PERCPU_VADDR(0, :percpu)
+#else
   PERCPU(PAGE_SIZE)
+#endif
 
   . = ALIGN(PAGE_SIZE);
   __init_end = .;
 
   . = ALIGN(PAGE_SIZE);
   __nosave_begin = .;
-  .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) { *(.data.nosave) }
+  .data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
+      *(.data.nosave)
+  } :data.init2 /* use another section data.init2, see PERCPU_VADDR() above */
   . = ALIGN(PAGE_SIZE);
   __nosave_end = .;
 
@@ -239,8 +257,21 @@ SECTIONS
   DWARF_DEBUG
 }
 
+ /*
+  * Per-cpu symbols which need to be offset from __per_cpu_load
+  * for the boot processor.
+  */
+#define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
+INIT_PER_CPU(gdt_page);
+INIT_PER_CPU(irq_stack_union);
+
 /*
  * Build-time check on the image size:
  */
 ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
         "kernel image bigger than KERNEL_IMAGE_SIZE")
+
+#ifdef CONFIG_SMP
+ASSERT((per_cpu__irq_stack_union == 0),
+        "irq_stack_union is not at start of per-cpu area");
+#endif
diff --git a/arch/x86/kernel/vsmp_64.c b/arch/x86/kernel/vsmp_64.c
index a688f3bfaec..c609205df59 100644
--- a/arch/x86/kernel/vsmp_64.c
+++ b/arch/x86/kernel/vsmp_64.c
@@ -37,6 +37,7 @@ static unsigned long vsmp_save_fl(void)
                 flags &= ~X86_EFLAGS_IF;
         return flags;
 }
+PV_CALLEE_SAVE_REGS_THUNK(vsmp_save_fl);
 
 static void vsmp_restore_fl(unsigned long flags)
 {
@@ -46,6 +47,7 @@ static void vsmp_restore_fl(unsigned long flags)
                 flags |= X86_EFLAGS_AC;
         native_restore_fl(flags);
 }
+PV_CALLEE_SAVE_REGS_THUNK(vsmp_restore_fl);
 
 static void vsmp_irq_disable(void)
 {
@@ -53,6 +55,7 @@ static void vsmp_irq_disable(void)
 
         native_restore_fl((flags & ~X86_EFLAGS_IF) | X86_EFLAGS_AC);
 }
+PV_CALLEE_SAVE_REGS_THUNK(vsmp_irq_disable);
 
 static void vsmp_irq_enable(void)
 {
@@ -60,6 +63,7 @@ static void vsmp_irq_enable(void)
 
         native_restore_fl((flags | X86_EFLAGS_IF) & (~X86_EFLAGS_AC));
 }
+PV_CALLEE_SAVE_REGS_THUNK(vsmp_irq_enable);
 
 static unsigned __init_or_module vsmp_patch(u8 type, u16 clobbers, void *ibuf,
                                   unsigned long addr, unsigned len)
@@ -90,10 +94,10 @@ static void __init set_vsmp_pv_ops(void)
                cap, ctl);
         if (cap & ctl & (1 << 4)) {
                 /* Setup irq ops and turn on vSMP  IRQ fastpath handling */
-                pv_irq_ops.irq_disable = vsmp_irq_disable;
-                pv_irq_ops.irq_enable  = vsmp_irq_enable;
-                pv_irq_ops.save_fl  = vsmp_save_fl;
-                pv_irq_ops.restore_fl  = vsmp_restore_fl;
+                pv_irq_ops.irq_disable = PV_CALLEE_SAVE(vsmp_irq_disable);
+                pv_irq_ops.irq_enable  = PV_CALLEE_SAVE(vsmp_irq_enable);
+                pv_irq_ops.save_fl  = PV_CALLEE_SAVE(vsmp_save_fl);
+                pv_irq_ops.restore_fl  = PV_CALLEE_SAVE(vsmp_restore_fl);
                 pv_init_ops.patch = vsmp_patch;
 
                 ctl &= ~(1 << 4);
diff --git a/arch/x86/kernel/x8664_ksyms_64.c b/arch/x86/kernel/x8664_ksyms_64.c
index 695e426aa35..3909e3ba5ce 100644
--- a/arch/x86/kernel/x8664_ksyms_64.c
+++ b/arch/x86/kernel/x8664_ksyms_64.c
@@ -58,5 +58,3 @@ EXPORT_SYMBOL(__memcpy);
 EXPORT_SYMBOL(empty_zero_page);
 EXPORT_SYMBOL(init_level4_pgt);
 EXPORT_SYMBOL(load_gs_index);
-
-EXPORT_SYMBOL(_proxy_pda);
diff --git a/arch/x86/lguest/boot.c b/arch/x86/lguest/boot.c
index 92f1c6f3e19..da2e314f61b 100644
--- a/arch/x86/lguest/boot.c
+++ b/arch/x86/lguest/boot.c
@@ -173,24 +173,29 @@ static unsigned long save_fl(void)
 {
         return lguest_data.irq_enabled;
 }
+PV_CALLEE_SAVE_REGS_THUNK(save_fl);
 
 /* restore_flags() just sets the flags back to the value given. */
 static void restore_fl(unsigned long flags)
 {
         lguest_data.irq_enabled = flags;
 }
+PV_CALLEE_SAVE_REGS_THUNK(restore_fl);
 
 /* Interrupts go off... */
 static void irq_disable(void)
 {
         lguest_data.irq_enabled = 0;
 }
+PV_CALLEE_SAVE_REGS_THUNK(irq_disable);
 
 /* Interrupts go on... */
 static void irq_enable(void)
 {
         lguest_data.irq_enabled = X86_EFLAGS_IF;
 }
+PV_CALLEE_SAVE_REGS_THUNK(irq_enable);
+
 /*:*/
 /*M:003 Note that we don't check for outstanding interrupts when we re-enable
  * them (or when we unmask an interrupt).  This seems to work for the moment,
@@ -278,7 +283,7 @@ static void lguest_load_tls(struct thread_struct *t, unsigned int cpu)
         /* There's one problem which normal hardware doesn't have: the Host
          * can't handle us removing entries we're currently using.  So we clear
          * the GS register here: if it's needed it'll be reloaded anyway. */
-        loadsegment(gs, 0);
+        lazy_load_gs(0);
         lazy_hcall(LHCALL_LOAD_TLS, __pa(&t->tls_array), cpu, 0);
 }
 
@@ -984,10 +989,10 @@ __init void lguest_init(void)
 
         /* interrupt-related operations */
         pv_irq_ops.init_IRQ = lguest_init_IRQ;
-        pv_irq_ops.save_fl = save_fl;
-        pv_irq_ops.restore_fl = restore_fl;
-        pv_irq_ops.irq_disable = irq_disable;
-        pv_irq_ops.irq_enable = irq_enable;
+        pv_irq_ops.save_fl = PV_CALLEE_SAVE(save_fl);
+        pv_irq_ops.restore_fl = PV_CALLEE_SAVE(restore_fl);
+        pv_irq_ops.irq_disable = PV_CALLEE_SAVE(irq_disable);
+        pv_irq_ops.irq_enable = PV_CALLEE_SAVE(irq_enable);
         pv_irq_ops.safe_halt = lguest_safe_halt;
 
         /* init-time operations */
diff --git a/arch/x86/mach-default/Makefile b/arch/x86/mach-default/Makefile
deleted file mode 100644
index 012fe34459e..00000000000
--- a/arch/x86/mach-default/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# Makefile for the linux kernel.
-#
-
-obj-y                           := setup.o
diff --git a/arch/x86/mach-default/setup.c b/arch/x86/mach-default/setup.c
deleted file mode 100644
index df167f26562..00000000000
--- a/arch/x86/mach-default/setup.c
+++ /dev/null
@@ -1,162 +0,0 @@
-/*
- *      Machine specific setup for generic
- */
-
-#include <linux/smp.h>
-#include <linux/init.h>
-#include <linux/interrupt.h>
-#include <asm/acpi.h>
-#include <asm/arch_hooks.h>
-#include <asm/e820.h>
-#include <asm/setup.h>
-
-#include <mach_ipi.h>
-
-#ifdef CONFIG_HOTPLUG_CPU
-#define DEFAULT_SEND_IPI        (1)
-#else
-#define DEFAULT_SEND_IPI        (0)
-#endif
-
-int no_broadcast = DEFAULT_SEND_IPI;
-
-/**
- * pre_intr_init_hook - initialisation prior to setting up interrupt vectors
- *
- * Description:
- *      Perform any necessary interrupt initialisation prior to setting up
- *      the "ordinary" interrupt call gates.  For legacy reasons, the ISA
- *      interrupts should be initialised here if the machine emulates a PC
- *      in any way.
- **/
-void __init pre_intr_init_hook(void)
-{
-        if (x86_quirks->arch_pre_intr_init) {
-                if (x86_quirks->arch_pre_intr_init())
-                        return;
-        }
-        init_ISA_irqs();
-}
-
-/**
- * intr_init_hook - post gate setup interrupt initialisation
- *
- * Description:
- *      Fill in any interrupts that may have been left out by the general
- *      init_IRQ() routine.  interrupts having to do with the machine rather
- *      than the devices on the I/O bus (like APIC interrupts in intel MP
- *      systems) are started here.
- **/
-void __init intr_init_hook(void)
-{
-        if (x86_quirks->arch_intr_init) {
-                if (x86_quirks->arch_intr_init())
-                        return;
-        }
-}
-
-/**
- * pre_setup_arch_hook - hook called prior to any setup_arch() execution
- *
- * Description:
- *      generally used to activate any machine specific identification
- *      routines that may be needed before setup_arch() runs.  On Voyager
- *      this is used to get the board revision and type.
- **/
-void __init pre_setup_arch_hook(void)
-{
-}
-
-/**
- * trap_init_hook - initialise system specific traps
- *
- * Description:
- *      Called as the final act of trap_init().  Used in VISWS to initialise
- *      the various board specific APIC traps.
- **/
-void __init trap_init_hook(void)
-{
-        if (x86_quirks->arch_trap_init) {
-                if (x86_quirks->arch_trap_init())
-                        return;
-        }
-}
-
-static struct irqaction irq0  = {
-        .handler = timer_interrupt,
-        .flags = IRQF_DISABLED | IRQF_NOBALANCING | IRQF_IRQPOLL,
-        .mask = CPU_MASK_NONE,
-        .name = "timer"
-};
-
-/**
- * pre_time_init_hook - do any specific initialisations before.
- *
- **/
-void __init pre_time_init_hook(void)
-{
-        if (x86_quirks->arch_pre_time_init)
-                x86_quirks->arch_pre_time_init();
-}
-
-/**
- * time_init_hook - do any specific initialisations for the system timer.
- *
- * Description:
- *      Must plug the system timer interrupt source at HZ into the IRQ listed
- *      in irq_vectors.h:TIMER_IRQ
- **/
-void __init time_init_hook(void)
-{
-        if (x86_quirks->arch_time_init) {
-                /*
-                 * A nonzero return code does not mean failure, it means
-                 * that the architecture quirk does not want any
-                 * generic (timer) setup to be performed after this:
-                 */
-                if (x86_quirks->arch_time_init())
-                        return;
-        }
-
-        irq0.mask = cpumask_of_cpu(0);
-        setup_irq(0, &irq0);
-}
-
-#ifdef CONFIG_MCA
-/**
- * mca_nmi_hook - hook into MCA specific NMI chain
- *
- * Description:
- *      The MCA (Microchannel Architecture) has an NMI chain for NMI sources
- *      along the MCA bus.  Use this to hook into that chain if you will need
- *      it.
- **/
-void mca_nmi_hook(void)
-{
-        /*
-         * If I recall correctly, there's a whole bunch of other things that
-         * we can do to check for NMI problems, but that's all I know about
-         * at the moment.
-         */
-        pr_warning("NMI generated from unknown source!\n");
-}
-#endif
-
-static __init int no_ipi_broadcast(char *str)
-{
-        get_option(&str, &no_broadcast);
-        pr_info("Using %s mode\n",
-                no_broadcast ? "No IPI Broadcast" : "IPI Broadcast");
-        return 1;
-}
-__setup("no_ipi_broadcast=", no_ipi_broadcast);
-
-static int __init print_ipi_mode(void)
-{
-        pr_info("Using IPI %s mode\n",
-                no_broadcast ? "No-Shortcut" : "Shortcut");
-        return 0;
-}
-
-late_initcall(print_ipi_mode);
-
diff --git a/arch/x86/mach-generic/Makefile b/arch/x86/mach-generic/Makefile
deleted file mode 100644
index 6730f4e7c74..00000000000
--- a/arch/x86/mach-generic/Makefile
+++ /dev/null
@@ -1,11 +0,0 @@
-#
-# Makefile for the generic architecture
-#
-
-EXTRA_CFLAGS                    := -Iarch/x86/kernel
-
-obj-y                           := probe.o default.o
-obj-$(CONFIG_X86_NUMAQ)         += numaq.o
-obj-$(CONFIG_X86_SUMMIT)        += summit.o
-obj-$(CONFIG_X86_BIGSMP)        += bigsmp.o
-obj-$(CONFIG_X86_ES7000)        += es7000.o
diff --git a/arch/x86/mach-generic/bigsmp.c b/arch/x86/mach-generic/bigsmp.c
deleted file mode 100644
index bc4c7840b2a..00000000000
--- a/arch/x86/mach-generic/bigsmp.c
+++ /dev/null
@@ -1,60 +0,0 @@
-/*
- * APIC driver for "bigsmp" XAPIC machines with more than 8 virtual CPUs.
- * Drives the local APIC in "clustered mode".
- */
-#define APIC_DEFINITION 1
-#include <linux/threads.h>
-#include <linux/cpumask.h>
-#include <asm/mpspec.h>
-#include <asm/genapic.h>
-#include <asm/fixmap.h>
-#include <asm/apicdef.h>
-#include <linux/kernel.h>
-#include <linux/init.h>
-#include <linux/dmi.h>
-#include <asm/bigsmp/apicdef.h>
-#include <linux/smp.h>
-#include <asm/bigsmp/apic.h>
-#include <asm/bigsmp/ipi.h>
-#include <asm/mach-default/mach_mpparse.h>
-#include <asm/mach-default/mach_wakecpu.h>
-
-static int dmi_bigsmp; /* can be set by dmi scanners */
-
-static int hp_ht_bigsmp(const struct dmi_system_id *d)
-{
-        printk(KERN_NOTICE "%s detected: force use of apic=bigsmp\n", d->ident);
-        dmi_bigsmp = 1;
-        return 0;
-}
-
-
-static const struct dmi_system_id bigsmp_dmi_table[] = {
-        { hp_ht_bigsmp, "HP ProLiant DL760 G2",
-        { DMI_MATCH(DMI_BIOS_VENDOR, "HP"),
-        DMI_MATCH(DMI_BIOS_VERSION, "P44-"),}
-        },
-
-        { hp_ht_bigsmp, "HP ProLiant DL740",
-        { DMI_MATCH(DMI_BIOS_VENDOR, "HP"),
-        DMI_MATCH(DMI_BIOS_VERSION, "P47-"),}
-        },
-         { }
-};
-
-static void vector_allocation_domain(int cpu, cpumask_t *retmask)
-{
-        cpus_clear(*retmask);
-        cpu_set(cpu, *retmask);
-}
-
-static int probe_bigsmp(void)
-{
-        if (def_to_bigsmp)
-                dmi_bigsmp = 1;
-        else
-                dmi_check_system(bigsmp_dmi_table);
-        return dmi_bigsmp;
-}
-
-struct genapic apic_bigsmp = APIC_INIT("bigsmp", probe_bigsmp);
diff --git a/arch/x86/mach-generic/default.c b/arch/x86/mach-generic/default.c
deleted file mode 100644
index e63a4a76d8c..00000000000
--- a/arch/x86/mach-generic/default.c
+++ /dev/null
@@ -1,27 +0,0 @@
-/*
- * Default generic APIC driver. This handles up to 8 CPUs.
- */
-#define APIC_DEFINITION 1
-#include <linux/threads.h>
-#include <linux/cpumask.h>
-#include <asm/mpspec.h>
-#include <asm/mach-default/mach_apicdef.h>
-#include <asm/genapic.h>
-#include <asm/fixmap.h>
-#include <asm/apicdef.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/smp.h>
-#include <linux/init.h>
-#include <asm/mach-default/mach_apic.h>
-#include <asm/mach-default/mach_ipi.h>
-#include <asm/mach-default/mach_mpparse.h>
-#include <asm/mach-default/mach_wakecpu.h>
-
-/* should be called last. */
-static int probe_default(void)
-{
-        return 1;
-}
-
-struct genapic apic_default = APIC_INIT("default", probe_default);
diff --git a/arch/x86/mach-generic/es7000.c b/arch/x86/mach-generic/es7000.c
deleted file mode 100644
index c2ded144802..00000000000
--- a/arch/x86/mach-generic/es7000.c
+++ /dev/null
@@ -1,103 +0,0 @@
-/*
- * APIC driver for the Unisys ES7000 chipset.
- */
-#define APIC_DEFINITION 1
-#include <linux/threads.h>
-#include <linux/cpumask.h>
-#include <asm/mpspec.h>
-#include <asm/genapic.h>
-#include <asm/fixmap.h>
-#include <asm/apicdef.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/init.h>
-#include <asm/es7000/apicdef.h>
-#include <linux/smp.h>
-#include <asm/es7000/apic.h>
-#include <asm/es7000/ipi.h>
-#include <asm/es7000/mpparse.h>
-#include <asm/mach-default/mach_wakecpu.h>
-
-void __init es7000_update_genapic_to_cluster(void)
-{
-        genapic->target_cpus = target_cpus_cluster;
-        genapic->int_delivery_mode = INT_DELIVERY_MODE_CLUSTER;
-        genapic->int_dest_mode = INT_DEST_MODE_CLUSTER;
-        genapic->no_balance_irq = NO_BALANCE_IRQ_CLUSTER;
-
-        genapic->init_apic_ldr = init_apic_ldr_cluster;
-
-        genapic->cpu_mask_to_apicid = cpu_mask_to_apicid_cluster;
-}
-
-static int probe_es7000(void)
-{
-        /* probed later in mptable/ACPI hooks */
-        return 0;
-}
-
-extern void es7000_sw_apic(void);
-static void __init enable_apic_mode(void)
-{
-        es7000_sw_apic();
-        return;
-}
-
-static __init int
-mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
-{
-        if (mpc->oemptr) {
-                struct mpc_oemtable *oem_table =
-                        (struct mpc_oemtable *)mpc->oemptr;
-                if (!strncmp(oem, "UNISYS", 6))
-                        return parse_unisys_oem((char *)oem_table);
-        }
-        return 0;
-}
-
-#ifdef CONFIG_ACPI
-/* Hook from generic ACPI tables.c */
-static int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-        unsigned long oem_addr = 0;
-        int check_dsdt;
-        int ret = 0;
-
-        /* check dsdt at first to avoid clear fix_map for oem_addr */
-        check_dsdt = es7000_check_dsdt();
-
-        if (!find_unisys_acpi_oem_table(&oem_addr)) {
-                if (check_dsdt)
-                        ret = parse_unisys_oem((char *)oem_addr);
-                else {
-                        setup_unisys();
-                        ret = 1;
-                }
-                /*
-                 * we need to unmap it
-                 */
-                unmap_unisys_acpi_oem_table(oem_addr);
-        }
-        return ret;
-}
-#else
-static int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-        return 0;
-}
-#endif
-
-static void vector_allocation_domain(int cpu, cpumask_t *retmask)
-{
-        /* Careful. Some cpus do not strictly honor the set of cpus
-         * specified in the interrupt destination when using lowest
-         * priority interrupt delivery mode.
-         *
-         * In particular there was a hyperthreading cpu observed to
-         * deliver interrupts to the wrong hyperthread when only one
-         * hyperthread was specified in the interrupt desitination.
-         */
-        *retmask = (cpumask_t){ { [0] = APIC_ALL_CPUS, } };
-}
-
-struct genapic __initdata_refok apic_es7000 = APIC_INIT("es7000", probe_es7000);
diff --git a/arch/x86/mach-generic/numaq.c b/arch/x86/mach-generic/numaq.c
deleted file mode 100644
index 3679e225564..00000000000
--- a/arch/x86/mach-generic/numaq.c
+++ /dev/null
@@ -1,53 +0,0 @@
-/*
- * APIC driver for the IBM NUMAQ chipset.
- */
-#define APIC_DEFINITION 1
-#include <linux/threads.h>
-#include <linux/cpumask.h>
-#include <asm/mpspec.h>
-#include <asm/genapic.h>
-#include <asm/fixmap.h>
-#include <asm/apicdef.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/init.h>
-#include <asm/numaq/apicdef.h>
-#include <linux/smp.h>
-#include <asm/numaq/apic.h>
-#include <asm/numaq/ipi.h>
-#include <asm/numaq/mpparse.h>
-#include <asm/numaq/wakecpu.h>
-#include <asm/numaq.h>
-
-static int mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
-{
-        numaq_mps_oem_check(mpc, oem, productid);
-        return found_numaq;
-}
-
-static int probe_numaq(void)
-{
-        /* already know from get_memcfg_numaq() */
-        return found_numaq;
-}
-
-/* Hook from generic ACPI tables.c */
-static int acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-        return 0;
-}
-
-static void vector_allocation_domain(int cpu, cpumask_t *retmask)
-{
-        /* Careful. Some cpus do not strictly honor the set of cpus
-         * specified in the interrupt destination when using lowest
-         * priority interrupt delivery mode.
-         *
-         * In particular there was a hyperthreading cpu observed to
-         * deliver interrupts to the wrong hyperthread when only one
-         * hyperthread was specified in the interrupt desitination.
-         */
-        *retmask = (cpumask_t){ { [0] = APIC_ALL_CPUS, } };
-}
-
-struct genapic apic_numaq = APIC_INIT("NUMAQ", probe_numaq);
diff --git a/arch/x86/mach-generic/probe.c b/arch/x86/mach-generic/probe.c
deleted file mode 100644
index 15a38daef1a..00000000000
--- a/arch/x86/mach-generic/probe.c
+++ /dev/null
@@ -1,152 +0,0 @@
-/*
- * Copyright 2003 Andi Kleen, SuSE Labs.
- * Subject to the GNU Public License, v.2
- *
- * Generic x86 APIC driver probe layer.
- */
-#include <linux/threads.h>
-#include <linux/cpumask.h>
-#include <linux/string.h>
-#include <linux/kernel.h>
-#include <linux/ctype.h>
-#include <linux/init.h>
-#include <linux/errno.h>
-#include <asm/fixmap.h>
-#include <asm/mpspec.h>
-#include <asm/apicdef.h>
-#include <asm/genapic.h>
-#include <asm/setup.h>
-
-extern struct genapic apic_numaq;
-extern struct genapic apic_summit;
-extern struct genapic apic_bigsmp;
-extern struct genapic apic_es7000;
-extern struct genapic apic_default;
-
-struct genapic *genapic = &apic_default;
-
-static struct genapic *apic_probe[] __initdata = {
-#ifdef CONFIG_X86_NUMAQ
-        &apic_numaq,
-#endif
-#ifdef CONFIG_X86_SUMMIT
-        &apic_summit,
-#endif
-#ifdef CONFIG_X86_BIGSMP
-        &apic_bigsmp,
-#endif
-#ifdef CONFIG_X86_ES7000
-        &apic_es7000,
-#endif
-        &apic_default,  /* must be last */
-        NULL,
-};
-
-static int cmdline_apic __initdata;
-static int __init parse_apic(char *arg)
-{
-        int i;
-
-        if (!arg)
-                return -EINVAL;
-
-        for (i = 0; apic_probe[i]; i++) {
-                if (!strcmp(apic_probe[i]->name, arg)) {
-                        genapic = apic_probe[i];
-                        cmdline_apic = 1;
-                        return 0;
-                }
-        }
-
-        if (x86_quirks->update_genapic)
-                x86_quirks->update_genapic();
-
-        /* Parsed again by __setup for debug/verbose */
-        return 0;
-}
-early_param("apic", parse_apic);
-
-void __init generic_bigsmp_probe(void)
-{
-#ifdef CONFIG_X86_BIGSMP
-        /*
-         * This routine is used to switch to bigsmp mode when
-         * - There is no apic= option specified by the user
-         * - generic_apic_probe() has chosen apic_default as the sub_arch
-         * - we find more than 8 CPUs in acpi LAPIC listing with xAPIC support
-         */
-
-        if (!cmdline_apic && genapic == &apic_default) {
-                if (apic_bigsmp.probe()) {
-                        genapic = &apic_bigsmp;
-                        if (x86_quirks->update_genapic)
-                                x86_quirks->update_genapic();
-                        printk(KERN_INFO "Overriding APIC driver with %s\n",
-                               genapic->name);
-                }
-        }
-#endif
-}
-
-void __init generic_apic_probe(void)
-{
-        if (!cmdline_apic) {
-                int i;
-                for (i = 0; apic_probe[i]; i++) {
-                        if (apic_probe[i]->probe()) {
-                                genapic = apic_probe[i];
-                                break;
-                        }
-                }
-                /* Not visible without early console */
-                if (!apic_probe[i])
-                        panic("Didn't find an APIC driver");
-
-                if (x86_quirks->update_genapic)
-                        x86_quirks->update_genapic();
-        }
-        printk(KERN_INFO "Using APIC driver %s\n", genapic->name);
-}
-
-/* These functions can switch the APIC even after the initial ->probe() */
-
-int __init mps_oem_check(struct mpc_table *mpc, char *oem, char *productid)
-{
-        int i;
-        for (i = 0; apic_probe[i]; ++i) {
-                if (apic_probe[i]->mps_oem_check(mpc, oem, productid)) {
-                        if (!cmdline_apic) {
-                                genapic = apic_probe[i];
-                                if (x86_quirks->update_genapic)
-                                        x86_quirks->update_genapic();
-                                printk(KERN_INFO "Switched to APIC driver `%s'.\n",
-                                       genapic->name);
-                        }
-                        return 1;
-                }
-        }
-        return 0;
-}
-
-int __init acpi_madt_oem_check(char *oem_id, char *oem_table_id)
-{
-        int i;
-        for (i = 0; apic_probe[i]; ++i) {
-                if (apic_probe[i]->acpi_madt_oem_check(oem_id, oem_table_id)) {
-                        if (!cmdline_apic) {
-                                genapic = apic_probe[i];
-                                if (x86_quirks->update_genapic)
-                                        x86_quirks->update_genapic();
-                                printk(KERN_INFO "Switched to APIC driver `%s'.\n",
-                                       genapic->name);
-                        }
-                        return 1;
-                }
-        }
-        return 0;
-}
-
-int hard_smp_processor_id(void)
-{
-        return genapic->get_apic_id(*(unsigned long *)(APIC_BASE+APIC_ID));
-}
diff --git a/arch/x86/mach-generic/summit.c b/arch/x86/mach-generic/summit.c
deleted file mode 100644
index 2821ffc188b..00000000000
--- a/arch/x86/mach-generic/summit.c
+++ /dev/null
@@ -1,40 +0,0 @@
-/*
- * APIC driver for the IBM "Summit" chipset.
- */
-#define APIC_DEFINITION 1
-#include <linux/threads.h>
-#include <linux/cpumask.h>
-#include <asm/mpspec.h>
-#include <asm/genapic.h>
-#include <asm/fixmap.h>
-#include <asm/apicdef.h>
-#include <linux/kernel.h>
-#include <linux/string.h>
-#include <linux/init.h>
-#include <asm/summit/apicdef.h>
-#include <linux/smp.h>
-#include <asm/summit/apic.h>
-#include <asm/summit/ipi.h>
-#include <asm/summit/mpparse.h>
-#include <asm/mach-default/mach_wakecpu.h>
-
-static int probe_summit(void)
-{
-        /* probed later in mptable/ACPI hooks */
-        return 0;
-}
-
-static void vector_allocation_domain(int cpu, cpumask_t *retmask)
-{
-        /* Careful. Some cpus do not strictly honor the set of cpus
-         * specified in the interrupt destination when using lowest
-         * priority interrupt delivery mode.
-         *
-         * In particular there was a hyperthreading cpu observed to
-         * deliver interrupts to the wrong hyperthread when only one
-         * hyperthread was specified in the interrupt desitination.
-         */
-        *retmask = (cpumask_t){ { [0] = APIC_ALL_CPUS, } };
-}
-
-struct genapic apic_summit = APIC_INIT("summit", probe_summit);
diff --git a/arch/x86/mach-rdc321x/Makefile b/arch/x86/mach-rdc321x/Makefile
deleted file mode 100644
index 8325b4ca431..00000000000
--- a/arch/x86/mach-rdc321x/Makefile
+++ /dev/null
@@ -1,5 +0,0 @@
-#
-# Makefile for the RDC321x specific parts of the kernel
-#
-obj-$(CONFIG_X86_RDC321X)        := gpio.o platform.o
-
diff --git a/arch/x86/mach-rdc321x/gpio.c b/arch/x86/mach-rdc321x/gpio.c
deleted file mode 100644
index 247f33d3a40..00000000000
--- a/arch/x86/mach-rdc321x/gpio.c
+++ /dev/null
@@ -1,194 +0,0 @@
-/*
- *  GPIO support for RDC SoC R3210/R8610
- *
- *  Copyright (C) 2007, Florian Fainelli <florian@openwrt.org>
- *  Copyright (C) 2008, Volker Weiss <dev@tintuc.de>
- *
- * This program is free software; you can redistribute it and/or modify
- * it under the terms of the GNU General Public License as published by
- * the Free Software Foundation; either version 2 of the License, or
- * (at your option) any later version.
- *
- * This program is distributed in the hope that it will be useful,
- * but WITHOUT ANY WARRANTY; without even the implied warranty of
- * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- * GNU General Public License for more details.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program; if not, write to the Free Software
- * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
- *
- */
-
-
-#include <linux/spinlock.h>
-#include <linux/io.h>
-#include <linux/types.h>
-#include <linux/module.h>
-
-#include <asm/gpio.h>
-#include <asm/mach-rdc321x/rdc321x_defs.h>
-
-
-/* spin lock to protect our private copy of GPIO data register plus
-   the access to PCI conf registers. */
-static DEFINE_SPINLOCK(gpio_lock);
-
-/* copy of GPIO data registers */
-static u32 gpio_data_reg1;
-static u32 gpio_data_reg2;
-
-static u32 gpio_request_data[2];
-
-
-static inline void rdc321x_conf_write(unsigned addr, u32 value)
-{
-        outl((1 << 31) | (7 << 11) | addr, RDC3210_CFGREG_ADDR);
-        outl(value, RDC3210_CFGREG_DATA);
-}
-
-static inline void rdc321x_conf_or(unsigned addr, u32 value)
-{
-        outl((1 << 31) | (7 << 11) | addr, RDC3210_CFGREG_ADDR);
-        value |= inl(RDC3210_CFGREG_DATA);
-        outl(value, RDC3210_CFGREG_DATA);
-}
-
-static inline u32 rdc321x_conf_read(unsigned addr)
-{
-        outl((1 << 31) | (7 << 11) | addr, RDC3210_CFGREG_ADDR);
-
-        return inl(RDC3210_CFGREG_DATA);
-}
-
-/* configure pin as GPIO */
-static void rdc321x_configure_gpio(unsigned gpio)
-{
-        unsigned long flags;
-
-        spin_lock_irqsave(&gpio_lock, flags);
-        rdc321x_conf_or(gpio < 32
-                ? RDC321X_GPIO_CTRL_REG1 : RDC321X_GPIO_CTRL_REG2,
-                1 << (gpio & 0x1f));
-        spin_unlock_irqrestore(&gpio_lock, flags);
-}
-
-/* initially setup the 2 copies of the gpio data registers.
-   This function must be called by the platform setup code. */
-void __init rdc321x_gpio_setup()
-{
-        /* this might not be, what others (BIOS, bootloader, etc.)
-           wrote to these registers before, but it's a good guess. Still
-           better than just using 0xffffffff. */
-
-        gpio_data_reg1 = rdc321x_conf_read(RDC321X_GPIO_DATA_REG1);
-        gpio_data_reg2 = rdc321x_conf_read(RDC321X_GPIO_DATA_REG2);
-}
-
-/* determine, if gpio number is valid */
-static inline int rdc321x_is_gpio(unsigned gpio)
-{
-        return gpio <= RDC321X_MAX_GPIO;
-}
-
-/* request GPIO */
-int rdc_gpio_request(unsigned gpio, const char *label)
-{
-        unsigned long flags;
-
-        if (!rdc321x_is_gpio(gpio))
-                return -EINVAL;
-
-        spin_lock_irqsave(&gpio_lock, flags);
-        if (gpio_request_data[(gpio & 0x20) ? 1 : 0] & (1 << (gpio & 0x1f)))
-                goto inuse;
-        gpio_request_data[(gpio & 0x20) ? 1 : 0] |= (1 << (gpio & 0x1f));
-        spin_unlock_irqrestore(&gpio_lock, flags);
-
-        return 0;
-inuse:
-        spin_unlock_irqrestore(&gpio_lock, flags);
-        return -EINVAL;
-}
-EXPORT_SYMBOL(rdc_gpio_request);
-
-/* release previously-claimed GPIO */
-void rdc_gpio_free(unsigned gpio)
-{
-        unsigned long flags;
-
-        if (!rdc321x_is_gpio(gpio))
-                return;
-
-        spin_lock_irqsave(&gpio_lock, flags);
-        gpio_request_data[(gpio & 0x20) ? 1 : 0] &= ~(1 << (gpio & 0x1f));
-        spin_unlock_irqrestore(&gpio_lock, flags);
-}
-EXPORT_SYMBOL(rdc_gpio_free);
-
-/* read GPIO pin */
-int rdc_gpio_get_value(unsigned gpio)
-{
-        u32 reg;
-        unsigned long flags;
-
-        spin_lock_irqsave(&gpio_lock, flags);
-        reg = rdc321x_conf_read(gpio < 32
-                ? RDC321X_GPIO_DATA_REG1 : RDC321X_GPIO_DATA_REG2);
-        spin_unlock_irqrestore(&gpio_lock, flags);
-
-        return (1 << (gpio & 0x1f)) & reg ? 1 : 0;
-}
-EXPORT_SYMBOL(rdc_gpio_get_value);
-
-/* set GPIO pin to value */
-void rdc_gpio_set_value(unsigned gpio, int value)
-{
-        unsigned long flags;
-        u32 reg;
-
-        reg = 1 << (gpio & 0x1f);
-        if (gpio < 32) {
-                spin_lock_irqsave(&gpio_lock, flags);
-                if (value)
-                        gpio_data_reg1 |= reg;
-                else
-                        gpio_data_reg1 &= ~reg;
-                rdc321x_conf_write(RDC321X_GPIO_DATA_REG1, gpio_data_reg1);
-                spin_unlock_irqrestore(&gpio_lock, flags);
-        } else {
-                spin_lock_irqsave(&gpio_lock, flags);
-                if (value)
-                        gpio_data_reg2 |= reg;
-                else
-                        gpio_data_reg2 &= ~reg;
-                rdc321x_conf_write(RDC321X_GPIO_DATA_REG2, gpio_data_reg2);
-                spin_unlock_irqrestore(&gpio_lock, flags);
-        }
-}
-EXPORT_SYMBOL(rdc_gpio_set_value);
-
-/* configure GPIO pin as input */
-int rdc_gpio_direction_input(unsigned gpio)
-{
-        if (!rdc321x_is_gpio(gpio))
-                return -EINVAL;
-
-        rdc321x_configure_gpio(gpio);
-
-        return 0;
-}
-EXPORT_SYMBOL(rdc_gpio_direction_input);
-
-/* configure GPIO pin as output and set value */
-int rdc_gpio_direction_output(unsigned gpio, int value)
-{
-        if (!rdc321x_is_gpio(gpio))
-                return -EINVAL;
-
-        gpio_set_value(gpio, value);
-        rdc321x_configure_gpio(gpio);
-
-        return 0;
-}
-EXPORT_SYMBOL(rdc_gpio_direction_output);
diff --git a/arch/x86/mach-rdc321x/platform.c b/arch/x86/mach-rdc321x/platform.c
deleted file mode 100644
index 4f4e50c3ad3..00000000000
--- a/arch/x86/mach-rdc321x/platform.c
+++ /dev/null
@@ -1,69 +0,0 @@
-/*
- *  Generic RDC321x platform devices
- *
- *  Copyright (C) 2007 Florian Fainelli <florian@openwrt.org>
- *
- *  This program is free software; you can redistribute it and/or
- *  modify it under the terms of the GNU General Public License
- *  as published by the Free Software Foundation; either version 2
- *  of the License, or (at your option) any later version.
- *
- *  This program is distributed in the hope that it will be useful,
- *  but WITHOUT ANY WARRANTY; without even the implied warranty of
- *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
- *  GNU General Public License for more details.
- *
- *  You should have received a copy of the GNU General Public License
- *  along with this program; if not, write to the
- *  Free Software Foundation, Inc., 51 Franklin Street, Fifth Floor,
- *  Boston, MA  02110-1301, USA.
- *
- */
-
-#include <linux/init.h>
-#include <linux/kernel.h>
-#include <linux/list.h>
-#include <linux/device.h>
-#include <linux/platform_device.h>
-#include <linux/leds.h>
-
-#include <asm/gpio.h>
-
-/* LEDS */
-static struct gpio_led default_leds[] = {
-        { .name = "rdc:dmz", .gpio = 1, },
-};
-
-static struct gpio_led_platform_data rdc321x_led_data = {
-        .num_leds = ARRAY_SIZE(default_leds),
-        .leds = default_leds,
-};
-
-static struct platform_device rdc321x_leds = {
-        .name = "leds-gpio",
-        .id = -1,
-        .dev = {
-                .platform_data = &rdc321x_led_data,
-        }
-};
-
-/* Watchdog */
-static struct platform_device rdc321x_wdt = {
-        .name = "rdc321x-wdt",
-        .id = -1,
-        .num_resources = 0,
-};
-
-static struct platform_device *rdc321x_devs[] = {
-        &rdc321x_leds,
-        &rdc321x_wdt
-};
-
-static int __init rdc_board_setup(void)
-{
-        rdc321x_gpio_setup();
-
-        return platform_add_devices(rdc321x_devs, ARRAY_SIZE(rdc321x_devs));
-}
-
-arch_initcall(rdc_board_setup);
diff --git a/arch/x86/mach-voyager/setup.c b/arch/x86/mach-voyager/setup.c
index a580b9562e7..66b7eb57d8e 100644
--- a/arch/x86/mach-voyager/setup.c
+++ b/arch/x86/mach-voyager/setup.c
@@ -9,6 +9,7 @@
 #include <asm/e820.h>
 #include <asm/io.h>
 #include <asm/setup.h>
+#include <asm/cpu.h>
 
 void __init pre_intr_init_hook(void)
 {
@@ -33,13 +34,23 @@ void __init intr_init_hook(void)
         setup_irq(2, &irq2);
 }
 
-void __init pre_setup_arch_hook(void)
+static void voyager_disable_tsc(void)
 {
         /* Voyagers run their CPUs from independent clocks, so disable
          * the TSC code because we can't sync them */
         setup_clear_cpu_cap(X86_FEATURE_TSC);
 }
 
+void __init pre_setup_arch_hook(void)
+{
+        voyager_disable_tsc();
+}
+
+void __init pre_time_init_hook(void)
+{
+        voyager_disable_tsc();
+}
+
 void __init trap_init_hook(void)
 {
 }
diff --git a/arch/x86/mach-voyager/voyager_smp.c b/arch/x86/mach-voyager/voyager_smp.c
index 9840b7ec749..98e3c2bc756 100644
--- a/arch/x86/mach-voyager/voyager_smp.c
+++ b/arch/x86/mach-voyager/voyager_smp.c
@@ -81,7 +81,7 @@ static void enable_local_vic_irq(unsigned int irq);
 static void disable_local_vic_irq(unsigned int irq);
 static void before_handle_vic_irq(unsigned int irq);
 static void after_handle_vic_irq(unsigned int irq);
-static void set_vic_irq_affinity(unsigned int irq, cpumask_t mask);
+static void set_vic_irq_affinity(unsigned int irq, const struct cpumask *mask);
 static void ack_vic_irq(unsigned int irq);
 static void vic_enable_cpi(void);
 static void do_boot_cpu(__u8 cpuid);
@@ -211,8 +211,6 @@ static __u32 cpu_booted_map;
 static cpumask_t smp_commenced_mask = CPU_MASK_NONE;
 
 /* This is for the new dynamic CPU boot code */
-cpumask_t cpu_callin_map = CPU_MASK_NONE;
-cpumask_t cpu_callout_map = CPU_MASK_NONE;
 
 /* The per processor IRQ masks (these are usually kept in sync) */
 static __u16 vic_irq_mask[NR_CPUS] __cacheline_aligned;
@@ -378,7 +376,7 @@ void __init find_smp_config(void)
         cpus_addr(phys_cpu_present_map)[0] |=
             voyager_extended_cmos_read(VOYAGER_PROCESSOR_PRESENT_MASK +
                                        3) << 24;
-        cpu_possible_map = phys_cpu_present_map;
+        init_cpu_possible(&phys_cpu_present_map);
         printk("VOYAGER SMP: phys_cpu_present_map = 0x%lx\n",
                cpus_addr(phys_cpu_present_map)[0]);
         /* Here we set up the VIC to enable SMP */
@@ -402,7 +400,7 @@ void __init find_smp_config(void)
              VOYAGER_SUS_IN_CONTROL_PORT);
 
         current_thread_info()->cpu = boot_cpu_id;
-        x86_write_percpu(cpu_number, boot_cpu_id);
+        percpu_write(cpu_number, boot_cpu_id);
 }
 
 /*
@@ -530,7 +528,6 @@ static void __init do_boot_cpu(__u8 cpu)
         /* init_tasks (in sched.c) is indexed logically */
         stack_start.sp = (void *)idle->thread.sp;
 
-        init_gdt(cpu);
         per_cpu(current_task, cpu) = idle;
         early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
         irq_ctx_init(cpu);
@@ -1599,16 +1596,16 @@ static void after_handle_vic_irq(unsigned int irq)
  * change the mask and then do an interrupt enable CPI to re-enable on
  * the selected processors */
 
-void set_vic_irq_affinity(unsigned int irq, cpumask_t mask)
+void set_vic_irq_affinity(unsigned int irq, const struct cpumask *mask)
 {
         /* Only extended processors handle interrupts */
         unsigned long real_mask;
         unsigned long irq_mask = 1 << irq;
         int cpu;
 
-        real_mask = cpus_addr(mask)[0] & voyager_extended_vic_processors;
+        real_mask = cpus_addr(*mask)[0] & voyager_extended_vic_processors;
 
-        if (cpus_addr(mask)[0] == 0)
+        if (cpus_addr(*mask)[0] == 0)
                 /* can't have no CPUs to accept the interrupt -- extremely
                  * bad things will happen */
                 return;
@@ -1747,13 +1744,14 @@ static void __init voyager_smp_prepare_cpus(unsigned int max_cpus)
 
 static void __cpuinit voyager_smp_prepare_boot_cpu(void)
 {
-        init_gdt(smp_processor_id());
-        switch_to_new_gdt();
+        int cpu = smp_processor_id();
+        switch_to_new_gdt(cpu);
+
+        cpu_set(cpu, cpu_online_map);
+        cpu_set(cpu, cpu_callout_map);
+        cpu_set(cpu, cpu_possible_map);
+        cpu_set(cpu, cpu_present_map);
 
-        cpu_set(smp_processor_id(), cpu_online_map);
-        cpu_set(smp_processor_id(), cpu_callout_map);
-        cpu_set(smp_processor_id(), cpu_possible_map);
-        cpu_set(smp_processor_id(), cpu_present_map);
 }
 
 static int __cpuinit voyager_cpu_up(unsigned int cpu)
@@ -1780,12 +1778,11 @@ static void __init voyager_smp_cpus_done(unsigned int max_cpus)
 void __init smp_setup_processor_id(void)
 {
         current_thread_info()->cpu = hard_smp_processor_id();
-        x86_write_percpu(cpu_number, hard_smp_processor_id());
 }
 
-static void voyager_send_call_func(cpumask_t callmask)
+static void voyager_send_call_func(const struct cpumask *callmask)
 {
-        __u32 mask = cpus_addr(callmask)[0] & ~(1 << smp_processor_id());
+        __u32 mask = cpus_addr(*callmask)[0] & ~(1 << smp_processor_id());
         send_CPI(mask, VIC_CALL_FUNCTION_CPI);
 }
 
diff --git a/arch/x86/math-emu/fpu_entry.c b/arch/x86/math-emu/fpu_entry.c
index c7b06feb139..5d87f586f8d 100644
--- a/arch/x86/math-emu/fpu_entry.c
+++ b/arch/x86/math-emu/fpu_entry.c
@@ -131,7 +131,7 @@ u_char emulating = 0;
 static int valid_prefix(u_char *Byte, u_char __user ** fpu_eip,
                         overrides * override);
 
-asmlinkage void math_emulate(long arg)
+void math_emulate(struct math_emu_info *info)
 {
         u_char FPU_modrm, byte1;
         unsigned short code;
@@ -161,7 +161,7 @@ asmlinkage void math_emulate(long arg)
         RE_ENTRANT_CHECK_ON;
 #endif /* RE_ENTRANT_CHECKING */
 
-        SETUP_DATA_AREA(arg);
+        FPU_info = info;
 
         FPU_ORIG_EIP = FPU_EIP;
 
@@ -659,7 +659,7 @@ static int valid_prefix(u_char *Byte, u_char __user **fpu_eip,
         }
 }
 
-void math_abort(struct info *info, unsigned int signal)
+void math_abort(struct math_emu_info *info, unsigned int signal)
 {
         FPU_EIP = FPU_ORIG_EIP;
         current->thread.trap_no = 16;
diff --git a/arch/x86/math-emu/fpu_proto.h b/arch/x86/math-emu/fpu_proto.h
index aa49b6a0d85..9779df436b7 100644
--- a/arch/x86/math-emu/fpu_proto.h
+++ b/arch/x86/math-emu/fpu_proto.h
@@ -51,8 +51,8 @@ extern void ffreep(void);
 extern void fst_i_(void);
 extern void fstp_i(void);
 /* fpu_entry.c */
-asmlinkage extern void math_emulate(long arg);
-extern void math_abort(struct info *info, unsigned int signal);
+extern void math_emulate(struct math_emu_info *info);
+extern void math_abort(struct math_emu_info *info, unsigned int signal);
 /* fpu_etc.c */
 extern void FPU_etc(void);
 /* fpu_tags.c */
diff --git a/arch/x86/math-emu/fpu_system.h b/arch/x86/math-emu/fpu_system.h
index 13488fa153e..50fa0ec2c8a 100644
--- a/arch/x86/math-emu/fpu_system.h
+++ b/arch/x86/math-emu/fpu_system.h
@@ -16,10 +16,6 @@
 #include <linux/kernel.h>
 #include <linux/mm.h>
 
-/* This sets the pointer FPU_info to point to the argument part
-   of the stack frame of math_emulate() */
-#define SETUP_DATA_AREA(arg)    FPU_info = (struct info *) &arg
-
 /* s is always from a cpu register, and the cpu does bounds checking
  * during register load --> no further bounds checks needed */
 #define LDT_DESCRIPTOR(s)       (((struct desc_struct *)current->mm->context.ldt)[(s) >> 3])
@@ -38,12 +34,12 @@
 #define I387                    (current->thread.xstate)
 #define FPU_info                (I387->soft.info)
 
-#define FPU_CS                  (*(unsigned short *) &(FPU_info->___cs))
-#define FPU_SS                  (*(unsigned short *) &(FPU_info->___ss))
-#define FPU_DS                  (*(unsigned short *) &(FPU_info->___ds))
-#define FPU_EAX                 (FPU_info->___eax)
-#define FPU_EFLAGS              (FPU_info->___eflags)
-#define FPU_EIP                 (FPU_info->___eip)
+#define FPU_CS                  (*(unsigned short *) &(FPU_info->regs->cs))
+#define FPU_SS                  (*(unsigned short *) &(FPU_info->regs->ss))
+#define FPU_DS                  (*(unsigned short *) &(FPU_info->regs->ds))
+#define FPU_EAX                 (FPU_info->regs->ax)
+#define FPU_EFLAGS              (FPU_info->regs->flags)
+#define FPU_EIP                 (FPU_info->regs->ip)
 #define FPU_ORIG_EIP            (FPU_info->___orig_eip)
 
 #define FPU_lookahead           (I387->soft.lookahead)
diff --git a/arch/x86/math-emu/get_address.c b/arch/x86/math-emu/get_address.c
index d701e2b39e4..6ef5e99380f 100644
--- a/arch/x86/math-emu/get_address.c
+++ b/arch/x86/math-emu/get_address.c
@@ -29,46 +29,43 @@
 #define FPU_WRITE_BIT 0x10
 
 static int reg_offset[] = {
-        offsetof(struct info, ___eax),
-        offsetof(struct info, ___ecx),
-        offsetof(struct info, ___edx),
-        offsetof(struct info, ___ebx),
-        offsetof(struct info, ___esp),
-        offsetof(struct info, ___ebp),
-        offsetof(struct info, ___esi),
-        offsetof(struct info, ___edi)
+        offsetof(struct pt_regs, ax),
+        offsetof(struct pt_regs, cx),
+        offsetof(struct pt_regs, dx),
+        offsetof(struct pt_regs, bx),
+        offsetof(struct pt_regs, sp),
+        offsetof(struct pt_regs, bp),
+        offsetof(struct pt_regs, si),
+        offsetof(struct pt_regs, di)
 };
 
-#define REG_(x) (*(long *)(reg_offset[(x)]+(u_char *) FPU_info))
+#define REG_(x) (*(long *)(reg_offset[(x)] + (u_char *)FPU_info->regs))
 
 static int reg_offset_vm86[] = {
-        offsetof(struct info, ___cs),
-        offsetof(struct info, ___vm86_ds),
-        offsetof(struct info, ___vm86_es),
-        offsetof(struct info, ___vm86_fs),
-        offsetof(struct info, ___vm86_gs),
-        offsetof(struct info, ___ss),
-        offsetof(struct info, ___vm86_ds)
+        offsetof(struct pt_regs, cs),
+        offsetof(struct kernel_vm86_regs, ds),
+        offsetof(struct kernel_vm86_regs, es),
+        offsetof(struct kernel_vm86_regs, fs),
+        offsetof(struct kernel_vm86_regs, gs),
+        offsetof(struct pt_regs, ss),
+        offsetof(struct kernel_vm86_regs, ds)
 };
 
 #define VM86_REG_(x) (*(unsigned short *) \
-                      (reg_offset_vm86[((unsigned)x)]+(u_char *) FPU_info))
-
-/* This dummy, gs is not saved on the stack. */
-#define ___GS ___ds
+                (reg_offset_vm86[((unsigned)x)] + (u_char *)FPU_info->regs))
 
 static int reg_offset_pm[] = {
-        offsetof(struct info, ___cs),
-        offsetof(struct info, ___ds),
-        offsetof(struct info, ___es),
-        offsetof(struct info, ___fs),
-        offsetof(struct info, ___GS),
-        offsetof(struct info, ___ss),
-        offsetof(struct info, ___ds)
+        offsetof(struct pt_regs, cs),
+        offsetof(struct pt_regs, ds),
+        offsetof(struct pt_regs, es),
+        offsetof(struct pt_regs, fs),
+        offsetof(struct pt_regs, ds),   /* dummy, not saved on stack */
+        offsetof(struct pt_regs, ss),
+        offsetof(struct pt_regs, ds)
 };
 
 #define PM_REG_(x) (*(unsigned short *) \
-                      (reg_offset_pm[((unsigned)x)]+(u_char *) FPU_info))
+                (reg_offset_pm[((unsigned)x)] + (u_char *)FPU_info->regs))
 
 /* Decode the SIB byte. This function assumes mod != 0 */
 static int sib(int mod, unsigned long *fpu_eip)
@@ -153,11 +150,9 @@ static long pm_address(u_char FPU_modrm, u_char segment,
 #endif /* PARANOID */
 
         switch (segment) {
-                /* gs isn't used by the kernel, so it still has its
-                   user-space value. */
         case PREFIX_GS_ - 1:
-                /* N.B. - movl %seg, mem is a 2 byte write regardless of prefix */
-                savesegment(gs, addr->selector);
+                /* user gs handling can be lazy, use special accessors */
+                addr->selector = get_user_gs(FPU_info->regs);
                 break;
         default:
                 addr->selector = PM_REG_(segment);
@@ -349,34 +344,34 @@ void __user *FPU_get_address_16(u_char FPU_modrm, unsigned long *fpu_eip,
         }
         switch (rm) {
         case 0:
-                address += FPU_info->___ebx + FPU_info->___esi;
+                address += FPU_info->regs->bx + FPU_info->regs->si;
                 break;
         case 1:
-                address += FPU_info->___ebx + FPU_info->___edi;
+                address += FPU_info->regs->bx + FPU_info->regs->di;
                 break;
         case 2:
-                address += FPU_info->___ebp + FPU_info->___esi;
+                address += FPU_info->regs->bp + FPU_info->regs->si;
                 if (addr_modes.override.segment == PREFIX_DEFAULT)
                         addr_modes.override.segment = PREFIX_SS_;
                 break;
         case 3:
-                address += FPU_info->___ebp + FPU_info->___edi;
+                address += FPU_info->regs->bp + FPU_info->regs->di;
                 if (addr_modes.override.segment == PREFIX_DEFAULT)
                         addr_modes.override.segment = PREFIX_SS_;
                 break;
         case 4:
-                address += FPU_info->___esi;
+                address += FPU_info->regs->si;
                 break;
         case 5:
-                address += FPU_info->___edi;
+                address += FPU_info->regs->di;
                 break;
         case 6:
-                address += FPU_info->___ebp;
+                address += FPU_info->regs->bp;
                 if (addr_modes.override.segment == PREFIX_DEFAULT)
                         addr_modes.override.segment = PREFIX_SS_;
                 break;
         case 7:
-                address += FPU_info->___ebx;
+                address += FPU_info->regs->bx;
                 break;
         }
 
diff --git a/arch/x86/mm/Makefile b/arch/x86/mm/Makefile
index d8cc96a2738..2b938a38491 100644
--- a/arch/x86/mm/Makefile
+++ b/arch/x86/mm/Makefile
@@ -1,6 +1,8 @@
 obj-y   :=  init_$(BITS).o fault.o ioremap.o extable.o pageattr.o mmap.o \
             pat.o pgtable.o gup.o
 
+obj-$(CONFIG_SMP)               += tlb.o
+
 obj-$(CONFIG_X86_32)            += pgtable_32.o iomap_32.o
 
 obj-$(CONFIG_HUGETLB_PAGE)      += hugetlbpage.o
diff --git a/arch/x86/mm/extable.c b/arch/x86/mm/extable.c
index 7e8db53528a..61b41ca3b5a 100644
--- a/arch/x86/mm/extable.c
+++ b/arch/x86/mm/extable.c
@@ -23,6 +23,12 @@ int fixup_exception(struct pt_regs *regs)
 
         fixup = search_exception_tables(regs->ip);
         if (fixup) {
+                /* If fixup is less than 16, it means uaccess error */
+                if (fixup->fixup < 16) {
+                        current_thread_info()->uaccess_err = -EFAULT;
+                        regs->ip += fixup->fixup;
+                        return 1;
+                }
                 regs->ip = fixup->fixup;
                 return 1;
         }
diff --git a/arch/x86/mm/fault.c b/arch/x86/mm/fault.c
index 90dfae511a4..29644175490 100644
--- a/arch/x86/mm/fault.c
+++ b/arch/x86/mm/fault.c
@@ -26,6 +26,7 @@
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
 #include <linux/kdebug.h>
+#include <linux/magic.h>
 
 #include <asm/system.h>
 #include <asm/desc.h>
@@ -91,8 +92,8 @@ static inline int notify_page_fault(struct pt_regs *regs)
  *
  * Opcode checker based on code by Richard Brunner
  */
-static int is_prefetch(struct pt_regs *regs, unsigned long addr,
-                       unsigned long error_code)
+static int is_prefetch(struct pt_regs *regs, unsigned long error_code,
+                        unsigned long addr)
 {
         unsigned char *instr;
         int scan_more = 1;
@@ -409,17 +410,16 @@ static void show_fault_oops(struct pt_regs *regs, unsigned long error_code,
 }
 
 #ifdef CONFIG_X86_64
-static noinline void pgtable_bad(unsigned long address, struct pt_regs *regs,
-                                 unsigned long error_code)
+static noinline void pgtable_bad(struct pt_regs *regs,
+                         unsigned long error_code, unsigned long address)
 {
         unsigned long flags = oops_begin();
         int sig = SIGKILL;
-        struct task_struct *tsk;
+        struct task_struct *tsk = current;
 
         printk(KERN_ALERT "%s: Corrupted page table at address %lx\n",
-               current->comm, address);
+               tsk->comm, address);
         dump_pagetable(address);
-        tsk = current;
         tsk->thread.cr2 = address;
         tsk->thread.trap_no = 14;
         tsk->thread.error_code = error_code;
@@ -429,6 +429,196 @@ static noinline void pgtable_bad(unsigned long address, struct pt_regs *regs,
 }
 #endif
 
+static noinline void no_context(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address)
+{
+        struct task_struct *tsk = current;
+        unsigned long *stackend;
+
+#ifdef CONFIG_X86_64
+        unsigned long flags;
+        int sig;
+#endif
+
+        /* Are we prepared to handle this kernel fault?  */
+        if (fixup_exception(regs))
+                return;
+
+        /*
+         * X86_32
+         * Valid to do another page fault here, because if this fault
+         * had been triggered by is_prefetch fixup_exception would have
+         * handled it.
+         *
+         * X86_64
+         * Hall of shame of CPU/BIOS bugs.
+         */
+        if (is_prefetch(regs, error_code, address))
+                return;
+
+        if (is_errata93(regs, address))
+                return;
+
+        /*
+         * Oops. The kernel tried to access some bad page. We'll have to
+         * terminate things with extreme prejudice.
+         */
+#ifdef CONFIG_X86_32
+        bust_spinlocks(1);
+#else
+        flags = oops_begin();
+#endif
+
+        show_fault_oops(regs, error_code, address);
+
+        stackend = end_of_stack(tsk);
+        if (*stackend != STACK_END_MAGIC)
+                printk(KERN_ALERT "Thread overran stack, or stack corrupted\n");
+
+        tsk->thread.cr2 = address;
+        tsk->thread.trap_no = 14;
+        tsk->thread.error_code = error_code;
+
+#ifdef CONFIG_X86_32
+        die("Oops", regs, error_code);
+        bust_spinlocks(0);
+        do_exit(SIGKILL);
+#else
+        sig = SIGKILL;
+        if (__die("Oops", regs, error_code))
+                sig = 0;
+        /* Executive summary in case the body of the oops scrolled away */
+        printk(KERN_EMERG "CR2: %016lx\n", address);
+        oops_end(flags, regs, sig);
+#endif
+}
+
+static void __bad_area_nosemaphore(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address,
+                        int si_code)
+{
+        struct task_struct *tsk = current;
+
+        /* User mode accesses just cause a SIGSEGV */
+        if (error_code & PF_USER) {
+                /*
+                 * It's possible to have interrupts off here.
+                 */
+                local_irq_enable();
+
+                /*
+                 * Valid to do another page fault here because this one came
+                 * from user space.
+                 */
+                if (is_prefetch(regs, error_code, address))
+                        return;
+
+                if (is_errata100(regs, address))
+                        return;
+
+                if (show_unhandled_signals && unhandled_signal(tsk, SIGSEGV) &&
+                    printk_ratelimit()) {
+                        printk(
+                        "%s%s[%d]: segfault at %lx ip %p sp %p error %lx",
+                        task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
+                        tsk->comm, task_pid_nr(tsk), address,
+                        (void *) regs->ip, (void *) regs->sp, error_code);
+                        print_vma_addr(" in ", regs->ip);
+                        printk("\n");
+                }
+
+                tsk->thread.cr2 = address;
+                /* Kernel addresses are always protection faults */
+                tsk->thread.error_code = error_code | (address >= TASK_SIZE);
+                tsk->thread.trap_no = 14;
+                force_sig_info_fault(SIGSEGV, si_code, address, tsk);
+                return;
+        }
+
+        if (is_f00f_bug(regs, address))
+                return;
+
+        no_context(regs, error_code, address);
+}
+
+static noinline void bad_area_nosemaphore(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address)
+{
+        __bad_area_nosemaphore(regs, error_code, address, SEGV_MAPERR);
+}
+
+static void __bad_area(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address,
+                        int si_code)
+{
+        struct mm_struct *mm = current->mm;
+
+        /*
+         * Something tried to access memory that isn't in our memory map..
+         * Fix it, but check if it's kernel or user first..
+         */
+        up_read(&mm->mmap_sem);
+
+        __bad_area_nosemaphore(regs, error_code, address, si_code);
+}
+
+static noinline void bad_area(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address)
+{
+        __bad_area(regs, error_code, address, SEGV_MAPERR);
+}
+
+static noinline void bad_area_access_error(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address)
+{
+        __bad_area(regs, error_code, address, SEGV_ACCERR);
+}
+
+/* TODO: fixup for "mm-invoke-oom-killer-from-page-fault.patch" */
+static void out_of_memory(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address)
+{
+        /*
+         * We ran out of memory, call the OOM killer, and return the userspace
+         * (which will retry the fault, or kill us if we got oom-killed).
+         */
+        up_read(&current->mm->mmap_sem);
+        pagefault_out_of_memory();
+}
+
+static void do_sigbus(struct pt_regs *regs,
+                        unsigned long error_code, unsigned long address)
+{
+        struct task_struct *tsk = current;
+        struct mm_struct *mm = tsk->mm;
+
+        up_read(&mm->mmap_sem);
+
+        /* Kernel mode? Handle exceptions or die */
+        if (!(error_code & PF_USER))
+                no_context(regs, error_code, address);
+#ifdef CONFIG_X86_32
+        /* User space => ok to do another page fault */
+        if (is_prefetch(regs, error_code, address))
+                return;
+#endif
+        tsk->thread.cr2 = address;
+        tsk->thread.error_code = error_code;
+        tsk->thread.trap_no = 14;
+        force_sig_info_fault(SIGBUS, BUS_ADRERR, address, tsk);
+}
+
+static noinline void mm_fault_error(struct pt_regs *regs,
+                unsigned long error_code, unsigned long address, unsigned int fault)
+{
+        if (fault & VM_FAULT_OOM)
+                out_of_memory(regs, error_code, address);
+        else if (fault & VM_FAULT_SIGBUS)
+                do_sigbus(regs, error_code, address);
+        else
+                BUG();
+}
+
 static int spurious_fault_check(unsigned long error_code, pte_t *pte)
 {
         if ((error_code & PF_WRITE) && !pte_write(*pte))
@@ -448,8 +638,8 @@ static int spurious_fault_check(unsigned long error_code, pte_t *pte)
  * There are no security implications to leaving a stale TLB when
  * increasing the permissions on a page.
  */
-static int spurious_fault(unsigned long address,
-                          unsigned long error_code)
+static noinline int spurious_fault(unsigned long error_code,
+                                unsigned long address)
 {
         pgd_t *pgd;
         pud_t *pud;
@@ -494,7 +684,7 @@ static int spurious_fault(unsigned long address,
  *
  * This assumes no large pages in there.
  */
-static int vmalloc_fault(unsigned long address)
+static noinline int vmalloc_fault(unsigned long address)
 {
 #ifdef CONFIG_X86_32
         unsigned long pgd_paddr;
@@ -573,6 +763,34 @@ static int vmalloc_fault(unsigned long address)
 
 int show_unhandled_signals = 1;
 
+static inline int access_error(unsigned long error_code, int write,
+                                struct vm_area_struct *vma)
+{
+        if (write) {
+                /* write, present and write, not present */
+                if (unlikely(!(vma->vm_flags & VM_WRITE)))
+                        return 1;
+        } else if (unlikely(error_code & PF_PROT)) {
+                /* read, present */
+                return 1;
+        } else {
+                /* read, not present */
+                if (unlikely(!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE))))
+                        return 1;
+        }
+
+        return 0;
+}
+
+static int fault_in_kernel_space(unsigned long address)
+{
+#ifdef CONFIG_X86_32
+        return address >= TASK_SIZE;
+#else /* !CONFIG_X86_32 */
+        return address >= TASK_SIZE64;
+#endif /* CONFIG_X86_32 */
+}
+
 /*
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
@@ -583,16 +801,12 @@ asmlinkage
 #endif
 void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
 {
+        unsigned long address;
         struct task_struct *tsk;
         struct mm_struct *mm;
         struct vm_area_struct *vma;
-        unsigned long address;
-        int write, si_code;
+        int write;
         int fault;
-#ifdef CONFIG_X86_64
-        unsigned long flags;
-        int sig;
-#endif
 
         tsk = current;
         mm = tsk->mm;
@@ -601,10 +815,6 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
         /* get the address */
         address = read_cr2();
 
-        si_code = SEGV_MAPERR;
-
-        if (notify_page_fault(regs))
-                return;
         if (unlikely(kmmio_fault(regs, address)))
                 return;
 
@@ -621,27 +831,29 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
          * (error_code & 4) == 0, and that the fault was not a
          * protection error (error_code & 9) == 0.
          */
-#ifdef CONFIG_X86_32
-        if (unlikely(address >= TASK_SIZE)) {
-#else
-        if (unlikely(address >= TASK_SIZE64)) {
-#endif
+        if (unlikely(fault_in_kernel_space(address))) {
                 if (!(error_code & (PF_RSVD|PF_USER|PF_PROT)) &&
                     vmalloc_fault(address) >= 0)
                         return;
 
                 /* Can handle a stale RO->RW TLB */
-                if (spurious_fault(address, error_code))
+                if (spurious_fault(error_code, address))
                         return;
 
+                /* kprobes don't want to hook the spurious faults. */
+                if (notify_page_fault(regs))
+                        return;
                 /*
                  * Don't take the mm semaphore here. If we fixup a prefetch
                  * fault we could otherwise deadlock.
                  */
-                goto bad_area_nosemaphore;
+                bad_area_nosemaphore(regs, error_code, address);
+                return;
         }
 
-
+        /* kprobes don't want to hook the spurious faults. */
+        if (unlikely(notify_page_fault(regs)))
+                return;
         /*
          * It's safe to allow irq's after cr2 has been saved and the
          * vmalloc fault has been handled.
@@ -657,15 +869,17 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
 
 #ifdef CONFIG_X86_64
         if (unlikely(error_code & PF_RSVD))
-                pgtable_bad(address, regs, error_code);
+                pgtable_bad(regs, error_code, address);
 #endif
 
         /*
          * If we're in an interrupt, have no user context or are running in an
          * atomic region then we must not take the fault.
          */
-        if (unlikely(in_atomic() || !mm))
-                goto bad_area_nosemaphore;
+        if (unlikely(in_atomic() || !mm)) {
+                bad_area_nosemaphore(regs, error_code, address);
+                return;
+        }
 
         /*
          * When running in the kernel we expect faults to occur only to
@@ -683,20 +897,32 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
          * source.  If this is invalid we can skip the address space check,
          * thus avoiding the deadlock.
          */
-        if (!down_read_trylock(&mm->mmap_sem)) {
+        if (unlikely(!down_read_trylock(&mm->mmap_sem))) {
                 if ((error_code & PF_USER) == 0 &&
-                    !search_exception_tables(regs->ip))
-                        goto bad_area_nosemaphore;
+                    !search_exception_tables(regs->ip)) {
+                        bad_area_nosemaphore(regs, error_code, address);
+                        return;
+                }
                 down_read(&mm->mmap_sem);
+        } else {
+                /*
+                 * The above down_read_trylock() might have succeeded in which
+                 * case we'll have missed the might_sleep() from down_read().
+                 */
+                might_sleep();
         }
 
         vma = find_vma(mm, address);
-        if (!vma)
-                goto bad_area;
-        if (vma->vm_start <= address)
+        if (unlikely(!vma)) {
+                bad_area(regs, error_code, address);
+                return;
+        }
+        if (likely(vma->vm_start <= address))
                 goto good_area;
-        if (!(vma->vm_flags & VM_GROWSDOWN))
-                goto bad_area;
+        if (unlikely(!(vma->vm_flags & VM_GROWSDOWN))) {
+                bad_area(regs, error_code, address);
+                return;
+        }
         if (error_code & PF_USER) {
                 /*
                  * Accessing the stack below %sp is always a bug.
@@ -704,31 +930,25 @@ void __kprobes do_page_fault(struct pt_regs *regs, unsigned long error_code)
                  * and pusha to work.  ("enter $65535,$31" pushes
                  * 32 pointers and then decrements %sp by 65535.)
                  */
-                if (address + 65536 + 32 * sizeof(unsigned long) < regs->sp)
-                        goto bad_area;
+                if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
+                        bad_area(regs, error_code, address);
+                        return;
+                }
         }
-        if (expand_stack(vma, address))
-                goto bad_area;
-/*
- * Ok, we have a good vm_area for this memory access, so
- * we can handle it..
- */
+        if (unlikely(expand_stack(vma, address))) {
+                bad_area(regs, error_code, address);
+                return;
+        }
+
+        /*
+         * Ok, we have a good vm_area for this memory access, so
+         * we can handle it..
+         */
 good_area:
-        si_code = SEGV_ACCERR;
-        write = 0;
-        switch (error_code & (PF_PROT|PF_WRITE)) {
-        default:        /* 3: write, present */
-                /* fall through */
-        case PF_WRITE:          /* write, not present */
-                if (!(vma->vm_flags & VM_WRITE))
-                        goto bad_area;
-                write++;
-                break;
-        case PF_PROT:           /* read, present */
-                goto bad_area;
-        case 0:                 /* read, not present */
-                if (!(vma->vm_flags & (VM_READ | VM_EXEC | VM_WRITE)))
-                        goto bad_area;
+        write = error_code & PF_WRITE;
+        if (unlikely(access_error(error_code, write, vma))) {
+                bad_area_access_error(regs, error_code, address);
+                return;
         }
 
         /*
@@ -738,11 +958,8 @@ good_area:
          */
         fault = handle_mm_fault(mm, vma, address, write);
         if (unlikely(fault & VM_FAULT_ERROR)) {
-                if (fault & VM_FAULT_OOM)
-                        goto out_of_memory;
-                else if (fault & VM_FAULT_SIGBUS)
-                        goto do_sigbus;
-                BUG();
+                mm_fault_error(regs, error_code, address, fault);
+                return;
         }
         if (fault & VM_FAULT_MAJOR)
                 tsk->maj_flt++;
@@ -760,128 +977,6 @@ good_area:
         }
 #endif
         up_read(&mm->mmap_sem);
-        return;
-
-/*
- * Something tried to access memory that isn't in our memory map..
- * Fix it, but check if it's kernel or user first..
- */
-bad_area:
-        up_read(&mm->mmap_sem);
-
-bad_area_nosemaphore:
-        /* User mode accesses just cause a SIGSEGV */
-        if (error_code & PF_USER) {
-                /*
-                 * It's possible to have interrupts off here.
-                 */
-                local_irq_enable();
-
-                /*
-                 * Valid to do another page fault here because this one came
-                 * from user space.
-                 */
-                if (is_prefetch(regs, address, error_code))
-                        return;
-
-                if (is_errata100(regs, address))
-                        return;
-
-                if (show_unhandled_signals && unhandled_signal(tsk, SIGSEGV) &&
-                    printk_ratelimit()) {
-                        printk(
-                        "%s%s[%d]: segfault at %lx ip %p sp %p error %lx",
-                        task_pid_nr(tsk) > 1 ? KERN_INFO : KERN_EMERG,
-                        tsk->comm, task_pid_nr(tsk), address,
-                        (void *) regs->ip, (void *) regs->sp, error_code);
-                        print_vma_addr(" in ", regs->ip);
-                        printk("\n");
-                }
-
-                tsk->thread.cr2 = address;
-                /* Kernel addresses are always protection faults */
-                tsk->thread.error_code = error_code | (address >= TASK_SIZE);
-                tsk->thread.trap_no = 14;
-                force_sig_info_fault(SIGSEGV, si_code, address, tsk);
-                return;
-        }
-
-        if (is_f00f_bug(regs, address))
-                return;
-
-no_context:
-        /* Are we prepared to handle this kernel fault?  */
-        if (fixup_exception(regs))
-                return;
-
-        /*
-         * X86_32
-         * Valid to do another page fault here, because if this fault
-         * had been triggered by is_prefetch fixup_exception would have
-         * handled it.
-         *
-         * X86_64
-         * Hall of shame of CPU/BIOS bugs.
-         */
-        if (is_prefetch(regs, address, error_code))
-                return;
-
-        if (is_errata93(regs, address))
-                return;
-
-/*
- * Oops. The kernel tried to access some bad page. We'll have to
- * terminate things with extreme prejudice.
- */
-#ifdef CONFIG_X86_32
-        bust_spinlocks(1);
-#else
-        flags = oops_begin();
-#endif
-
-        show_fault_oops(regs, error_code, address);
-
-        tsk->thread.cr2 = address;
-        tsk->thread.trap_no = 14;
-        tsk->thread.error_code = error_code;
-
-#ifdef CONFIG_X86_32
-        die("Oops", regs, error_code);
-        bust_spinlocks(0);
-        do_exit(SIGKILL);
-#else
-        sig = SIGKILL;
-        if (__die("Oops", regs, error_code))
-                sig = 0;
-        /* Executive summary in case the body of the oops scrolled away */
-        printk(KERN_EMERG "CR2: %016lx\n", address);
-        oops_end(flags, regs, sig);
-#endif
-
-out_of_memory:
-        /*
-         * We ran out of memory, call the OOM killer, and return the userspace
-         * (which will retry the fault, or kill us if we got oom-killed).
-         */
-        up_read(&mm->mmap_sem);
-        pagefault_out_of_memory();
-        return;
-
-do_sigbus:
-        up_read(&mm->mmap_sem);
-
-        /* Kernel mode? Handle exceptions or die */
-        if (!(error_code & PF_USER))
-                goto no_context;
-#ifdef CONFIG_X86_32
-        /* User space => ok to do another page fault */
-        if (is_prefetch(regs, address, error_code))
-                return;
-#endif
-        tsk->thread.cr2 = address;
-        tsk->thread.error_code = error_code;
-        tsk->thread.trap_no = 14;
-        force_sig_info_fault(SIGBUS, BUS_ADRERR, address, tsk);
 }
 
 DEFINE_SPINLOCK(pgd_lock);
diff --git a/arch/x86/mm/init_32.c b/arch/x86/mm/init_32.c
index 2cef0507441..06708ee94aa 100644
--- a/arch/x86/mm/init_32.c
+++ b/arch/x86/mm/init_32.c
@@ -49,7 +49,6 @@
 #include <asm/paravirt.h>
 #include <asm/setup.h>
 #include <asm/cacheflush.h>
-#include <asm/smp.h>
 
 unsigned int __VMALLOC_RESERVE = 128 << 20;
 
@@ -675,75 +674,97 @@ static int __init parse_highmem(char *arg)
 }
 early_param("highmem", parse_highmem);
 
+#define MSG_HIGHMEM_TOO_BIG \
+        "highmem size (%luMB) is bigger than pages available (%luMB)!\n"
+
+#define MSG_LOWMEM_TOO_SMALL \
+        "highmem size (%luMB) results in <64MB lowmem, ignoring it!\n"
 /*
- * Determine low and high memory ranges:
+ * All of RAM fits into lowmem - but if user wants highmem
+ * artificially via the highmem=x boot parameter then create
+ * it:
  */
-void __init find_low_pfn_range(void)
+void __init lowmem_pfn_init(void)
 {
-        /* it could update max_pfn */
-
         /* max_low_pfn is 0, we already have early_res support */
-
         max_low_pfn = max_pfn;
-        if (max_low_pfn > MAXMEM_PFN) {
-                if (highmem_pages == -1)
-                        highmem_pages = max_pfn - MAXMEM_PFN;
-                if (highmem_pages + MAXMEM_PFN < max_pfn)
-                        max_pfn = MAXMEM_PFN + highmem_pages;
-                if (highmem_pages + MAXMEM_PFN > max_pfn) {
-                        printk(KERN_WARNING "only %luMB highmem pages "
-                                "available, ignoring highmem size of %uMB.\n",
-                                pages_to_mb(max_pfn - MAXMEM_PFN),
+
+        if (highmem_pages == -1)
+                highmem_pages = 0;
+#ifdef CONFIG_HIGHMEM
+        if (highmem_pages >= max_pfn) {
+                printk(KERN_ERR MSG_HIGHMEM_TOO_BIG,
+                        pages_to_mb(highmem_pages), pages_to_mb(max_pfn));
+                highmem_pages = 0;
+        }
+        if (highmem_pages) {
+                if (max_low_pfn - highmem_pages < 64*1024*1024/PAGE_SIZE) {
+                        printk(KERN_ERR MSG_LOWMEM_TOO_SMALL,
                                 pages_to_mb(highmem_pages));
                         highmem_pages = 0;
                 }
-                max_low_pfn = MAXMEM_PFN;
+                max_low_pfn -= highmem_pages;
+        }
+#else
+        if (highmem_pages)
+                printk(KERN_ERR "ignoring highmem size on non-highmem kernel!\n");
+#endif
+}
+
+#define MSG_HIGHMEM_TOO_SMALL \
+        "only %luMB highmem pages available, ignoring highmem size of %luMB!\n"
+
+#define MSG_HIGHMEM_TRIMMED \
+        "Warning: only 4GB will be used. Use a HIGHMEM64G enabled kernel!\n"
+/*
+ * We have more RAM than fits into lowmem - we try to put it into
+ * highmem, also taking the highmem=x boot parameter into account:
+ */
+void __init highmem_pfn_init(void)
+{
+        max_low_pfn = MAXMEM_PFN;
+
+        if (highmem_pages == -1)
+                highmem_pages = max_pfn - MAXMEM_PFN;
+
+        if (highmem_pages + MAXMEM_PFN < max_pfn)
+                max_pfn = MAXMEM_PFN + highmem_pages;
+
+        if (highmem_pages + MAXMEM_PFN > max_pfn) {
+                printk(KERN_WARNING MSG_HIGHMEM_TOO_SMALL,
+                        pages_to_mb(max_pfn - MAXMEM_PFN),
+                        pages_to_mb(highmem_pages));
+                highmem_pages = 0;
+        }
 #ifndef CONFIG_HIGHMEM
-                /* Maximum memory usable is what is directly addressable */
-                printk(KERN_WARNING "Warning only %ldMB will be used.\n",
-                                        MAXMEM>>20);
-                if (max_pfn > MAX_NONPAE_PFN)
-                        printk(KERN_WARNING
-                                 "Use a HIGHMEM64G enabled kernel.\n");
-                else
-                        printk(KERN_WARNING "Use a HIGHMEM enabled kernel.\n");
-                max_pfn = MAXMEM_PFN;
+        /* Maximum memory usable is what is directly addressable */
+        printk(KERN_WARNING "Warning only %ldMB will be used.\n", MAXMEM>>20);
+        if (max_pfn > MAX_NONPAE_PFN)
+                printk(KERN_WARNING "Use a HIGHMEM64G enabled kernel.\n");
+        else
+                printk(KERN_WARNING "Use a HIGHMEM enabled kernel.\n");
+        max_pfn = MAXMEM_PFN;
 #else /* !CONFIG_HIGHMEM */
 #ifndef CONFIG_HIGHMEM64G
-                if (max_pfn > MAX_NONPAE_PFN) {
-                        max_pfn = MAX_NONPAE_PFN;
-                        printk(KERN_WARNING "Warning only 4GB will be used."
-                                "Use a HIGHMEM64G enabled kernel.\n");
-                }
+        if (max_pfn > MAX_NONPAE_PFN) {
+                max_pfn = MAX_NONPAE_PFN;
+                printk(KERN_WARNING MSG_HIGHMEM_TRIMMED);
+        }
 #endif /* !CONFIG_HIGHMEM64G */
 #endif /* !CONFIG_HIGHMEM */
-        } else {
-                if (highmem_pages == -1)
-                        highmem_pages = 0;
-#ifdef CONFIG_HIGHMEM
-                if (highmem_pages >= max_pfn) {
-                        printk(KERN_ERR "highmem size specified (%uMB) is "
-                                "bigger than pages available (%luMB)!.\n",
-                                pages_to_mb(highmem_pages),
-                                pages_to_mb(max_pfn));
-                        highmem_pages = 0;
-                }
-                if (highmem_pages) {
-                        if (max_low_pfn - highmem_pages <
-                            64*1024*1024/PAGE_SIZE){
-                                printk(KERN_ERR "highmem size %uMB results in "
-                                "smaller than 64MB lowmem, ignoring it.\n"
-                                        , pages_to_mb(highmem_pages));
-                                highmem_pages = 0;
-                        }
-                        max_low_pfn -= highmem_pages;
-                }
-#else
-                if (highmem_pages)
-                        printk(KERN_ERR "ignoring highmem size on non-highmem"
-                                        " kernel!\n");
-#endif
-        }
+}
+
+/*
+ * Determine low and high memory ranges:
+ */
+void __init find_low_pfn_range(void)
+{
+        /* it could update max_pfn */
+
+        if (max_pfn <= MAXMEM_PFN)
+                lowmem_pfn_init();
+        else
+                highmem_pfn_init();
 }
 
 #ifndef CONFIG_NEED_MULTIPLE_NODES
diff --git a/arch/x86/mm/ioremap.c b/arch/x86/mm/ioremap.c
index af750ab973b..433f7bd4648 100644
--- a/arch/x86/mm/ioremap.c
+++ b/arch/x86/mm/ioremap.c
@@ -134,25 +134,6 @@ int page_is_ram(unsigned long pagenr)
         return 0;
 }
 
-int pagerange_is_ram(unsigned long start, unsigned long end)
-{
-        int ram_page = 0, not_rampage = 0;
-        unsigned long page_nr;
-
-        for (page_nr = (start >> PAGE_SHIFT); page_nr < (end >> PAGE_SHIFT);
-             ++page_nr) {
-                if (page_is_ram(page_nr))
-                        ram_page = 1;
-                else
-                        not_rampage = 1;
-
-                if (ram_page == not_rampage)
-                        return -1;
-        }
-
-        return ram_page;
-}
-
 /*
  * Fix up the linear direct mapping of the kernel to avoid cache attribute
  * conflicts.
@@ -367,7 +348,7 @@ EXPORT_SYMBOL(ioremap_nocache);
  *
  * Must be freed with iounmap.
  */
-void __iomem *ioremap_wc(unsigned long phys_addr, unsigned long size)
+void __iomem *ioremap_wc(resource_size_t phys_addr, unsigned long size)
 {
         if (pat_enabled)
                 return __ioremap_caller(phys_addr, size, _PAGE_CACHE_WC,
diff --git a/arch/x86/mm/mmap.c b/arch/x86/mm/mmap.c
index 56fe7124fbe..16582960056 100644
--- a/arch/x86/mm/mmap.c
+++ b/arch/x86/mm/mmap.c
@@ -4,7 +4,7 @@
  * Based on code by Ingo Molnar and Andi Kleen, copyrighted
  * as follows:
  *
- * Copyright 2003-2004 Red Hat Inc., Durham, North Carolina.
+ * Copyright 2003-2009 Red Hat Inc.
  * All Rights Reserved.
  * Copyright 2005 Andi Kleen, SUSE Labs.
  * Copyright 2007 Jiri Kosina, SUSE Labs.
diff --git a/arch/x86/mm/numa_64.c b/arch/x86/mm/numa_64.c
index 71a14f89f89..deb1c1ab786 100644
--- a/arch/x86/mm/numa_64.c
+++ b/arch/x86/mm/numa_64.c
@@ -20,6 +20,12 @@
 #include <asm/acpi.h>
 #include <asm/k8.h>
 
+#ifdef CONFIG_DEBUG_PER_CPU_MAPS
+# define DBG(x...) printk(KERN_DEBUG x)
+#else
+# define DBG(x...)
+#endif
+
 struct pglist_data *node_data[MAX_NUMNODES] __read_mostly;
 EXPORT_SYMBOL(node_data);
 
@@ -33,6 +39,21 @@ int numa_off __initdata;
 static unsigned long __initdata nodemap_addr;
 static unsigned long __initdata nodemap_size;
 
+DEFINE_PER_CPU(int, node_number) = 0;
+EXPORT_PER_CPU_SYMBOL(node_number);
+
+/*
+ * Map cpu index to node index
+ */
+DEFINE_EARLY_PER_CPU(int, x86_cpu_to_node_map, NUMA_NO_NODE);
+EXPORT_EARLY_PER_CPU_SYMBOL(x86_cpu_to_node_map);
+
+/*
+ * Which logical CPUs are on which nodes
+ */
+cpumask_t *node_to_cpumask_map;
+EXPORT_SYMBOL(node_to_cpumask_map);
+
 /*
  * Given a shift value, try to populate memnodemap[]
  * Returns :
@@ -640,3 +661,199 @@ void __init init_cpu_to_node(void)
 #endif
 
 
+/*
+ * Allocate node_to_cpumask_map based on number of available nodes
+ * Requires node_possible_map to be valid.
+ *
+ * Note: node_to_cpumask() is not valid until after this is done.
+ * (Use CONFIG_DEBUG_PER_CPU_MAPS to check this.)
+ */
+void __init setup_node_to_cpumask_map(void)
+{
+        unsigned int node, num = 0;
+        cpumask_t *map;
+
+        /* setup nr_node_ids if not done yet */
+        if (nr_node_ids == MAX_NUMNODES) {
+                for_each_node_mask(node, node_possible_map)
+                        num = node;
+                nr_node_ids = num + 1;
+        }
+
+        /* allocate the map */
+        map = alloc_bootmem_low(nr_node_ids * sizeof(cpumask_t));
+        DBG("node_to_cpumask_map at %p for %d nodes\n", map, nr_node_ids);
+
+        pr_debug("Node to cpumask map at %p for %d nodes\n",
+                 map, nr_node_ids);
+
+        /* node_to_cpumask() will now work */
+        node_to_cpumask_map = map;
+}
+
+void __cpuinit numa_set_node(int cpu, int node)
+{
+        int *cpu_to_node_map = early_per_cpu_ptr(x86_cpu_to_node_map);
+
+        /* early setting, no percpu area yet */
+        if (cpu_to_node_map) {
+                cpu_to_node_map[cpu] = node;
+                return;
+        }
+
+#ifdef CONFIG_DEBUG_PER_CPU_MAPS
+        if (cpu >= nr_cpu_ids || !cpu_possible(cpu)) {
+                printk(KERN_ERR "numa_set_node: invalid cpu# (%d)\n", cpu);
+                dump_stack();
+                return;
+        }
+#endif
+        per_cpu(x86_cpu_to_node_map, cpu) = node;
+
+        if (node != NUMA_NO_NODE)
+                per_cpu(node_number, cpu) = node;
+}
+
+void __cpuinit numa_clear_node(int cpu)
+{
+        numa_set_node(cpu, NUMA_NO_NODE);
+}
+
+#ifndef CONFIG_DEBUG_PER_CPU_MAPS
+
+void __cpuinit numa_add_cpu(int cpu)
+{
+        cpu_set(cpu, node_to_cpumask_map[early_cpu_to_node(cpu)]);
+}
+
+void __cpuinit numa_remove_cpu(int cpu)
+{
+        cpu_clear(cpu, node_to_cpumask_map[early_cpu_to_node(cpu)]);
+}
+
+#else /* CONFIG_DEBUG_PER_CPU_MAPS */
+
+/*
+ * --------- debug versions of the numa functions ---------
+ */
+static void __cpuinit numa_set_cpumask(int cpu, int enable)
+{
+        int node = early_cpu_to_node(cpu);
+        cpumask_t *mask;
+        char buf[64];
+
+        if (node_to_cpumask_map == NULL) {
+                printk(KERN_ERR "node_to_cpumask_map NULL\n");
+                dump_stack();
+                return;
+        }
+
+        mask = &node_to_cpumask_map[node];
+        if (enable)
+                cpu_set(cpu, *mask);
+        else
+                cpu_clear(cpu, *mask);
+
+        cpulist_scnprintf(buf, sizeof(buf), mask);
+        printk(KERN_DEBUG "%s cpu %d node %d: mask now %s\n",
+                enable ? "numa_add_cpu" : "numa_remove_cpu", cpu, node, buf);
+}
+
+void __cpuinit numa_add_cpu(int cpu)
+{
+        numa_set_cpumask(cpu, 1);
+}
+
+void __cpuinit numa_remove_cpu(int cpu)
+{
+        numa_set_cpumask(cpu, 0);
+}
+
+int cpu_to_node(int cpu)
+{
+        if (early_per_cpu_ptr(x86_cpu_to_node_map)) {
+                printk(KERN_WARNING
+                        "cpu_to_node(%d): usage too early!\n", cpu);
+                dump_stack();
+                return early_per_cpu_ptr(x86_cpu_to_node_map)[cpu];
+        }
+        return per_cpu(x86_cpu_to_node_map, cpu);
+}
+EXPORT_SYMBOL(cpu_to_node);
+
+/*
+ * Same function as cpu_to_node() but used if called before the
+ * per_cpu areas are setup.
+ */
+int early_cpu_to_node(int cpu)
+{
+        if (early_per_cpu_ptr(x86_cpu_to_node_map))
+                return early_per_cpu_ptr(x86_cpu_to_node_map)[cpu];
+
+        if (!cpu_possible(cpu)) {
+                printk(KERN_WARNING
+                        "early_cpu_to_node(%d): no per_cpu area!\n", cpu);
+                dump_stack();
+                return NUMA_NO_NODE;
+        }
+        return per_cpu(x86_cpu_to_node_map, cpu);
+}
+
+
+/* empty cpumask */
+static const cpumask_t cpu_mask_none;
+
+/*
+ * Returns a pointer to the bitmask of CPUs on Node 'node'.
+ */
+const cpumask_t *cpumask_of_node(int node)
+{
+        if (node_to_cpumask_map == NULL) {
+                printk(KERN_WARNING
+                        "cpumask_of_node(%d): no node_to_cpumask_map!\n",
+                        node);
+                dump_stack();
+                return (const cpumask_t *)&cpu_online_map;
+        }
+        if (node >= nr_node_ids) {
+                printk(KERN_WARNING
+                        "cpumask_of_node(%d): node > nr_node_ids(%d)\n",
+                        node, nr_node_ids);
+                dump_stack();
+                return &cpu_mask_none;
+        }
+        return &node_to_cpumask_map[node];
+}
+EXPORT_SYMBOL(cpumask_of_node);
+
+/*
+ * Returns a bitmask of CPUs on Node 'node'.
+ *
+ * Side note: this function creates the returned cpumask on the stack
+ * so with a high NR_CPUS count, excessive stack space is used.  The
+ * node_to_cpumask_ptr function should be used whenever possible.
+ */
+cpumask_t node_to_cpumask(int node)
+{
+        if (node_to_cpumask_map == NULL) {
+                printk(KERN_WARNING
+                        "node_to_cpumask(%d): no node_to_cpumask_map!\n", node);
+                dump_stack();
+                return cpu_online_map;
+        }
+        if (node >= nr_node_ids) {
+                printk(KERN_WARNING
+                        "node_to_cpumask(%d): node > nr_node_ids(%d)\n",
+                        node, nr_node_ids);
+                dump_stack();
+                return cpu_mask_none;
+        }
+        return node_to_cpumask_map[node];
+}
+EXPORT_SYMBOL(node_to_cpumask);
+
+/*
+ * --------- end of debug versions of the numa functions ---------
+ */
+
+#endif /* CONFIG_DEBUG_PER_CPU_MAPS */
diff --git a/arch/x86/mm/pageattr.c b/arch/x86/mm/pageattr.c
index 84ba74820ad..8ca0d8566fc 100644
--- a/arch/x86/mm/pageattr.c
+++ b/arch/x86/mm/pageattr.c
@@ -575,7 +575,6 @@ static int __change_page_attr(struct cpa_data *cpa, int primary)
                 address = cpa->vaddr[cpa->curpage];
         else
                 address = *cpa->vaddr;
-
 repeat:
         kpte = lookup_address(address, &level);
         if (!kpte)
@@ -812,6 +811,13 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
 
         vm_unmap_aliases();
 
+        /*
+         * If we're called with lazy mmu updates enabled, the
+         * in-memory pte state may be stale.  Flush pending updates to
+         * bring them up to date.
+         */
+        arch_flush_lazy_mmu_mode();
+
         cpa.vaddr = addr;
         cpa.numpages = numpages;
         cpa.mask_set = mask_set;
@@ -854,6 +860,13 @@ static int change_page_attr_set_clr(unsigned long *addr, int numpages,
         } else
                 cpa_flush_all(cache);
 
+        /*
+         * If we've been called with lazy mmu updates enabled, then
+         * make sure that everything gets flushed out before we
+         * return.
+         */
+        arch_flush_lazy_mmu_mode();
+
 out:
         return ret;
 }
diff --git a/arch/x86/mm/pat.c b/arch/x86/mm/pat.c
index 7b61036427d..05f9aef6818 100644
--- a/arch/x86/mm/pat.c
+++ b/arch/x86/mm/pat.c
@@ -30,7 +30,7 @@
 #ifdef CONFIG_X86_PAT
 int __read_mostly pat_enabled = 1;
 
-void __cpuinit pat_disable(char *reason)
+void __cpuinit pat_disable(const char *reason)
 {
         pat_enabled = 0;
         printk(KERN_INFO "%s\n", reason);
@@ -42,6 +42,11 @@ static int __init nopat(char *str)
         return 0;
 }
 early_param("nopat", nopat);
+#else
+static inline void pat_disable(const char *reason)
+{
+        (void)reason;
+}
 #endif
 
 
@@ -78,16 +83,20 @@ void pat_init(void)
         if (!pat_enabled)
                 return;
 
-        /* Paranoia check. */
-        if (!cpu_has_pat && boot_pat_state) {
-                /*
-                 * If this happens we are on a secondary CPU, but
-                 * switched to PAT on the boot CPU. We have no way to
-                 * undo PAT.
-                 */
-                printk(KERN_ERR "PAT enabled, "
-                       "but not supported by secondary CPU\n");
-                BUG();
+        if (!cpu_has_pat) {
+                if (!boot_pat_state) {
+                        pat_disable("PAT not supported by CPU.");
+                        return;
+                } else {
+                        /*
+                         * If this happens we are on a secondary CPU, but
+                         * switched to PAT on the boot CPU. We have no way to
+                         * undo PAT.
+                         */
+                        printk(KERN_ERR "PAT enabled, "
+                               "but not supported by secondary CPU\n");
+                        BUG();
+                }
         }
 
         /* Set PWT to Write-Combining. All other bits stay the same */
@@ -211,6 +220,33 @@ chk_conflict(struct memtype *new, struct memtype *entry, unsigned long *type)
 static struct memtype *cached_entry;
 static u64 cached_start;
 
+static int pat_pagerange_is_ram(unsigned long start, unsigned long end)
+{
+        int ram_page = 0, not_rampage = 0;
+        unsigned long page_nr;
+
+        for (page_nr = (start >> PAGE_SHIFT); page_nr < (end >> PAGE_SHIFT);
+             ++page_nr) {
+                /*
+                 * For legacy reasons, physical address range in the legacy ISA
+                 * region is tracked as non-RAM. This will allow users of
+                 * /dev/mem to map portions of legacy ISA region, even when
+                 * some of those portions are listed(or not even listed) with
+                 * different e820 types(RAM/reserved/..)
+                 */
+                if (page_nr >= (ISA_END_ADDRESS >> PAGE_SHIFT) &&
+                    page_is_ram(page_nr))
+                        ram_page = 1;
+                else
+                        not_rampage = 1;
+
+                if (ram_page == not_rampage)
+                        return -1;
+        }
+
+        return ram_page;
+}
+
 /*
  * For RAM pages, mark the pages as non WB memory type using
  * PageNonWB (PG_arch_1). We allow only one set_memory_uc() or
@@ -336,20 +372,12 @@ int reserve_memtype(u64 start, u64 end, unsigned long req_type,
         if (new_type)
                 *new_type = actual_type;
 
-        /*
-         * For legacy reasons, some parts of the physical address range in the
-         * legacy 1MB region is treated as non-RAM (even when listed as RAM in
-         * the e820 tables).  So we will track the memory attributes of this
-         * legacy 1MB region using the linear memtype_list always.
-         */
-        if (end >= ISA_END_ADDRESS) {
-                is_range_ram = pagerange_is_ram(start, end);
-                if (is_range_ram == 1)
-                        return reserve_ram_pages_type(start, end, req_type,
-                                                      new_type);
-                else if (is_range_ram < 0)
-                        return -EINVAL;
-        }
+        is_range_ram = pat_pagerange_is_ram(start, end);
+        if (is_range_ram == 1)
+                return reserve_ram_pages_type(start, end, req_type,
+                                              new_type);
+        else if (is_range_ram < 0)
+                return -EINVAL;
 
         new  = kmalloc(sizeof(struct memtype), GFP_KERNEL);
         if (!new)
@@ -446,19 +474,11 @@ int free_memtype(u64 start, u64 end)
         if (is_ISA_range(start, end - 1))
                 return 0;
 
-        /*
-         * For legacy reasons, some parts of the physical address range in the
-         * legacy 1MB region is treated as non-RAM (even when listed as RAM in
-         * the e820 tables).  So we will track the memory attributes of this
-         * legacy 1MB region using the linear memtype_list always.
-         */
-        if (end >= ISA_END_ADDRESS) {
-                is_range_ram = pagerange_is_ram(start, end);
-                if (is_range_ram == 1)
-                        return free_ram_pages_type(start, end);
-                else if (is_range_ram < 0)
-                        return -EINVAL;
-        }
+        is_range_ram = pat_pagerange_is_ram(start, end);
+        if (is_range_ram == 1)
+                return free_ram_pages_type(start, end);
+        else if (is_range_ram < 0)
+                return -EINVAL;
 
         spin_lock(&memtype_lock);
         list_for_each_entry(entry, &memtype_list, nd) {
@@ -626,17 +646,13 @@ static int reserve_pfn_range(u64 paddr, unsigned long size, pgprot_t *vma_prot,
         unsigned long flags;
         unsigned long want_flags = (pgprot_val(*vma_prot) & _PAGE_CACHE_MASK);
 
-        is_ram = pagerange_is_ram(paddr, paddr + size);
+        is_ram = pat_pagerange_is_ram(paddr, paddr + size);
 
-        if (is_ram != 0) {
-                /*
-                 * For mapping RAM pages, drivers need to call
-                 * set_memory_[uc|wc|wb] directly, for reserve and free, before
-                 * setting up the PTE.
-                 */
-                WARN_ON_ONCE(1);
-                return 0;
-        }
+        /*
+         * reserve_pfn_range() doesn't support RAM pages.
+         */
+        if (is_ram != 0)
+                return -EINVAL;
 
         ret = reserve_memtype(paddr, paddr + size, want_flags, &flags);
         if (ret)
@@ -693,7 +709,7 @@ static void free_pfn_range(u64 paddr, unsigned long size)
 {
         int is_ram;
 
-        is_ram = pagerange_is_ram(paddr, paddr + size);
+        is_ram = pat_pagerange_is_ram(paddr, paddr + size);
         if (is_ram == 0)
                 free_memtype(paddr, paddr + size);
 }
diff --git a/arch/x86/mm/srat_64.c b/arch/x86/mm/srat_64.c
index 09737c8af07..15df1baee10 100644
--- a/arch/x86/mm/srat_64.c
+++ b/arch/x86/mm/srat_64.c
@@ -21,6 +21,7 @@
 #include <asm/numa.h>
 #include <asm/e820.h>
 #include <asm/genapic.h>
+#include <asm/uv/uv.h>
 
 int acpi_numa __initdata;
 
diff --git a/arch/x86/kernel/tlb_64.c b/arch/x86/mm/tlb.c
index f8be6f1d2e4..14c5af4d11e 100644
--- a/arch/x86/kernel/tlb_64.c
+++ b/arch/x86/mm/tlb.c
@@ -1,24 +1,20 @@
 #include <linux/init.h>
 
 #include <linux/mm.h>
-#include <linux/delay.h>
 #include <linux/spinlock.h>
 #include <linux/smp.h>
-#include <linux/kernel_stat.h>
-#include <linux/mc146818rtc.h>
 #include <linux/interrupt.h>
+#include <linux/module.h>
 
-#include <asm/mtrr.h>
-#include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
-#include <asm/proto.h>
-#include <asm/apicdef.h>
-#include <asm/idle.h>
-#include <asm/uv/uv_hub.h>
-#include <asm/uv/uv_bau.h>
+#include <asm/apic.h>
+#include <asm/uv/uv.h>
 
-#include <mach_ipi.h>
+DEFINE_PER_CPU_SHARED_ALIGNED(struct tlb_state, cpu_tlbstate)
+                        = { &init_mm, 0, };
+
+#include <asm/genapic.h>
 /*
  *      Smarter SMP flushing macros.
  *              c/o Linus Torvalds.
@@ -33,7 +29,7 @@
  *      To avoid global state use 8 different call vectors.
  *      Each CPU uses a specific vector to trigger flushes on other
  *      CPUs. Depending on the received vector the target CPUs look into
- *      the right per cpu variable for the flush data.
+ *      the right array slot for the flush data.
  *
  *      With more than 8 CPUs they are hashed to the 8 available
  *      vectors. The limited global vector space forces us to this right now.
@@ -43,18 +39,18 @@
 
 union smp_flush_state {
         struct {
-                cpumask_t flush_cpumask;
                 struct mm_struct *flush_mm;
                 unsigned long flush_va;
                 spinlock_t tlbstate_lock;
+                DECLARE_BITMAP(flush_cpumask, NR_CPUS);
         };
-        char pad[SMP_CACHE_BYTES];
-} ____cacheline_aligned;
+        char pad[CONFIG_X86_INTERNODE_CACHE_BYTES];
+} ____cacheline_internodealigned_in_smp;
 
 /* State is put into the per CPU data section, but padded
    to a full cache line because other CPUs can access it and we don't
    want false sharing in the per cpu data segment. */
-static DEFINE_PER_CPU(union smp_flush_state, flush_state);
+static union smp_flush_state flush_state[NUM_INVALIDATE_TLB_VECTORS];
 
 /*
  * We cannot call mmdrop() because we are in interrupt context,
@@ -62,9 +58,9 @@ static DEFINE_PER_CPU(union smp_flush_state, flush_state);
  */
 void leave_mm(int cpu)
 {
-        if (read_pda(mmu_state) == TLBSTATE_OK)
+        if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
                 BUG();
-        cpu_clear(cpu, read_pda(active_mm)->cpu_vm_mask);
+        cpu_clear(cpu, percpu_read(cpu_tlbstate.active_mm)->cpu_vm_mask);
         load_cr3(swapper_pg_dir);
 }
 EXPORT_SYMBOL_GPL(leave_mm);
@@ -117,10 +113,20 @@ EXPORT_SYMBOL_GPL(leave_mm);
  * Interrupts are disabled.
  */
 
-asmlinkage void smp_invalidate_interrupt(struct pt_regs *regs)
+/*
+ * FIXME: use of asmlinkage is not consistent.  On x86_64 it's noop
+ * but still used for documentation purpose but the usage is slightly
+ * inconsistent.  On x86_32, asmlinkage is regparm(0) but interrupt
+ * entry calls in with the first parameter in %eax.  Maybe define
+ * intrlinkage?
+ */
+#ifdef CONFIG_X86_64
+asmlinkage
+#endif
+void smp_invalidate_interrupt(struct pt_regs *regs)
 {
-        int cpu;
-        int sender;
+        unsigned int cpu;
+        unsigned int sender;
         union smp_flush_state *f;
 
         cpu = smp_processor_id();
@@ -129,9 +135,9 @@ asmlinkage void smp_invalidate_interrupt(struct pt_regs *regs)
          * Use that to determine where the sender put the data.
          */
         sender = ~regs->orig_ax - INVALIDATE_TLB_VECTOR_START;
-        f = &per_cpu(flush_state, sender);
+        f = &flush_state[sender];
 
-        if (!cpu_isset(cpu, f->flush_cpumask))
+        if (!cpumask_test_cpu(cpu, to_cpumask(f->flush_cpumask)))
                 goto out;
                 /*
                  * This was a BUG() but until someone can quote me the
@@ -142,8 +148,8 @@ asmlinkage void smp_invalidate_interrupt(struct pt_regs *regs)
                  * BUG();
                  */
 
-        if (f->flush_mm == read_pda(active_mm)) {
-                if (read_pda(mmu_state) == TLBSTATE_OK) {
+        if (f->flush_mm == percpu_read(cpu_tlbstate.active_mm)) {
+                if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK) {
                         if (f->flush_va == TLB_FLUSH_ALL)
                                 local_flush_tlb();
                         else
@@ -153,23 +159,21 @@ asmlinkage void smp_invalidate_interrupt(struct pt_regs *regs)
         }
 out:
         ack_APIC_irq();
-        cpu_clear(cpu, f->flush_cpumask);
+        smp_mb__before_clear_bit();
+        cpumask_clear_cpu(cpu, to_cpumask(f->flush_cpumask));
+        smp_mb__after_clear_bit();
         inc_irq_stat(irq_tlb_count);
 }
 
-void native_flush_tlb_others(const cpumask_t *cpumaskp, struct mm_struct *mm,
-                             unsigned long va)
+static void flush_tlb_others_ipi(const struct cpumask *cpumask,
+                                 struct mm_struct *mm, unsigned long va)
 {
-        int sender;
+        unsigned int sender;
         union smp_flush_state *f;
-        cpumask_t cpumask = *cpumaskp;
-
-        if (is_uv_system() && uv_flush_tlb_others(&cpumask, mm, va))
-                return;
 
         /* Caller has disabled preemption */
         sender = smp_processor_id() % NUM_INVALIDATE_TLB_VECTORS;
-        f = &per_cpu(flush_state, sender);
+        f = &flush_state[sender];
 
         /*
          * Could avoid this lock when
@@ -180,7 +184,8 @@ void native_flush_tlb_others(const cpumask_t *cpumaskp, struct mm_struct *mm,
 
         f->flush_mm = mm;
         f->flush_va = va;
-        cpus_or(f->flush_cpumask, cpumask, f->flush_cpumask);
+        cpumask_andnot(to_cpumask(f->flush_cpumask),
+                       cpumask, cpumask_of(smp_processor_id()));
 
         /*
          * Make the above memory operations globally visible before
@@ -191,9 +196,10 @@ void native_flush_tlb_others(const cpumask_t *cpumaskp, struct mm_struct *mm,
          * We have to send the IPI only to
          * CPUs affected.
          */
-        send_IPI_mask(&cpumask, INVALIDATE_TLB_VECTOR_START + sender);
+        apic->send_IPI_mask(to_cpumask(f->flush_cpumask),
+                      INVALIDATE_TLB_VECTOR_START + sender);
 
-        while (!cpus_empty(f->flush_cpumask))
+        while (!cpumask_empty(to_cpumask(f->flush_cpumask)))
                 cpu_relax();
 
         f->flush_mm = NULL;
@@ -201,12 +207,28 @@ void native_flush_tlb_others(const cpumask_t *cpumaskp, struct mm_struct *mm,
         spin_unlock(&f->tlbstate_lock);
 }
 
+void native_flush_tlb_others(const struct cpumask *cpumask,
+                             struct mm_struct *mm, unsigned long va)
+{
+        if (is_uv_system()) {
+                unsigned int cpu;
+
+                cpu = get_cpu();
+                cpumask = uv_flush_tlb_others(cpumask, mm, va, cpu);
+                if (cpumask)
+                        flush_tlb_others_ipi(cpumask, mm, va);
+                put_cpu();
+                return;
+        }
+        flush_tlb_others_ipi(cpumask, mm, va);
+}
+
 static int __cpuinit init_smp_flush(void)
 {
         int i;
 
-        for_each_possible_cpu(i)
-                spin_lock_init(&per_cpu(flush_state, i).tlbstate_lock);
+        for (i = 0; i < ARRAY_SIZE(flush_state); i++)
+                spin_lock_init(&flush_state[i].tlbstate_lock);
 
         return 0;
 }
@@ -215,25 +237,18 @@ core_initcall(init_smp_flush);
 void flush_tlb_current_task(void)
 {
         struct mm_struct *mm = current->mm;
-        cpumask_t cpu_mask;
 
         preempt_disable();
-        cpu_mask = mm->cpu_vm_mask;
-        cpu_clear(smp_processor_id(), cpu_mask);
 
         local_flush_tlb();
-        if (!cpus_empty(cpu_mask))
-                flush_tlb_others(cpu_mask, mm, TLB_FLUSH_ALL);
+        if (cpumask_any_but(&mm->cpu_vm_mask, smp_processor_id()) < nr_cpu_ids)
+                flush_tlb_others(&mm->cpu_vm_mask, mm, TLB_FLUSH_ALL);
         preempt_enable();
 }
 
 void flush_tlb_mm(struct mm_struct *mm)
 {
-        cpumask_t cpu_mask;
-
         preempt_disable();
-        cpu_mask = mm->cpu_vm_mask;
-        cpu_clear(smp_processor_id(), cpu_mask);
 
         if (current->active_mm == mm) {
                 if (current->mm)
@@ -241,8 +256,8 @@ void flush_tlb_mm(struct mm_struct *mm)
                 else
                         leave_mm(smp_processor_id());
         }
-        if (!cpus_empty(cpu_mask))
-                flush_tlb_others(cpu_mask, mm, TLB_FLUSH_ALL);
+        if (cpumask_any_but(&mm->cpu_vm_mask, smp_processor_id()) < nr_cpu_ids)
+                flush_tlb_others(&mm->cpu_vm_mask, mm, TLB_FLUSH_ALL);
 
         preempt_enable();
 }
@@ -250,11 +265,8 @@ void flush_tlb_mm(struct mm_struct *mm)
 void flush_tlb_page(struct vm_area_struct *vma, unsigned long va)
 {
         struct mm_struct *mm = vma->vm_mm;
-        cpumask_t cpu_mask;
 
         preempt_disable();
-        cpu_mask = mm->cpu_vm_mask;
-        cpu_clear(smp_processor_id(), cpu_mask);
 
         if (current->active_mm == mm) {
                 if (current->mm)
@@ -263,8 +275,8 @@ void flush_tlb_page(struct vm_area_struct *vma, unsigned long va)
                         leave_mm(smp_processor_id());
         }
 
-        if (!cpus_empty(cpu_mask))
-                flush_tlb_others(cpu_mask, mm, va);
+        if (cpumask_any_but(&mm->cpu_vm_mask, smp_processor_id()) < nr_cpu_ids)
+                flush_tlb_others(&mm->cpu_vm_mask, mm, va);
 
         preempt_enable();
 }
@@ -274,7 +286,7 @@ static void do_flush_tlb_all(void *info)
         unsigned long cpu = smp_processor_id();
 
         __flush_tlb_all();
-        if (read_pda(mmu_state) == TLBSTATE_LAZY)
+        if (percpu_read(cpu_tlbstate.state) == TLBSTATE_LAZY)
                 leave_mm(cpu);
 }
 
diff --git a/arch/x86/pci/irq.c b/arch/x86/pci/irq.c
index 4064345cf14..fecbce6e7d7 100644
--- a/arch/x86/pci/irq.c
+++ b/arch/x86/pci/irq.c
@@ -572,6 +572,7 @@ static __init int intel_router_probe(struct irq_router *r, struct pci_dev *route
         case PCI_DEVICE_ID_INTEL_ICH7_1:
         case PCI_DEVICE_ID_INTEL_ICH7_30:
         case PCI_DEVICE_ID_INTEL_ICH7_31:
+        case PCI_DEVICE_ID_INTEL_TGP_LPC:
         case PCI_DEVICE_ID_INTEL_ESB2_0:
         case PCI_DEVICE_ID_INTEL_ICH8_0:
         case PCI_DEVICE_ID_INTEL_ICH8_1:
diff --git a/arch/x86/pci/numaq_32.c b/arch/x86/pci/numaq_32.c
index 2089354968a..5601e829c38 100644
--- a/arch/x86/pci/numaq_32.c
+++ b/arch/x86/pci/numaq_32.c
@@ -5,7 +5,7 @@
 #include <linux/pci.h>
 #include <linux/init.h>
 #include <linux/nodemask.h>
-#include <mach_apic.h>
+#include <asm/genapic.h>
 #include <asm/mpspec.h>
 #include <asm/pci_x86.h>
 
@@ -18,10 +18,6 @@
 
 #define QUADLOCAL2BUS(quad,local) (quad_local_to_mp_bus_id[quad][local])
 
-/* Where the IO area was mapped on multiquad, always 0 otherwise */
-void *xquad_portio;
-EXPORT_SYMBOL(xquad_portio);
-
 #define XQUAD_PORT_ADDR(port, quad) (xquad_portio + (XQUAD_PORTIO_QUAD*quad) + port)
 
 #define PCI_CONF1_MQ_ADDRESS(bus, devfn, reg) \
diff --git a/arch/x86/pci/pcbios.c b/arch/x86/pci/pcbios.c
index b82cae970df..1c975cc9839 100644
--- a/arch/x86/pci/pcbios.c
+++ b/arch/x86/pci/pcbios.c
@@ -7,7 +7,7 @@
 #include <linux/module.h>
 #include <linux/uaccess.h>
 #include <asm/pci_x86.h>
-#include <asm/mach-default/pci-functions.h>
+#include <asm/pci-functions.h>
 
 /* BIOS32 signature: "_32_" */
 #define BIOS32_SIGNATURE        (('_' << 0) + ('3' << 8) + ('2' << 16) + ('_' << 24))
diff --git a/arch/x86/vdso/Makefile b/arch/x86/vdso/Makefile
index 4d6ef0a336d..16a9020c8f1 100644
--- a/arch/x86/vdso/Makefile
+++ b/arch/x86/vdso/Makefile
@@ -38,7 +38,7 @@ $(obj)/%.so: $(obj)/%.so.dbg FORCE
         $(call if_changed,objcopy)
 
 CFL := $(PROFILING) -mcmodel=small -fPIC -O2 -fasynchronous-unwind-tables -m64 \
-       $(filter -g%,$(KBUILD_CFLAGS))
+       $(filter -g%,$(KBUILD_CFLAGS)) $(call cc-option, -fno-stack-protector)
 
 $(vobjs): KBUILD_CFLAGS += $(CFL)
 
diff --git a/arch/x86/xen/Makefile b/arch/x86/xen/Makefile
index 6dcefba7836..3b767d03fd6 100644
--- a/arch/x86/xen/Makefile
+++ b/arch/x86/xen/Makefile
@@ -6,7 +6,8 @@ CFLAGS_REMOVE_irq.o = -pg
 endif
 
 obj-y           := enlighten.o setup.o multicalls.o mmu.o irq.o \
-                        time.o xen-asm_$(BITS).o grant-table.o suspend.o
+                        time.o xen-asm.o xen-asm_$(BITS).o \
+                        grant-table.o suspend.o
 
 obj-$(CONFIG_SMP)               += smp.o spinlock.o
 obj-$(CONFIG_XEN_DEBUG_FS)      += debugfs.o
\ No newline at end of file
diff --git a/arch/x86/xen/enlighten.c b/arch/x86/xen/enlighten.c
index bea215230b2..95ff6a0e942 100644
--- a/arch/x86/xen/enlighten.c
+++ b/arch/x86/xen/enlighten.c
@@ -61,40 +61,13 @@ DEFINE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 enum xen_domain_type xen_domain_type = XEN_NATIVE;
 EXPORT_SYMBOL_GPL(xen_domain_type);
 
-/*
- * Identity map, in addition to plain kernel map.  This needs to be
- * large enough to allocate page table pages to allocate the rest.
- * Each page can map 2MB.
- */
-static pte_t level1_ident_pgt[PTRS_PER_PTE * 4] __page_aligned_bss;
-
-#ifdef CONFIG_X86_64
-/* l3 pud for userspace vsyscall mapping */
-static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss;
-#endif /* CONFIG_X86_64 */
-
-/*
- * Note about cr3 (pagetable base) values:
- *
- * xen_cr3 contains the current logical cr3 value; it contains the
- * last set cr3.  This may not be the current effective cr3, because
- * its update may be being lazily deferred.  However, a vcpu looking
- * at its own cr3 can use this value knowing that it everything will
- * be self-consistent.
- *
- * xen_current_cr3 contains the actual vcpu cr3; it is set once the
- * hypercall to set the vcpu cr3 is complete (so it may be a little
- * out of date, but it will never be set early).  If one vcpu is
- * looking at another vcpu's cr3 value, it should use this variable.
- */
-DEFINE_PER_CPU(unsigned long, xen_cr3);  /* cr3 stored as physaddr */
-DEFINE_PER_CPU(unsigned long, xen_current_cr3);  /* actual vcpu cr3 */
-
 struct start_info *xen_start_info;
 EXPORT_SYMBOL_GPL(xen_start_info);
 
 struct shared_info xen_dummy_shared_info;
 
+void *xen_initial_gdt;
+
 /*
  * Point at some empty memory to start with. We map the real shared_info
  * page as soon as fixmap is up and running.
@@ -114,14 +87,7 @@ struct shared_info *HYPERVISOR_shared_info = (void *)&xen_dummy_shared_info;
  *
  * 0: not available, 1: available
  */
-static int have_vcpu_info_placement =
-#ifdef CONFIG_X86_32
-        1
-#else
-        0
-#endif
-        ;
-
+static int have_vcpu_info_placement = 1;
 
 static void xen_vcpu_setup(int cpu)
 {
@@ -237,7 +203,7 @@ static unsigned long xen_get_debugreg(int reg)
         return HYPERVISOR_get_debugreg(reg);
 }
 
-static void xen_leave_lazy(void)
+void xen_leave_lazy(void)
 {
         paravirt_leave_lazy(paravirt_get_lazy_mode());
         xen_mc_flush();
@@ -357,13 +323,14 @@ static void load_TLS_descriptor(struct thread_struct *t,
 static void xen_load_tls(struct thread_struct *t, unsigned int cpu)
 {
         /*
-         * XXX sleazy hack: If we're being called in a lazy-cpu zone,
-         * it means we're in a context switch, and %gs has just been
-         * saved.  This means we can zero it out to prevent faults on
-         * exit from the hypervisor if the next process has no %gs.
-         * Either way, it has been saved, and the new value will get
-         * loaded properly.  This will go away as soon as Xen has been
-         * modified to not save/restore %gs for normal hypercalls.
+         * XXX sleazy hack: If we're being called in a lazy-cpu zone
+         * and lazy gs handling is enabled, it means we're in a
+         * context switch, and %gs has just been saved.  This means we
+         * can zero it out to prevent faults on exit from the
+         * hypervisor if the next process has no %gs.  Either way, it
+         * has been saved, and the new value will get loaded properly.
+         * This will go away as soon as Xen has been modified to not
+         * save/restore %gs for normal hypercalls.
          *
          * On x86_64, this hack is not used for %gs, because gs points
          * to KERNEL_GS_BASE (and uses it for PDA references), so we
@@ -375,7 +342,7 @@ static void xen_load_tls(struct thread_struct *t, unsigned int cpu)
          */
         if (paravirt_get_lazy_mode() == PARAVIRT_LAZY_CPU) {
 #ifdef CONFIG_X86_32
-                loadsegment(gs, 0);
+                lazy_load_gs(0);
 #else
                 loadsegment(fs, 0);
 #endif
@@ -598,83 +565,6 @@ static struct apic_ops xen_basic_apic_ops = {
 
 #endif
 
-static void xen_flush_tlb(void)
-{
-        struct mmuext_op *op;
-        struct multicall_space mcs;
-
-        preempt_disable();
-
-        mcs = xen_mc_entry(sizeof(*op));
-
-        op = mcs.args;
-        op->cmd = MMUEXT_TLB_FLUSH_LOCAL;
-        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
-
-        xen_mc_issue(PARAVIRT_LAZY_MMU);
-
-        preempt_enable();
-}
-
-static void xen_flush_tlb_single(unsigned long addr)
-{
-        struct mmuext_op *op;
-        struct multicall_space mcs;
-
-        preempt_disable();
-
-        mcs = xen_mc_entry(sizeof(*op));
-        op = mcs.args;
-        op->cmd = MMUEXT_INVLPG_LOCAL;
-        op->arg1.linear_addr = addr & PAGE_MASK;
-        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
-
-        xen_mc_issue(PARAVIRT_LAZY_MMU);
-
-        preempt_enable();
-}
-
-static void xen_flush_tlb_others(const cpumask_t *cpus, struct mm_struct *mm,
-                                 unsigned long va)
-{
-        struct {
-                struct mmuext_op op;
-                cpumask_t mask;
-        } *args;
-        cpumask_t cpumask = *cpus;
-        struct multicall_space mcs;
-
-        /*
-         * A couple of (to be removed) sanity checks:
-         *
-         * - current CPU must not be in mask
-         * - mask must exist :)
-         */
-        BUG_ON(cpus_empty(cpumask));
-        BUG_ON(cpu_isset(smp_processor_id(), cpumask));
-        BUG_ON(!mm);
-
-        /* If a CPU which we ran on has gone down, OK. */
-        cpus_and(cpumask, cpumask, cpu_online_map);
-        if (cpus_empty(cpumask))
-                return;
-
-        mcs = xen_mc_entry(sizeof(*args));
-        args = mcs.args;
-        args->mask = cpumask;
-        args->op.arg2.vcpumask = &args->mask;
-
-        if (va == TLB_FLUSH_ALL) {
-                args->op.cmd = MMUEXT_TLB_FLUSH_MULTI;
-        } else {
-                args->op.cmd = MMUEXT_INVLPG_MULTI;
-                args->op.arg1.linear_addr = va;
-        }
-
-        MULTI_mmuext_op(mcs.mc, &args->op, 1, NULL, DOMID_SELF);
-
-        xen_mc_issue(PARAVIRT_LAZY_MMU);
-}
 
 static void xen_clts(void)
 {
@@ -700,21 +590,6 @@ static void xen_write_cr0(unsigned long cr0)
         xen_mc_issue(PARAVIRT_LAZY_CPU);
 }
 
-static void xen_write_cr2(unsigned long cr2)
-{
-        x86_read_percpu(xen_vcpu)->arch.cr2 = cr2;
-}
-
-static unsigned long xen_read_cr2(void)
-{
-        return x86_read_percpu(xen_vcpu)->arch.cr2;
-}
-
-static unsigned long xen_read_cr2_direct(void)
-{
-        return x86_read_percpu(xen_vcpu_info.arch.cr2);
-}
-
 static void xen_write_cr4(unsigned long cr4)
 {
         cr4 &= ~X86_CR4_PGE;
@@ -723,71 +598,6 @@ static void xen_write_cr4(unsigned long cr4)
         native_write_cr4(cr4);
 }
 
-static unsigned long xen_read_cr3(void)
-{
-        return x86_read_percpu(xen_cr3);
-}
-
-static void set_current_cr3(void *v)
-{
-        x86_write_percpu(xen_current_cr3, (unsigned long)v);
-}
-
-static void __xen_write_cr3(bool kernel, unsigned long cr3)
-{
-        struct mmuext_op *op;
-        struct multicall_space mcs;
-        unsigned long mfn;
-
-        if (cr3)
-                mfn = pfn_to_mfn(PFN_DOWN(cr3));
-        else
-                mfn = 0;
-
-        WARN_ON(mfn == 0 && kernel);
-
-        mcs = __xen_mc_entry(sizeof(*op));
-
-        op = mcs.args;
-        op->cmd = kernel ? MMUEXT_NEW_BASEPTR : MMUEXT_NEW_USER_BASEPTR;
-        op->arg1.mfn = mfn;
-
-        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
-
-        if (kernel) {
-                x86_write_percpu(xen_cr3, cr3);
-
-                /* Update xen_current_cr3 once the batch has actually
-                   been submitted. */
-                xen_mc_callback(set_current_cr3, (void *)cr3);
-        }
-}
-
-static void xen_write_cr3(unsigned long cr3)
-{
-        BUG_ON(preemptible());
-
-        xen_mc_batch();  /* disables interrupts */
-
-        /* Update while interrupts are disabled, so its atomic with
-           respect to ipis */
-        x86_write_percpu(xen_cr3, cr3);
-
-        __xen_write_cr3(true, cr3);
-
-#ifdef CONFIG_X86_64
-        {
-                pgd_t *user_pgd = xen_get_user_pgd(__va(cr3));
-                if (user_pgd)
-                        __xen_write_cr3(false, __pa(user_pgd));
-                else
-                        __xen_write_cr3(false, 0);
-        }
-#endif
-
-        xen_mc_issue(PARAVIRT_LAZY_CPU);  /* interrupts restored */
-}
-
 static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
 {
         int ret;
@@ -829,185 +639,6 @@ static int xen_write_msr_safe(unsigned int msr, unsigned low, unsigned high)
         return ret;
 }
 
-/* Early in boot, while setting up the initial pagetable, assume
-   everything is pinned. */
-static __init void xen_alloc_pte_init(struct mm_struct *mm, unsigned long pfn)
-{
-#ifdef CONFIG_FLATMEM
-        BUG_ON(mem_map);        /* should only be used early */
-#endif
-        make_lowmem_page_readonly(__va(PFN_PHYS(pfn)));
-}
-
-/* Early release_pte assumes that all pts are pinned, since there's
-   only init_mm and anything attached to that is pinned. */
-static void xen_release_pte_init(unsigned long pfn)
-{
-        make_lowmem_page_readwrite(__va(PFN_PHYS(pfn)));
-}
-
-static void pin_pagetable_pfn(unsigned cmd, unsigned long pfn)
-{
-        struct mmuext_op op;
-        op.cmd = cmd;
-        op.arg1.mfn = pfn_to_mfn(pfn);
-        if (HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF))
-                BUG();
-}
-
-/* This needs to make sure the new pte page is pinned iff its being
-   attached to a pinned pagetable. */
-static void xen_alloc_ptpage(struct mm_struct *mm, unsigned long pfn, unsigned level)
-{
-        struct page *page = pfn_to_page(pfn);
-
-        if (PagePinned(virt_to_page(mm->pgd))) {
-                SetPagePinned(page);
-
-                vm_unmap_aliases();
-                if (!PageHighMem(page)) {
-                        make_lowmem_page_readonly(__va(PFN_PHYS((unsigned long)pfn)));
-                        if (level == PT_PTE && USE_SPLIT_PTLOCKS)
-                                pin_pagetable_pfn(MMUEXT_PIN_L1_TABLE, pfn);
-                } else {
-                        /* make sure there are no stray mappings of
-                           this page */
-                        kmap_flush_unused();
-                }
-        }
-}
-
-static void xen_alloc_pte(struct mm_struct *mm, unsigned long pfn)
-{
-        xen_alloc_ptpage(mm, pfn, PT_PTE);
-}
-
-static void xen_alloc_pmd(struct mm_struct *mm, unsigned long pfn)
-{
-        xen_alloc_ptpage(mm, pfn, PT_PMD);
-}
-
-static int xen_pgd_alloc(struct mm_struct *mm)
-{
-        pgd_t *pgd = mm->pgd;
-        int ret = 0;
-
-        BUG_ON(PagePinned(virt_to_page(pgd)));
-
-#ifdef CONFIG_X86_64
-        {
-                struct page *page = virt_to_page(pgd);
-                pgd_t *user_pgd;
-
-                BUG_ON(page->private != 0);
-
-                ret = -ENOMEM;
-
-                user_pgd = (pgd_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
-                page->private = (unsigned long)user_pgd;
-
-                if (user_pgd != NULL) {
-                        user_pgd[pgd_index(VSYSCALL_START)] =
-                                __pgd(__pa(level3_user_vsyscall) | _PAGE_TABLE);
-                        ret = 0;
-                }
-
-                BUG_ON(PagePinned(virt_to_page(xen_get_user_pgd(pgd))));
-        }
-#endif
-
-        return ret;
-}
-
-static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
-{
-#ifdef CONFIG_X86_64
-        pgd_t *user_pgd = xen_get_user_pgd(pgd);
-
-        if (user_pgd)
-                free_page((unsigned long)user_pgd);
-#endif
-}
-
-/* This should never happen until we're OK to use struct page */
-static void xen_release_ptpage(unsigned long pfn, unsigned level)
-{
-        struct page *page = pfn_to_page(pfn);
-
-        if (PagePinned(page)) {
-                if (!PageHighMem(page)) {
-                        if (level == PT_PTE && USE_SPLIT_PTLOCKS)
-                                pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, pfn);
-                        make_lowmem_page_readwrite(__va(PFN_PHYS(pfn)));
-                }
-                ClearPagePinned(page);
-        }
-}
-
-static void xen_release_pte(unsigned long pfn)
-{
-        xen_release_ptpage(pfn, PT_PTE);
-}
-
-static void xen_release_pmd(unsigned long pfn)
-{
-        xen_release_ptpage(pfn, PT_PMD);
-}
-
-#if PAGETABLE_LEVELS == 4
-static void xen_alloc_pud(struct mm_struct *mm, unsigned long pfn)
-{
-        xen_alloc_ptpage(mm, pfn, PT_PUD);
-}
-
-static void xen_release_pud(unsigned long pfn)
-{
-        xen_release_ptpage(pfn, PT_PUD);
-}
-#endif
-
-#ifdef CONFIG_HIGHPTE
-static void *xen_kmap_atomic_pte(struct page *page, enum km_type type)
-{
-        pgprot_t prot = PAGE_KERNEL;
-
-        if (PagePinned(page))
-                prot = PAGE_KERNEL_RO;
-
-        if (0 && PageHighMem(page))
-                printk("mapping highpte %lx type %d prot %s\n",
-                       page_to_pfn(page), type,
-                       (unsigned long)pgprot_val(prot) & _PAGE_RW ? "WRITE" : "READ");
-
-        return kmap_atomic_prot(page, type, prot);
-}
-#endif
-
-#ifdef CONFIG_X86_32
-static __init pte_t mask_rw_pte(pte_t *ptep, pte_t pte)
-{
-        /* If there's an existing pte, then don't allow _PAGE_RW to be set */
-        if (pte_val_ma(*ptep) & _PAGE_PRESENT)
-                pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
-                               pte_val_ma(pte));
-
-        return pte;
-}
-
-/* Init-time set_pte while constructing initial pagetables, which
-   doesn't allow RO pagetable pages to be remapped RW */
-static __init void xen_set_pte_init(pte_t *ptep, pte_t pte)
-{
-        pte = mask_rw_pte(ptep, pte);
-
-        xen_set_pte(ptep, pte);
-}
-#endif
-
-static __init void xen_pagetable_setup_start(pgd_t *base)
-{
-}
-
 void xen_setup_shared_info(void)
 {
         if (!xen_feature(XENFEAT_auto_translated_physmap)) {
@@ -1028,37 +659,6 @@ void xen_setup_shared_info(void)
         xen_setup_mfn_list_list();
 }
 
-static __init void xen_pagetable_setup_done(pgd_t *base)
-{
-        xen_setup_shared_info();
-}
-
-static __init void xen_post_allocator_init(void)
-{
-        pv_mmu_ops.set_pte = xen_set_pte;
-        pv_mmu_ops.set_pmd = xen_set_pmd;
-        pv_mmu_ops.set_pud = xen_set_pud;
-#if PAGETABLE_LEVELS == 4
-        pv_mmu_ops.set_pgd = xen_set_pgd;
-#endif
-
-        /* This will work as long as patching hasn't happened yet
-           (which it hasn't) */
-        pv_mmu_ops.alloc_pte = xen_alloc_pte;
-        pv_mmu_ops.alloc_pmd = xen_alloc_pmd;
-        pv_mmu_ops.release_pte = xen_release_pte;
-        pv_mmu_ops.release_pmd = xen_release_pmd;
-#if PAGETABLE_LEVELS == 4
-        pv_mmu_ops.alloc_pud = xen_alloc_pud;
-        pv_mmu_ops.release_pud = xen_release_pud;
-#endif
-
-#ifdef CONFIG_X86_64
-        SetPagePinned(virt_to_page(level3_user_vsyscall));
-#endif
-        xen_mark_init_mm_pinned();
-}
-
 /* This is called once we have the cpu_possible_map */
 void xen_setup_vcpu_info_placement(void)
 {
@@ -1072,10 +672,10 @@ void xen_setup_vcpu_info_placement(void)
         if (have_vcpu_info_placement) {
                 printk(KERN_INFO "Xen: using vcpu_info placement\n");
 
-                pv_irq_ops.save_fl = xen_save_fl_direct;
-                pv_irq_ops.restore_fl = xen_restore_fl_direct;
-                pv_irq_ops.irq_disable = xen_irq_disable_direct;
-                pv_irq_ops.irq_enable = xen_irq_enable_direct;
+                pv_irq_ops.save_fl = __PV_IS_CALLEE_SAVE(xen_save_fl_direct);
+                pv_irq_ops.restore_fl = __PV_IS_CALLEE_SAVE(xen_restore_fl_direct);
+                pv_irq_ops.irq_disable = __PV_IS_CALLEE_SAVE(xen_irq_disable_direct);
+                pv_irq_ops.irq_enable = __PV_IS_CALLEE_SAVE(xen_irq_enable_direct);
                 pv_mmu_ops.read_cr2 = xen_read_cr2_direct;
         }
 }
@@ -1133,49 +733,6 @@ static unsigned xen_patch(u8 type, u16 clobbers, void *insnbuf,
         return ret;
 }
 
-static void xen_set_fixmap(unsigned idx, unsigned long phys, pgprot_t prot)
-{
-        pte_t pte;
-
-        phys >>= PAGE_SHIFT;
-
-        switch (idx) {
-        case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
-#ifdef CONFIG_X86_F00F_BUG
-        case FIX_F00F_IDT:
-#endif
-#ifdef CONFIG_X86_32
-        case FIX_WP_TEST:
-        case FIX_VDSO:
-# ifdef CONFIG_HIGHMEM
-        case FIX_KMAP_BEGIN ... FIX_KMAP_END:
-# endif
-#else
-        case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
-#endif
-#ifdef CONFIG_X86_LOCAL_APIC
-        case FIX_APIC_BASE:     /* maps dummy local APIC */
-#endif
-                pte = pfn_pte(phys, prot);
-                break;
-
-        default:
-                pte = mfn_pte(phys, prot);
-                break;
-        }
-
-        __native_set_fixmap(idx, pte);
-
-#ifdef CONFIG_X86_64
-        /* Replicate changes to map the vsyscall page into the user
-           pagetable vsyscall mapping. */
-        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
-                unsigned long vaddr = __fix_to_virt(idx);
-                set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
-        }
-#endif
-}
-
 static const struct pv_info xen_info __initdata = {
         .paravirt_enabled = 1,
         .shared_kernel_pmd = 0,
@@ -1271,87 +828,6 @@ static const struct pv_apic_ops xen_apic_ops __initdata = {
 #endif
 };
 
-static const struct pv_mmu_ops xen_mmu_ops __initdata = {
-        .pagetable_setup_start = xen_pagetable_setup_start,
-        .pagetable_setup_done = xen_pagetable_setup_done,
-
-        .read_cr2 = xen_read_cr2,
-        .write_cr2 = xen_write_cr2,
-
-        .read_cr3 = xen_read_cr3,
-        .write_cr3 = xen_write_cr3,
-
-        .flush_tlb_user = xen_flush_tlb,
-        .flush_tlb_kernel = xen_flush_tlb,
-        .flush_tlb_single = xen_flush_tlb_single,
-        .flush_tlb_others = xen_flush_tlb_others,
-
-        .pte_update = paravirt_nop,
-        .pte_update_defer = paravirt_nop,
-
-        .pgd_alloc = xen_pgd_alloc,
-        .pgd_free = xen_pgd_free,
-
-        .alloc_pte = xen_alloc_pte_init,
-        .release_pte = xen_release_pte_init,
-        .alloc_pmd = xen_alloc_pte_init,
-        .alloc_pmd_clone = paravirt_nop,
-        .release_pmd = xen_release_pte_init,
-
-#ifdef CONFIG_HIGHPTE
-        .kmap_atomic_pte = xen_kmap_atomic_pte,
-#endif
-
-#ifdef CONFIG_X86_64
-        .set_pte = xen_set_pte,
-#else
-        .set_pte = xen_set_pte_init,
-#endif
-        .set_pte_at = xen_set_pte_at,
-        .set_pmd = xen_set_pmd_hyper,
-
-        .ptep_modify_prot_start = __ptep_modify_prot_start,
-        .ptep_modify_prot_commit = __ptep_modify_prot_commit,
-
-        .pte_val = xen_pte_val,
-        .pte_flags = native_pte_flags,
-        .pgd_val = xen_pgd_val,
-
-        .make_pte = xen_make_pte,
-        .make_pgd = xen_make_pgd,
-
-#ifdef CONFIG_X86_PAE
-        .set_pte_atomic = xen_set_pte_atomic,
-        .set_pte_present = xen_set_pte_at,
-        .pte_clear = xen_pte_clear,
-        .pmd_clear = xen_pmd_clear,
-#endif  /* CONFIG_X86_PAE */
-        .set_pud = xen_set_pud_hyper,
-
-        .make_pmd = xen_make_pmd,
-        .pmd_val = xen_pmd_val,
-
-#if PAGETABLE_LEVELS == 4
-        .pud_val = xen_pud_val,
-        .make_pud = xen_make_pud,
-        .set_pgd = xen_set_pgd_hyper,
-
-        .alloc_pud = xen_alloc_pte_init,
-        .release_pud = xen_release_pte_init,
-#endif  /* PAGETABLE_LEVELS == 4 */
-
-        .activate_mm = xen_activate_mm,
-        .dup_mmap = xen_dup_mmap,
-        .exit_mmap = xen_exit_mmap,
-
-        .lazy_mode = {
-                .enter = paravirt_enter_lazy_mmu,
-                .leave = xen_leave_lazy,
-        },
-
-        .set_fixmap = xen_set_fixmap,
-};
-
 static void xen_reboot(int reason)
 {
         struct sched_shutdown r = { .reason = reason };
@@ -1394,223 +870,6 @@ static const struct machine_ops __initdata xen_machine_ops = {
 };
 
 
-static void __init xen_reserve_top(void)
-{
-#ifdef CONFIG_X86_32
-        unsigned long top = HYPERVISOR_VIRT_START;
-        struct xen_platform_parameters pp;
-
-        if (HYPERVISOR_xen_version(XENVER_platform_parameters, &pp) == 0)
-                top = pp.virt_start;
-
-        reserve_top_address(-top);
-#endif  /* CONFIG_X86_32 */
-}
-
-/*
- * Like __va(), but returns address in the kernel mapping (which is
- * all we have until the physical memory mapping has been set up.
- */
-static void *__ka(phys_addr_t paddr)
-{
-#ifdef CONFIG_X86_64
-        return (void *)(paddr + __START_KERNEL_map);
-#else
-        return __va(paddr);
-#endif
-}
-
-/* Convert a machine address to physical address */
-static unsigned long m2p(phys_addr_t maddr)
-{
-        phys_addr_t paddr;
-
-        maddr &= PTE_PFN_MASK;
-        paddr = mfn_to_pfn(maddr >> PAGE_SHIFT) << PAGE_SHIFT;
-
-        return paddr;
-}
-
-/* Convert a machine address to kernel virtual */
-static void *m2v(phys_addr_t maddr)
-{
-        return __ka(m2p(maddr));
-}
-
-static void set_page_prot(void *addr, pgprot_t prot)
-{
-        unsigned long pfn = __pa(addr) >> PAGE_SHIFT;
-        pte_t pte = pfn_pte(pfn, prot);
-
-        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, 0))
-                BUG();
-}
-
-static __init void xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
-{
-        unsigned pmdidx, pteidx;
-        unsigned ident_pte;
-        unsigned long pfn;
-
-        ident_pte = 0;
-        pfn = 0;
-        for (pmdidx = 0; pmdidx < PTRS_PER_PMD && pfn < max_pfn; pmdidx++) {
-                pte_t *pte_page;
-
-                /* Reuse or allocate a page of ptes */
-                if (pmd_present(pmd[pmdidx]))
-                        pte_page = m2v(pmd[pmdidx].pmd);
-                else {
-                        /* Check for free pte pages */
-                        if (ident_pte == ARRAY_SIZE(level1_ident_pgt))
-                                break;
-
-                        pte_page = &level1_ident_pgt[ident_pte];
-                        ident_pte += PTRS_PER_PTE;
-
-                        pmd[pmdidx] = __pmd(__pa(pte_page) | _PAGE_TABLE);
-                }
-
-                /* Install mappings */
-                for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
-                        pte_t pte;
-
-                        if (pfn > max_pfn_mapped)
-                                max_pfn_mapped = pfn;
-
-                        if (!pte_none(pte_page[pteidx]))
-                                continue;
-
-                        pte = pfn_pte(pfn, PAGE_KERNEL_EXEC);
-                        pte_page[pteidx] = pte;
-                }
-        }
-
-        for (pteidx = 0; pteidx < ident_pte; pteidx += PTRS_PER_PTE)
-                set_page_prot(&level1_ident_pgt[pteidx], PAGE_KERNEL_RO);
-
-        set_page_prot(pmd, PAGE_KERNEL_RO);
-}
-
-#ifdef CONFIG_X86_64
-static void convert_pfn_mfn(void *v)
-{
-        pte_t *pte = v;
-        int i;
-
-        /* All levels are converted the same way, so just treat them
-           as ptes. */
-        for (i = 0; i < PTRS_PER_PTE; i++)
-                pte[i] = xen_make_pte(pte[i].pte);
-}
-
-/*
- * Set up the inital kernel pagetable.
- *
- * We can construct this by grafting the Xen provided pagetable into
- * head_64.S's preconstructed pagetables.  We copy the Xen L2's into
- * level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt.  This
- * means that only the kernel has a physical mapping to start with -
- * but that's enough to get __va working.  We need to fill in the rest
- * of the physical mapping once some sort of allocator has been set
- * up.
- */
-static __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
-                                                unsigned long max_pfn)
-{
-        pud_t *l3;
-        pmd_t *l2;
-
-        /* Zap identity mapping */
-        init_level4_pgt[0] = __pgd(0);
-
-        /* Pre-constructed entries are in pfn, so convert to mfn */
-        convert_pfn_mfn(init_level4_pgt);
-        convert_pfn_mfn(level3_ident_pgt);
-        convert_pfn_mfn(level3_kernel_pgt);
-
-        l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
-        l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
-
-        memcpy(level2_ident_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
-        memcpy(level2_kernel_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
-
-        l3 = m2v(pgd[pgd_index(__START_KERNEL_map + PMD_SIZE)].pgd);
-        l2 = m2v(l3[pud_index(__START_KERNEL_map + PMD_SIZE)].pud);
-        memcpy(level2_fixmap_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
-
-        /* Set up identity map */
-        xen_map_identity_early(level2_ident_pgt, max_pfn);
-
-        /* Make pagetable pieces RO */
-        set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
-        set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
-        set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
-        set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
-        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
-        set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
-
-        /* Pin down new L4 */
-        pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
-                          PFN_DOWN(__pa_symbol(init_level4_pgt)));
-
-        /* Unpin Xen-provided one */
-        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
-
-        /* Switch over */
-        pgd = init_level4_pgt;
-
-        /*
-         * At this stage there can be no user pgd, and no page
-         * structure to attach it to, so make sure we just set kernel
-         * pgd.
-         */
-        xen_mc_batch();
-        __xen_write_cr3(true, __pa(pgd));
-        xen_mc_issue(PARAVIRT_LAZY_CPU);
-
-        reserve_early(__pa(xen_start_info->pt_base),
-                      __pa(xen_start_info->pt_base +
-                           xen_start_info->nr_pt_frames * PAGE_SIZE),
-                      "XEN PAGETABLES");
-
-        return pgd;
-}
-#else   /* !CONFIG_X86_64 */
-static pmd_t level2_kernel_pgt[PTRS_PER_PMD] __page_aligned_bss;
-
-static __init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
-                                                unsigned long max_pfn)
-{
-        pmd_t *kernel_pmd;
-
-        init_pg_tables_start = __pa(pgd);
-        init_pg_tables_end = __pa(pgd) + xen_start_info->nr_pt_frames*PAGE_SIZE;
-        max_pfn_mapped = PFN_DOWN(init_pg_tables_end + 512*1024);
-
-        kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
-        memcpy(level2_kernel_pgt, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
-
-        xen_map_identity_early(level2_kernel_pgt, max_pfn);
-
-        memcpy(swapper_pg_dir, pgd, sizeof(pgd_t) * PTRS_PER_PGD);
-        set_pgd(&swapper_pg_dir[KERNEL_PGD_BOUNDARY],
-                        __pgd(__pa(level2_kernel_pgt) | _PAGE_PRESENT));
-
-        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
-        set_page_prot(swapper_pg_dir, PAGE_KERNEL_RO);
-        set_page_prot(empty_zero_page, PAGE_KERNEL_RO);
-
-        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
-
-        xen_write_cr3(__pa(swapper_pg_dir));
-
-        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(swapper_pg_dir)));
-
-        return swapper_pg_dir;
-}
-#endif  /* CONFIG_X86_64 */
-
 /* First C function to be called on Xen boot */
 asmlinkage void __init xen_start_kernel(void)
 {
@@ -1650,10 +909,18 @@ asmlinkage void __init xen_start_kernel(void)
         machine_ops = xen_machine_ops;
 
 #ifdef CONFIG_X86_64
-        /* Disable until direct per-cpu data access. */
-        have_vcpu_info_placement = 0;
-        x86_64_init_pda();
+        /*
+         * Setup percpu state.  We only need to do this for 64-bit
+         * because 32-bit already has %fs set properly.
+         */
+        load_percpu_segment(0);
 #endif
+        /*
+         * The only reliable way to retain the initial address of the
+         * percpu gdt_page is to remember it here, so we can go and
+         * mark it RW later, when the initial percpu area is freed.
+         */
+        xen_initial_gdt = &per_cpu(gdt_page, 0);
 
         xen_smp_init();
 
diff --git a/arch/x86/xen/irq.c b/arch/x86/xen/irq.c
index bb042608c60..cfd17799bd6 100644
--- a/arch/x86/xen/irq.c
+++ b/arch/x86/xen/irq.c
@@ -19,27 +19,12 @@ void xen_force_evtchn_callback(void)
         (void)HYPERVISOR_xen_version(0, NULL);
 }
 
-static void __init __xen_init_IRQ(void)
-{
-        int i;
-
-        /* Create identity vector->irq map */
-        for(i = 0; i < NR_VECTORS; i++) {
-                int cpu;
-
-                for_each_possible_cpu(cpu)
-                        per_cpu(vector_irq, cpu)[i] = i;
-        }
-
-        xen_init_IRQ();
-}
-
 static unsigned long xen_save_fl(void)
 {
         struct vcpu_info *vcpu;
         unsigned long flags;
 
-        vcpu = x86_read_percpu(xen_vcpu);
+        vcpu = percpu_read(xen_vcpu);
 
         /* flag has opposite sense of mask */
         flags = !vcpu->evtchn_upcall_mask;
@@ -50,6 +35,7 @@ static unsigned long xen_save_fl(void)
         */
         return (-flags) & X86_EFLAGS_IF;
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_save_fl);
 
 static void xen_restore_fl(unsigned long flags)
 {
@@ -62,7 +48,7 @@ static void xen_restore_fl(unsigned long flags)
            make sure we're don't switch CPUs between getting the vcpu
            pointer and updating the mask. */
         preempt_disable();
-        vcpu = x86_read_percpu(xen_vcpu);
+        vcpu = percpu_read(xen_vcpu);
         vcpu->evtchn_upcall_mask = flags;
         preempt_enable_no_resched();
 
@@ -76,6 +62,7 @@ static void xen_restore_fl(unsigned long flags)
                         xen_force_evtchn_callback();
         }
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_restore_fl);
 
 static void xen_irq_disable(void)
 {
@@ -83,9 +70,10 @@ static void xen_irq_disable(void)
            make sure we're don't switch CPUs between getting the vcpu
            pointer and updating the mask. */
         preempt_disable();
-        x86_read_percpu(xen_vcpu)->evtchn_upcall_mask = 1;
+        percpu_read(xen_vcpu)->evtchn_upcall_mask = 1;
         preempt_enable_no_resched();
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_irq_disable);
 
 static void xen_irq_enable(void)
 {
@@ -96,7 +84,7 @@ static void xen_irq_enable(void)
            the caller is confused and is trying to re-enable interrupts
            on an indeterminate processor. */
 
-        vcpu = x86_read_percpu(xen_vcpu);
+        vcpu = percpu_read(xen_vcpu);
         vcpu->evtchn_upcall_mask = 0;
 
         /* Doesn't matter if we get preempted here, because any
@@ -106,6 +94,7 @@ static void xen_irq_enable(void)
         if (unlikely(vcpu->evtchn_upcall_pending))
                 xen_force_evtchn_callback();
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_irq_enable);
 
 static void xen_safe_halt(void)
 {
@@ -123,11 +112,13 @@ static void xen_halt(void)
 }
 
 static const struct pv_irq_ops xen_irq_ops __initdata = {
-        .init_IRQ = __xen_init_IRQ,
-        .save_fl = xen_save_fl,
-        .restore_fl = xen_restore_fl,
-        .irq_disable = xen_irq_disable,
-        .irq_enable = xen_irq_enable,
+        .init_IRQ = xen_init_IRQ,
+
+        .save_fl = PV_CALLEE_SAVE(xen_save_fl),
+        .restore_fl = PV_CALLEE_SAVE(xen_restore_fl),
+        .irq_disable = PV_CALLEE_SAVE(xen_irq_disable),
+        .irq_enable = PV_CALLEE_SAVE(xen_irq_enable),
+
         .safe_halt = xen_safe_halt,
         .halt = xen_halt,
 #ifdef CONFIG_X86_64
diff --git a/arch/x86/xen/mmu.c b/arch/x86/xen/mmu.c
index 503c240e26c..d2e8ed1aff3 100644
--- a/arch/x86/xen/mmu.c
+++ b/arch/x86/xen/mmu.c
@@ -47,6 +47,7 @@
 #include <asm/tlbflush.h>
 #include <asm/fixmap.h>
 #include <asm/mmu_context.h>
+#include <asm/setup.h>
 #include <asm/paravirt.h>
 #include <asm/linkage.h>
 
@@ -55,6 +56,8 @@
 
 #include <xen/page.h>
 #include <xen/interface/xen.h>
+#include <xen/interface/version.h>
+#include <xen/hvc-console.h>
 
 #include "multicalls.h"
 #include "mmu.h"
@@ -114,6 +117,37 @@ static inline void check_zero(void)
 
 #endif /* CONFIG_XEN_DEBUG_FS */
 
+
+/*
+ * Identity map, in addition to plain kernel map.  This needs to be
+ * large enough to allocate page table pages to allocate the rest.
+ * Each page can map 2MB.
+ */
+static pte_t level1_ident_pgt[PTRS_PER_PTE * 4] __page_aligned_bss;
+
+#ifdef CONFIG_X86_64
+/* l3 pud for userspace vsyscall mapping */
+static pud_t level3_user_vsyscall[PTRS_PER_PUD] __page_aligned_bss;
+#endif /* CONFIG_X86_64 */
+
+/*
+ * Note about cr3 (pagetable base) values:
+ *
+ * xen_cr3 contains the current logical cr3 value; it contains the
+ * last set cr3.  This may not be the current effective cr3, because
+ * its update may be being lazily deferred.  However, a vcpu looking
+ * at its own cr3 can use this value knowing that it everything will
+ * be self-consistent.
+ *
+ * xen_current_cr3 contains the actual vcpu cr3; it is set once the
+ * hypercall to set the vcpu cr3 is complete (so it may be a little
+ * out of date, but it will never be set early).  If one vcpu is
+ * looking at another vcpu's cr3 value, it should use this variable.
+ */
+DEFINE_PER_CPU(unsigned long, xen_cr3);  /* cr3 stored as physaddr */
+DEFINE_PER_CPU(unsigned long, xen_current_cr3);  /* actual vcpu cr3 */
+
+
 /*
  * Just beyond the highest usermode address.  STACK_TOP_MAX has a
  * redzone above it, so round it up to a PGD boundary.
@@ -458,28 +492,33 @@ pteval_t xen_pte_val(pte_t pte)
 {
         return pte_mfn_to_pfn(pte.pte);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_pte_val);
 
 pgdval_t xen_pgd_val(pgd_t pgd)
 {
         return pte_mfn_to_pfn(pgd.pgd);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_pgd_val);
 
 pte_t xen_make_pte(pteval_t pte)
 {
         pte = pte_pfn_to_mfn(pte);
         return native_make_pte(pte);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_make_pte);
 
 pgd_t xen_make_pgd(pgdval_t pgd)
 {
         pgd = pte_pfn_to_mfn(pgd);
         return native_make_pgd(pgd);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_make_pgd);
 
 pmdval_t xen_pmd_val(pmd_t pmd)
 {
         return pte_mfn_to_pfn(pmd.pmd);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_pmd_val);
 
 void xen_set_pud_hyper(pud_t *ptr, pud_t val)
 {
@@ -556,12 +595,14 @@ pmd_t xen_make_pmd(pmdval_t pmd)
         pmd = pte_pfn_to_mfn(pmd);
         return native_make_pmd(pmd);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_make_pmd);
 
 #if PAGETABLE_LEVELS == 4
 pudval_t xen_pud_val(pud_t pud)
 {
         return pte_mfn_to_pfn(pud.pud);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_pud_val);
 
 pud_t xen_make_pud(pudval_t pud)
 {
@@ -569,6 +610,7 @@ pud_t xen_make_pud(pudval_t pud)
 
         return native_make_pud(pud);
 }
+PV_CALLEE_SAVE_REGS_THUNK(xen_make_pud);
 
 pgd_t *xen_get_user_pgd(pgd_t *pgd)
 {
@@ -1063,18 +1105,14 @@ static void drop_other_mm_ref(void *info)
         struct mm_struct *mm = info;
         struct mm_struct *active_mm;
 
-#ifdef CONFIG_X86_64
-        active_mm = read_pda(active_mm);
-#else
-        active_mm = __get_cpu_var(cpu_tlbstate).active_mm;
-#endif
+        active_mm = percpu_read(cpu_tlbstate.active_mm);
 
         if (active_mm == mm)
                 leave_mm(smp_processor_id());
 
         /* If this cpu still has a stale cr3 reference, then make sure
            it has been flushed. */
-        if (x86_read_percpu(xen_current_cr3) == __pa(mm->pgd)) {
+        if (percpu_read(xen_current_cr3) == __pa(mm->pgd)) {
                 load_cr3(swapper_pg_dir);
                 arch_flush_lazy_cpu_mode();
         }
@@ -1156,6 +1194,709 @@ void xen_exit_mmap(struct mm_struct *mm)
         spin_unlock(&mm->page_table_lock);
 }
 
+static __init void xen_pagetable_setup_start(pgd_t *base)
+{
+}
+
+static __init void xen_pagetable_setup_done(pgd_t *base)
+{
+        xen_setup_shared_info();
+}
+
+static void xen_write_cr2(unsigned long cr2)
+{
+        percpu_read(xen_vcpu)->arch.cr2 = cr2;
+}
+
+static unsigned long xen_read_cr2(void)
+{
+        return percpu_read(xen_vcpu)->arch.cr2;
+}
+
+unsigned long xen_read_cr2_direct(void)
+{
+        return percpu_read(xen_vcpu_info.arch.cr2);
+}
+
+static void xen_flush_tlb(void)
+{
+        struct mmuext_op *op;
+        struct multicall_space mcs;
+
+        preempt_disable();
+
+        mcs = xen_mc_entry(sizeof(*op));
+
+        op = mcs.args;
+        op->cmd = MMUEXT_TLB_FLUSH_LOCAL;
+        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+
+        preempt_enable();
+}
+
+static void xen_flush_tlb_single(unsigned long addr)
+{
+        struct mmuext_op *op;
+        struct multicall_space mcs;
+
+        preempt_disable();
+
+        mcs = xen_mc_entry(sizeof(*op));
+        op = mcs.args;
+        op->cmd = MMUEXT_INVLPG_LOCAL;
+        op->arg1.linear_addr = addr & PAGE_MASK;
+        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
+
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+
+        preempt_enable();
+}
+
+static void xen_flush_tlb_others(const struct cpumask *cpus,
+                                 struct mm_struct *mm, unsigned long va)
+{
+        struct {
+                struct mmuext_op op;
+                DECLARE_BITMAP(mask, NR_CPUS);
+        } *args;
+        struct multicall_space mcs;
+
+        BUG_ON(cpumask_empty(cpus));
+        BUG_ON(!mm);
+
+        mcs = xen_mc_entry(sizeof(*args));
+        args = mcs.args;
+        args->op.arg2.vcpumask = to_cpumask(args->mask);
+
+        /* Remove us, and any offline CPUS. */
+        cpumask_and(to_cpumask(args->mask), cpus, cpu_online_mask);
+        cpumask_clear_cpu(smp_processor_id(), to_cpumask(args->mask));
+        if (unlikely(cpumask_empty(to_cpumask(args->mask))))
+                goto issue;
+
+        if (va == TLB_FLUSH_ALL) {
+                args->op.cmd = MMUEXT_TLB_FLUSH_MULTI;
+        } else {
+                args->op.cmd = MMUEXT_INVLPG_MULTI;
+                args->op.arg1.linear_addr = va;
+        }
+
+        MULTI_mmuext_op(mcs.mc, &args->op, 1, NULL, DOMID_SELF);
+
+issue:
+        xen_mc_issue(PARAVIRT_LAZY_MMU);
+}
+
+static unsigned long xen_read_cr3(void)
+{
+        return percpu_read(xen_cr3);
+}
+
+static void set_current_cr3(void *v)
+{
+        percpu_write(xen_current_cr3, (unsigned long)v);
+}
+
+static void __xen_write_cr3(bool kernel, unsigned long cr3)
+{
+        struct mmuext_op *op;
+        struct multicall_space mcs;
+        unsigned long mfn;
+
+        if (cr3)
+                mfn = pfn_to_mfn(PFN_DOWN(cr3));
+        else
+                mfn = 0;
+
+        WARN_ON(mfn == 0 && kernel);
+
+        mcs = __xen_mc_entry(sizeof(*op));
+
+        op = mcs.args;
+        op->cmd = kernel ? MMUEXT_NEW_BASEPTR : MMUEXT_NEW_USER_BASEPTR;
+        op->arg1.mfn = mfn;
+
+        MULTI_mmuext_op(mcs.mc, op, 1, NULL, DOMID_SELF);
+
+        if (kernel) {
+                percpu_write(xen_cr3, cr3);
+
+                /* Update xen_current_cr3 once the batch has actually
+                   been submitted. */
+                xen_mc_callback(set_current_cr3, (void *)cr3);
+        }
+}
+
+static void xen_write_cr3(unsigned long cr3)
+{
+        BUG_ON(preemptible());
+
+        xen_mc_batch();  /* disables interrupts */
+
+        /* Update while interrupts are disabled, so its atomic with
+           respect to ipis */
+        percpu_write(xen_cr3, cr3);
+
+        __xen_write_cr3(true, cr3);
+
+#ifdef CONFIG_X86_64
+        {
+                pgd_t *user_pgd = xen_get_user_pgd(__va(cr3));
+                if (user_pgd)
+                        __xen_write_cr3(false, __pa(user_pgd));
+                else
+                        __xen_write_cr3(false, 0);
+        }
+#endif
+
+        xen_mc_issue(PARAVIRT_LAZY_CPU);  /* interrupts restored */
+}
+
+static int xen_pgd_alloc(struct mm_struct *mm)
+{
+        pgd_t *pgd = mm->pgd;
+        int ret = 0;
+
+        BUG_ON(PagePinned(virt_to_page(pgd)));
+
+#ifdef CONFIG_X86_64
+        {
+                struct page *page = virt_to_page(pgd);
+                pgd_t *user_pgd;
+
+                BUG_ON(page->private != 0);
+
+                ret = -ENOMEM;
+
+                user_pgd = (pgd_t *)__get_free_page(GFP_KERNEL | __GFP_ZERO);
+                page->private = (unsigned long)user_pgd;
+
+                if (user_pgd != NULL) {
+                        user_pgd[pgd_index(VSYSCALL_START)] =
+                                __pgd(__pa(level3_user_vsyscall) | _PAGE_TABLE);
+                        ret = 0;
+                }
+
+                BUG_ON(PagePinned(virt_to_page(xen_get_user_pgd(pgd))));
+        }
+#endif
+
+        return ret;
+}
+
+static void xen_pgd_free(struct mm_struct *mm, pgd_t *pgd)
+{
+#ifdef CONFIG_X86_64
+        pgd_t *user_pgd = xen_get_user_pgd(pgd);
+
+        if (user_pgd)
+                free_page((unsigned long)user_pgd);
+#endif
+}
+
+#ifdef CONFIG_HIGHPTE
+static void *xen_kmap_atomic_pte(struct page *page, enum km_type type)
+{
+        pgprot_t prot = PAGE_KERNEL;
+
+        if (PagePinned(page))
+                prot = PAGE_KERNEL_RO;
+
+        if (0 && PageHighMem(page))
+                printk("mapping highpte %lx type %d prot %s\n",
+                       page_to_pfn(page), type,
+                       (unsigned long)pgprot_val(prot) & _PAGE_RW ? "WRITE" : "READ");
+
+        return kmap_atomic_prot(page, type, prot);
+}
+#endif
+
+#ifdef CONFIG_X86_32
+static __init pte_t mask_rw_pte(pte_t *ptep, pte_t pte)
+{
+        /* If there's an existing pte, then don't allow _PAGE_RW to be set */
+        if (pte_val_ma(*ptep) & _PAGE_PRESENT)
+                pte = __pte_ma(((pte_val_ma(*ptep) & _PAGE_RW) | ~_PAGE_RW) &
+                               pte_val_ma(pte));
+
+        return pte;
+}
+
+/* Init-time set_pte while constructing initial pagetables, which
+   doesn't allow RO pagetable pages to be remapped RW */
+static __init void xen_set_pte_init(pte_t *ptep, pte_t pte)
+{
+        pte = mask_rw_pte(ptep, pte);
+
+        xen_set_pte(ptep, pte);
+}
+#endif
+
+/* Early in boot, while setting up the initial pagetable, assume
+   everything is pinned. */
+static __init void xen_alloc_pte_init(struct mm_struct *mm, unsigned long pfn)
+{
+#ifdef CONFIG_FLATMEM
+        BUG_ON(mem_map);        /* should only be used early */
+#endif
+        make_lowmem_page_readonly(__va(PFN_PHYS(pfn)));
+}
+
+/* Early release_pte assumes that all pts are pinned, since there's
+   only init_mm and anything attached to that is pinned. */
+static void xen_release_pte_init(unsigned long pfn)
+{
+        make_lowmem_page_readwrite(__va(PFN_PHYS(pfn)));
+}
+
+static void pin_pagetable_pfn(unsigned cmd, unsigned long pfn)
+{
+        struct mmuext_op op;
+        op.cmd = cmd;
+        op.arg1.mfn = pfn_to_mfn(pfn);
+        if (HYPERVISOR_mmuext_op(&op, 1, NULL, DOMID_SELF))
+                BUG();
+}
+
+/* This needs to make sure the new pte page is pinned iff its being
+   attached to a pinned pagetable. */
+static void xen_alloc_ptpage(struct mm_struct *mm, unsigned long pfn, unsigned level)
+{
+        struct page *page = pfn_to_page(pfn);
+
+        if (PagePinned(virt_to_page(mm->pgd))) {
+                SetPagePinned(page);
+
+                vm_unmap_aliases();
+                if (!PageHighMem(page)) {
+                        make_lowmem_page_readonly(__va(PFN_PHYS((unsigned long)pfn)));
+                        if (level == PT_PTE && USE_SPLIT_PTLOCKS)
+                                pin_pagetable_pfn(MMUEXT_PIN_L1_TABLE, pfn);
+                } else {
+                        /* make sure there are no stray mappings of
+                           this page */
+                        kmap_flush_unused();
+                }
+        }
+}
+
+static void xen_alloc_pte(struct mm_struct *mm, unsigned long pfn)
+{
+        xen_alloc_ptpage(mm, pfn, PT_PTE);
+}
+
+static void xen_alloc_pmd(struct mm_struct *mm, unsigned long pfn)
+{
+        xen_alloc_ptpage(mm, pfn, PT_PMD);
+}
+
+/* This should never happen until we're OK to use struct page */
+static void xen_release_ptpage(unsigned long pfn, unsigned level)
+{
+        struct page *page = pfn_to_page(pfn);
+
+        if (PagePinned(page)) {
+                if (!PageHighMem(page)) {
+                        if (level == PT_PTE && USE_SPLIT_PTLOCKS)
+                                pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, pfn);
+                        make_lowmem_page_readwrite(__va(PFN_PHYS(pfn)));
+                }
+                ClearPagePinned(page);
+        }
+}
+
+static void xen_release_pte(unsigned long pfn)
+{
+        xen_release_ptpage(pfn, PT_PTE);
+}
+
+static void xen_release_pmd(unsigned long pfn)
+{
+        xen_release_ptpage(pfn, PT_PMD);
+}
+
+#if PAGETABLE_LEVELS == 4
+static void xen_alloc_pud(struct mm_struct *mm, unsigned long pfn)
+{
+        xen_alloc_ptpage(mm, pfn, PT_PUD);
+}
+
+static void xen_release_pud(unsigned long pfn)
+{
+        xen_release_ptpage(pfn, PT_PUD);
+}
+#endif
+
+void __init xen_reserve_top(void)
+{
+#ifdef CONFIG_X86_32
+        unsigned long top = HYPERVISOR_VIRT_START;
+        struct xen_platform_parameters pp;
+
+        if (HYPERVISOR_xen_version(XENVER_platform_parameters, &pp) == 0)
+                top = pp.virt_start;
+
+        reserve_top_address(-top);
+#endif  /* CONFIG_X86_32 */
+}
+
+/*
+ * Like __va(), but returns address in the kernel mapping (which is
+ * all we have until the physical memory mapping has been set up.
+ */
+static void *__ka(phys_addr_t paddr)
+{
+#ifdef CONFIG_X86_64
+        return (void *)(paddr + __START_KERNEL_map);
+#else
+        return __va(paddr);
+#endif
+}
+
+/* Convert a machine address to physical address */
+static unsigned long m2p(phys_addr_t maddr)
+{
+        phys_addr_t paddr;
+
+        maddr &= PTE_PFN_MASK;
+        paddr = mfn_to_pfn(maddr >> PAGE_SHIFT) << PAGE_SHIFT;
+
+        return paddr;
+}
+
+/* Convert a machine address to kernel virtual */
+static void *m2v(phys_addr_t maddr)
+{
+        return __ka(m2p(maddr));
+}
+
+static void set_page_prot(void *addr, pgprot_t prot)
+{
+        unsigned long pfn = __pa(addr) >> PAGE_SHIFT;
+        pte_t pte = pfn_pte(pfn, prot);
+
+        if (HYPERVISOR_update_va_mapping((unsigned long)addr, pte, 0))
+                BUG();
+}
+
+static __init void xen_map_identity_early(pmd_t *pmd, unsigned long max_pfn)
+{
+        unsigned pmdidx, pteidx;
+        unsigned ident_pte;
+        unsigned long pfn;
+
+        ident_pte = 0;
+        pfn = 0;
+        for (pmdidx = 0; pmdidx < PTRS_PER_PMD && pfn < max_pfn; pmdidx++) {
+                pte_t *pte_page;
+
+                /* Reuse or allocate a page of ptes */
+                if (pmd_present(pmd[pmdidx]))
+                        pte_page = m2v(pmd[pmdidx].pmd);
+                else {
+                        /* Check for free pte pages */
+                        if (ident_pte == ARRAY_SIZE(level1_ident_pgt))
+                                break;
+
+                        pte_page = &level1_ident_pgt[ident_pte];
+                        ident_pte += PTRS_PER_PTE;
+
+                        pmd[pmdidx] = __pmd(__pa(pte_page) | _PAGE_TABLE);
+                }
+
+                /* Install mappings */
+                for (pteidx = 0; pteidx < PTRS_PER_PTE; pteidx++, pfn++) {
+                        pte_t pte;
+
+                        if (pfn > max_pfn_mapped)
+                                max_pfn_mapped = pfn;
+
+                        if (!pte_none(pte_page[pteidx]))
+                                continue;
+
+                        pte = pfn_pte(pfn, PAGE_KERNEL_EXEC);
+                        pte_page[pteidx] = pte;
+                }
+        }
+
+        for (pteidx = 0; pteidx < ident_pte; pteidx += PTRS_PER_PTE)
+                set_page_prot(&level1_ident_pgt[pteidx], PAGE_KERNEL_RO);
+
+        set_page_prot(pmd, PAGE_KERNEL_RO);
+}
+
+#ifdef CONFIG_X86_64
+static void convert_pfn_mfn(void *v)
+{
+        pte_t *pte = v;
+        int i;
+
+        /* All levels are converted the same way, so just treat them
+           as ptes. */
+        for (i = 0; i < PTRS_PER_PTE; i++)
+                pte[i] = xen_make_pte(pte[i].pte);
+}
+
+/*
+ * Set up the inital kernel pagetable.
+ *
+ * We can construct this by grafting the Xen provided pagetable into
+ * head_64.S's preconstructed pagetables.  We copy the Xen L2's into
+ * level2_ident_pgt, level2_kernel_pgt and level2_fixmap_pgt.  This
+ * means that only the kernel has a physical mapping to start with -
+ * but that's enough to get __va working.  We need to fill in the rest
+ * of the physical mapping once some sort of allocator has been set
+ * up.
+ */
+__init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
+                                         unsigned long max_pfn)
+{
+        pud_t *l3;
+        pmd_t *l2;
+
+        /* Zap identity mapping */
+        init_level4_pgt[0] = __pgd(0);
+
+        /* Pre-constructed entries are in pfn, so convert to mfn */
+        convert_pfn_mfn(init_level4_pgt);
+        convert_pfn_mfn(level3_ident_pgt);
+        convert_pfn_mfn(level3_kernel_pgt);
+
+        l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
+        l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
+
+        memcpy(level2_ident_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+        memcpy(level2_kernel_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        l3 = m2v(pgd[pgd_index(__START_KERNEL_map + PMD_SIZE)].pgd);
+        l2 = m2v(l3[pud_index(__START_KERNEL_map + PMD_SIZE)].pud);
+        memcpy(level2_fixmap_pgt, l2, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        /* Set up identity map */
+        xen_map_identity_early(level2_ident_pgt, max_pfn);
+
+        /* Make pagetable pieces RO */
+        set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
+
+        /* Pin down new L4 */
+        pin_pagetable_pfn(MMUEXT_PIN_L4_TABLE,
+                          PFN_DOWN(__pa_symbol(init_level4_pgt)));
+
+        /* Unpin Xen-provided one */
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+
+        /* Switch over */
+        pgd = init_level4_pgt;
+
+        /*
+         * At this stage there can be no user pgd, and no page
+         * structure to attach it to, so make sure we just set kernel
+         * pgd.
+         */
+        xen_mc_batch();
+        __xen_write_cr3(true, __pa(pgd));
+        xen_mc_issue(PARAVIRT_LAZY_CPU);
+
+        reserve_early(__pa(xen_start_info->pt_base),
+                      __pa(xen_start_info->pt_base +
+                           xen_start_info->nr_pt_frames * PAGE_SIZE),
+                      "XEN PAGETABLES");
+
+        return pgd;
+}
+#else   /* !CONFIG_X86_64 */
+static pmd_t level2_kernel_pgt[PTRS_PER_PMD] __page_aligned_bss;
+
+__init pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd,
+                                         unsigned long max_pfn)
+{
+        pmd_t *kernel_pmd;
+
+        init_pg_tables_start = __pa(pgd);
+        init_pg_tables_end = __pa(pgd) + xen_start_info->nr_pt_frames*PAGE_SIZE;
+        max_pfn_mapped = PFN_DOWN(init_pg_tables_end + 512*1024);
+
+        kernel_pmd = m2v(pgd[KERNEL_PGD_BOUNDARY].pgd);
+        memcpy(level2_kernel_pgt, kernel_pmd, sizeof(pmd_t) * PTRS_PER_PMD);
+
+        xen_map_identity_early(level2_kernel_pgt, max_pfn);
+
+        memcpy(swapper_pg_dir, pgd, sizeof(pgd_t) * PTRS_PER_PGD);
+        set_pgd(&swapper_pg_dir[KERNEL_PGD_BOUNDARY],
+                        __pgd(__pa(level2_kernel_pgt) | _PAGE_PRESENT));
+
+        set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
+        set_page_prot(swapper_pg_dir, PAGE_KERNEL_RO);
+        set_page_prot(empty_zero_page, PAGE_KERNEL_RO);
+
+        pin_pagetable_pfn(MMUEXT_UNPIN_TABLE, PFN_DOWN(__pa(pgd)));
+
+        xen_write_cr3(__pa(swapper_pg_dir));
+
+        pin_pagetable_pfn(MMUEXT_PIN_L3_TABLE, PFN_DOWN(__pa(swapper_pg_dir)));
+
+        return swapper_pg_dir;
+}
+#endif  /* CONFIG_X86_64 */
+
+static void xen_set_fixmap(unsigned idx, unsigned long phys, pgprot_t prot)
+{
+        pte_t pte;
+
+        phys >>= PAGE_SHIFT;
+
+        switch (idx) {
+        case FIX_BTMAP_END ... FIX_BTMAP_BEGIN:
+#ifdef CONFIG_X86_F00F_BUG
+        case FIX_F00F_IDT:
+#endif
+#ifdef CONFIG_X86_32
+        case FIX_WP_TEST:
+        case FIX_VDSO:
+# ifdef CONFIG_HIGHMEM
+        case FIX_KMAP_BEGIN ... FIX_KMAP_END:
+# endif
+#else
+        case VSYSCALL_LAST_PAGE ... VSYSCALL_FIRST_PAGE:
+#endif
+#ifdef CONFIG_X86_LOCAL_APIC
+        case FIX_APIC_BASE:     /* maps dummy local APIC */
+#endif
+                pte = pfn_pte(phys, prot);
+                break;
+
+        default:
+                pte = mfn_pte(phys, prot);
+                break;
+        }
+
+        __native_set_fixmap(idx, pte);
+
+#ifdef CONFIG_X86_64
+        /* Replicate changes to map the vsyscall page into the user
+           pagetable vsyscall mapping. */
+        if (idx >= VSYSCALL_LAST_PAGE && idx <= VSYSCALL_FIRST_PAGE) {
+                unsigned long vaddr = __fix_to_virt(idx);
+                set_pte_vaddr_pud(level3_user_vsyscall, vaddr, pte);
+        }
+#endif
+}
+
+__init void xen_post_allocator_init(void)
+{
+        pv_mmu_ops.set_pte = xen_set_pte;
+        pv_mmu_ops.set_pmd = xen_set_pmd;
+        pv_mmu_ops.set_pud = xen_set_pud;
+#if PAGETABLE_LEVELS == 4
+        pv_mmu_ops.set_pgd = xen_set_pgd;
+#endif
+
+        /* This will work as long as patching hasn't happened yet
+           (which it hasn't) */
+        pv_mmu_ops.alloc_pte = xen_alloc_pte;
+        pv_mmu_ops.alloc_pmd = xen_alloc_pmd;
+        pv_mmu_ops.release_pte = xen_release_pte;
+        pv_mmu_ops.release_pmd = xen_release_pmd;
+#if PAGETABLE_LEVELS == 4
+        pv_mmu_ops.alloc_pud = xen_alloc_pud;
+        pv_mmu_ops.release_pud = xen_release_pud;
+#endif
+
+#ifdef CONFIG_X86_64
+        SetPagePinned(virt_to_page(level3_user_vsyscall));
+#endif
+        xen_mark_init_mm_pinned();
+}
+
+
+const struct pv_mmu_ops xen_mmu_ops __initdata = {
+        .pagetable_setup_start = xen_pagetable_setup_start,
+        .pagetable_setup_done = xen_pagetable_setup_done,
+
+        .read_cr2 = xen_read_cr2,
+        .write_cr2 = xen_write_cr2,
+
+        .read_cr3 = xen_read_cr3,
+        .write_cr3 = xen_write_cr3,
+
+        .flush_tlb_user = xen_flush_tlb,
+        .flush_tlb_kernel = xen_flush_tlb,
+        .flush_tlb_single = xen_flush_tlb_single,
+        .flush_tlb_others = xen_flush_tlb_others,
+
+        .pte_update = paravirt_nop,
+        .pte_update_defer = paravirt_nop,
+
+        .pgd_alloc = xen_pgd_alloc,
+        .pgd_free = xen_pgd_free,
+
+        .alloc_pte = xen_alloc_pte_init,
+        .release_pte = xen_release_pte_init,
+        .alloc_pmd = xen_alloc_pte_init,
+        .alloc_pmd_clone = paravirt_nop,
+        .release_pmd = xen_release_pte_init,
+
+#ifdef CONFIG_HIGHPTE
+        .kmap_atomic_pte = xen_kmap_atomic_pte,
+#endif
+
+#ifdef CONFIG_X86_64
+        .set_pte = xen_set_pte,
+#else
+        .set_pte = xen_set_pte_init,
+#endif
+        .set_pte_at = xen_set_pte_at,
+        .set_pmd = xen_set_pmd_hyper,
+
+        .ptep_modify_prot_start = __ptep_modify_prot_start,
+        .ptep_modify_prot_commit = __ptep_modify_prot_commit,
+
+        .pte_val = PV_CALLEE_SAVE(xen_pte_val),
+        .pgd_val = PV_CALLEE_SAVE(xen_pgd_val),
+
+        .make_pte = PV_CALLEE_SAVE(xen_make_pte),
+        .make_pgd = PV_CALLEE_SAVE(xen_make_pgd),
+
+#ifdef CONFIG_X86_PAE
+        .set_pte_atomic = xen_set_pte_atomic,
+        .set_pte_present = xen_set_pte_at,
+        .pte_clear = xen_pte_clear,
+        .pmd_clear = xen_pmd_clear,
+#endif  /* CONFIG_X86_PAE */
+        .set_pud = xen_set_pud_hyper,
+
+        .make_pmd = PV_CALLEE_SAVE(xen_make_pmd),
+        .pmd_val = PV_CALLEE_SAVE(xen_pmd_val),
+
+#if PAGETABLE_LEVELS == 4
+        .pud_val = PV_CALLEE_SAVE(xen_pud_val),
+        .make_pud = PV_CALLEE_SAVE(xen_make_pud),
+        .set_pgd = xen_set_pgd_hyper,
+
+        .alloc_pud = xen_alloc_pte_init,
+        .release_pud = xen_release_pte_init,
+#endif  /* PAGETABLE_LEVELS == 4 */
+
+        .activate_mm = xen_activate_mm,
+        .dup_mmap = xen_dup_mmap,
+        .exit_mmap = xen_exit_mmap,
+
+        .lazy_mode = {
+                .enter = paravirt_enter_lazy_mmu,
+                .leave = xen_leave_lazy,
+        },
+
+        .set_fixmap = xen_set_fixmap,
+};
+
+
 #ifdef CONFIG_XEN_DEBUG_FS
 
 static struct dentry *d_mmu_debug;
diff --git a/arch/x86/xen/mmu.h b/arch/x86/xen/mmu.h
index 98d71659da5..24d1b44a337 100644
--- a/arch/x86/xen/mmu.h
+++ b/arch/x86/xen/mmu.h
@@ -54,4 +54,7 @@ pte_t xen_ptep_modify_prot_start(struct mm_struct *mm, unsigned long addr, pte_t
 void  xen_ptep_modify_prot_commit(struct mm_struct *mm, unsigned long addr,
                                   pte_t *ptep, pte_t pte);
 
+unsigned long xen_read_cr2_direct(void);
+
+extern const struct pv_mmu_ops xen_mmu_ops;
 #endif  /* _XEN_MMU_H */
diff --git a/arch/x86/xen/multicalls.h b/arch/x86/xen/multicalls.h
index 85893824161..9e565da5d1f 100644
--- a/arch/x86/xen/multicalls.h
+++ b/arch/x86/xen/multicalls.h
@@ -19,8 +19,10 @@ DECLARE_PER_CPU(unsigned long, xen_mc_irq_flags);
    paired with xen_mc_issue() */
 static inline void xen_mc_batch(void)
 {
+        unsigned long flags;
         /* need to disable interrupts until this entry is complete */
-        local_irq_save(__get_cpu_var(xen_mc_irq_flags));
+        local_irq_save(flags);
+        __get_cpu_var(xen_mc_irq_flags) = flags;
 }
 
 static inline struct multicall_space xen_mc_entry(size_t args)
@@ -39,7 +41,7 @@ static inline void xen_mc_issue(unsigned mode)
                 xen_mc_flush();
 
         /* restore flags saved in xen_mc_batch */
-        local_irq_restore(x86_read_percpu(xen_mc_irq_flags));
+        local_irq_restore(percpu_read(xen_mc_irq_flags));
 }
 
 /* Set up a callback to be called when the current batch is flushed */
diff --git a/arch/x86/xen/smp.c b/arch/x86/xen/smp.c
index c44e2069c7c..035582ae815 100644
--- a/arch/x86/xen/smp.c
+++ b/arch/x86/xen/smp.c
@@ -50,11 +50,7 @@ static irqreturn_t xen_call_function_single_interrupt(int irq, void *dev_id);
  */
 static irqreturn_t xen_reschedule_interrupt(int irq, void *dev_id)
 {
-#ifdef CONFIG_X86_32
-        __get_cpu_var(irq_stat).irq_resched_count++;
-#else
-        add_pda(irq_resched_count, 1);
-#endif
+        inc_irq_stat(irq_resched_count);
 
         return IRQ_HANDLED;
 }
@@ -78,7 +74,7 @@ static __cpuinit void cpu_bringup(void)
         xen_setup_cpu_clockevents();
 
         cpu_set(cpu, cpu_online_map);
-        x86_write_percpu(cpu_state, CPU_ONLINE);
+        percpu_write(cpu_state, CPU_ONLINE);
         wmb();
 
         /* We can take interrupts now: we're officially "up". */
@@ -174,7 +170,7 @@ static void __init xen_smp_prepare_boot_cpu(void)
 
         /* We've switched to the "real" per-cpu gdt, so make sure the
            old memory can be recycled */
-        make_lowmem_page_readwrite(&per_cpu_var(gdt_page));
+        make_lowmem_page_readwrite(xen_initial_gdt);
 
         xen_setup_vcpu_info_placement();
 }
@@ -239,6 +235,8 @@ cpu_initialize_context(unsigned int cpu, struct task_struct *idle)
         ctxt->user_regs.ss = __KERNEL_DS;
 #ifdef CONFIG_X86_32
         ctxt->user_regs.fs = __KERNEL_PERCPU;
+#else
+        ctxt->gs_base_kernel = per_cpu_offset(cpu);
 #endif
         ctxt->user_regs.eip = (unsigned long)cpu_bringup_and_idle;
         ctxt->user_regs.eflags = 0x1000; /* IOPL_RING1 */
@@ -283,23 +281,14 @@ static int __cpuinit xen_cpu_up(unsigned int cpu)
         struct task_struct *idle = idle_task(cpu);
         int rc;
 
-#ifdef CONFIG_X86_64
-        /* Allocate node local memory for AP pdas */
-        WARN_ON(cpu == 0);
-        if (cpu > 0) {
-                rc = get_local_pda(cpu);
-                if (rc)
-                        return rc;
-        }
-#endif
-
-#ifdef CONFIG_X86_32
-        init_gdt(cpu);
         per_cpu(current_task, cpu) = idle;
+#ifdef CONFIG_X86_32
         irq_ctx_init(cpu);
 #else
-        cpu_pda(cpu)->pcurrent = idle;
         clear_tsk_thread_flag(idle, TIF_FORK);
+        per_cpu(kernel_stack, cpu) =
+                (unsigned long)task_stack_page(idle) -
+                KERNEL_STACK_OFFSET + THREAD_SIZE;
 #endif
         xen_setup_timer(cpu);
         xen_init_lock_cpu(cpu);
@@ -445,11 +434,7 @@ static irqreturn_t xen_call_function_interrupt(int irq, void *dev_id)
 {
         irq_enter();
         generic_smp_call_function_interrupt();
-#ifdef CONFIG_X86_32
-        __get_cpu_var(irq_stat).irq_call_count++;
-#else
-        add_pda(irq_call_count, 1);
-#endif
+        inc_irq_stat(irq_call_count);
         irq_exit();
 
         return IRQ_HANDLED;
@@ -459,11 +444,7 @@ static irqreturn_t xen_call_function_single_interrupt(int irq, void *dev_id)
 {
         irq_enter();
         generic_smp_call_function_single_interrupt();
-#ifdef CONFIG_X86_32
-        __get_cpu_var(irq_stat).irq_call_count++;
-#else
-        add_pda(irq_call_count, 1);
-#endif
+        inc_irq_stat(irq_call_count);
         irq_exit();
 
         return IRQ_HANDLED;
diff --git a/arch/x86/xen/suspend.c b/arch/x86/xen/suspend.c
index 212ffe012b7..95be7b43472 100644
--- a/arch/x86/xen/suspend.c
+++ b/arch/x86/xen/suspend.c
@@ -6,6 +6,7 @@
 
 #include <asm/xen/hypercall.h>
 #include <asm/xen/page.h>
+#include <asm/fixmap.h>
 
 #include "xen-ops.h"
 #include "mmu.h"
diff --git a/arch/x86/xen/xen-asm.S b/arch/x86/xen/xen-asm.S
new file mode 100644
index 00000000000..79d7362ad6d
--- /dev/null
+++ b/arch/x86/xen/xen-asm.S
@@ -0,0 +1,142 @@
+/*
+ * Asm versions of Xen pv-ops, suitable for either direct use or
+ * inlining.  The inline versions are the same as the direct-use
+ * versions, with the pre- and post-amble chopped off.
+ *
+ * This code is encoded for size rather than absolute efficiency, with
+ * a view to being able to inline as much as possible.
+ *
+ * We only bother with direct forms (ie, vcpu in percpu data) of the
+ * operations here; the indirect forms are better handled in C, since
+ * they're generally too large to inline anyway.
+ */
+
+#include <asm/asm-offsets.h>
+#include <asm/percpu.h>
+#include <asm/processor-flags.h>
+
+#include "xen-asm.h"
+
+/*
+ * Enable events.  This clears the event mask and tests the pending
+ * event status with one and operation.  If there are pending events,
+ * then enter the hypervisor to get them handled.
+ */
+ENTRY(xen_irq_enable_direct)
+        /* Unmask events */
+        movb $0, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_mask
+
+        /*
+         * Preempt here doesn't matter because that will deal with any
+         * pending interrupts.  The pending check may end up being run
+         * on the wrong CPU, but that doesn't hurt.
+         */
+
+        /* Test for pending */
+        testb $0xff, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
+        jz 1f
+
+2:      call check_events
+1:
+ENDPATCH(xen_irq_enable_direct)
+        ret
+        ENDPROC(xen_irq_enable_direct)
+        RELOC(xen_irq_enable_direct, 2b+1)
+
+
+/*
+ * Disabling events is simply a matter of making the event mask
+ * non-zero.
+ */
+ENTRY(xen_irq_disable_direct)
+        movb $1, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_mask
+ENDPATCH(xen_irq_disable_direct)
+        ret
+        ENDPROC(xen_irq_disable_direct)
+        RELOC(xen_irq_disable_direct, 0)
+
+/*
+ * (xen_)save_fl is used to get the current interrupt enable status.
+ * Callers expect the status to be in X86_EFLAGS_IF, and other bits
+ * may be set in the return value.  We take advantage of this by
+ * making sure that X86_EFLAGS_IF has the right value (and other bits
+ * in that byte are 0), but other bits in the return value are
+ * undefined.  We need to toggle the state of the bit, because Xen and
+ * x86 use opposite senses (mask vs enable).
+ */
+ENTRY(xen_save_fl_direct)
+        testb $0xff, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_mask
+        setz %ah
+        addb %ah, %ah
+ENDPATCH(xen_save_fl_direct)
+        ret
+        ENDPROC(xen_save_fl_direct)
+        RELOC(xen_save_fl_direct, 0)
+
+
+/*
+ * In principle the caller should be passing us a value return from
+ * xen_save_fl_direct, but for robustness sake we test only the
+ * X86_EFLAGS_IF flag rather than the whole byte. After setting the
+ * interrupt mask state, it checks for unmasked pending events and
+ * enters the hypervisor to get them delivered if so.
+ */
+ENTRY(xen_restore_fl_direct)
+#ifdef CONFIG_X86_64
+        testw $X86_EFLAGS_IF, %di
+#else
+        testb $X86_EFLAGS_IF>>8, %ah
+#endif
+        setz PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_mask
+        /*
+         * Preempt here doesn't matter because that will deal with any
+         * pending interrupts.  The pending check may end up being run
+         * on the wrong CPU, but that doesn't hurt.
+         */
+
+        /* check for unmasked and pending */
+        cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info) + XEN_vcpu_info_pending
+        jz 1f
+2:      call check_events
+1:
+ENDPATCH(xen_restore_fl_direct)
+        ret
+        ENDPROC(xen_restore_fl_direct)
+        RELOC(xen_restore_fl_direct, 2b+1)
+
+
+/*
+ * Force an event check by making a hypercall, but preserve regs
+ * before making the call.
+ */
+check_events:
+#ifdef CONFIG_X86_32
+        push %eax
+        push %ecx
+        push %edx
+        call xen_force_evtchn_callback
+        pop %edx
+        pop %ecx
+        pop %eax
+#else
+        push %rax
+        push %rcx
+        push %rdx
+        push %rsi
+        push %rdi
+        push %r8
+        push %r9
+        push %r10
+        push %r11
+        call xen_force_evtchn_callback
+        pop %r11
+        pop %r10
+        pop %r9
+        pop %r8
+        pop %rdi
+        pop %rsi
+        pop %rdx
+        pop %rcx
+        pop %rax
+#endif
+        ret
diff --git a/arch/x86/xen/xen-asm.h b/arch/x86/xen/xen-asm.h
new file mode 100644
index 00000000000..465276467a4
--- /dev/null
+++ b/arch/x86/xen/xen-asm.h
@@ -0,0 +1,12 @@
+#ifndef _XEN_XEN_ASM_H
+#define _XEN_XEN_ASM_H
+
+#include <linux/linkage.h>
+
+#define RELOC(x, v)     .globl x##_reloc; x##_reloc=v
+#define ENDPATCH(x)     .globl x##_end; x##_end=.
+
+/* Pseudo-flag used for virtual NMI, which we don't implement yet */
+#define XEN_EFLAGS_NMI  0x80000000
+
+#endif
diff --git a/arch/x86/xen/xen-asm_32.S b/arch/x86/xen/xen-asm_32.S
index 42786f59d9c..88e15deb8b8 100644
--- a/arch/x86/xen/xen-asm_32.S
+++ b/arch/x86/xen/xen-asm_32.S
@@ -1,117 +1,43 @@
 /*
-        Asm versions of Xen pv-ops, suitable for either direct use or inlining.
-        The inline versions are the same as the direct-use versions, with the
-        pre- and post-amble chopped off.
-
-        This code is encoded for size rather than absolute efficiency,
-        with a view to being able to inline as much as possible.
-
-        We only bother with direct forms (ie, vcpu in pda) of the operations
-        here; the indirect forms are better handled in C, since they're
-        generally too large to inline anyway.
+ * Asm versions of Xen pv-ops, suitable for either direct use or
+ * inlining.  The inline versions are the same as the direct-use
+ * versions, with the pre- and post-amble chopped off.
+ *
+ * This code is encoded for size rather than absolute efficiency, with
+ * a view to being able to inline as much as possible.
+ *
+ * We only bother with direct forms (ie, vcpu in pda) of the
+ * operations here; the indirect forms are better handled in C, since
+ * they're generally too large to inline anyway.
  */
 
-#include <linux/linkage.h>
-
-#include <asm/asm-offsets.h>
 #include <asm/thread_info.h>
-#include <asm/percpu.h>
 #include <asm/processor-flags.h>
 #include <asm/segment.h>
 
 #include <xen/interface/xen.h>
 
-#define RELOC(x, v)     .globl x##_reloc; x##_reloc=v
-#define ENDPATCH(x)     .globl x##_end; x##_end=.
-
-/* Pseudo-flag used for virtual NMI, which we don't implement yet */
-#define XEN_EFLAGS_NMI  0x80000000
-
-/*
-        Enable events.  This clears the event mask and tests the pending
-        event status with one and operation.  If there are pending
-        events, then enter the hypervisor to get them handled.
- */
-ENTRY(xen_irq_enable_direct)
-        /* Unmask events */
-        movb $0, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_mask
-
-        /* Preempt here doesn't matter because that will deal with
-           any pending interrupts.  The pending check may end up being
-           run on the wrong CPU, but that doesn't hurt. */
-
-        /* Test for pending */
-        testb $0xff, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_pending
-        jz 1f
-
-2:      call check_events
-1:
-ENDPATCH(xen_irq_enable_direct)
-        ret
-        ENDPROC(xen_irq_enable_direct)
-        RELOC(xen_irq_enable_direct, 2b+1)
-
-
-/*
-        Disabling events is simply a matter of making the event mask
-        non-zero.
- */
-ENTRY(xen_irq_disable_direct)
-        movb $1, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_mask
-ENDPATCH(xen_irq_disable_direct)
-        ret
-        ENDPROC(xen_irq_disable_direct)
-        RELOC(xen_irq_disable_direct, 0)
+#include "xen-asm.h"
 
 /*
-        (xen_)save_fl is used to get the current interrupt enable status.
-        Callers expect the status to be in X86_EFLAGS_IF, and other bits
-        may be set in the return value.  We take advantage of this by
-        making sure that X86_EFLAGS_IF has the right value (and other bits
-        in that byte are 0), but other bits in the return value are
-        undefined.  We need to toggle the state of the bit, because
-        Xen and x86 use opposite senses (mask vs enable).
+ * Force an event check by making a hypercall, but preserve regs
+ * before making the call.
  */
-ENTRY(xen_save_fl_direct)
-        testb $0xff, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_mask
-        setz %ah
-        addb %ah,%ah
-ENDPATCH(xen_save_fl_direct)
-        ret
-        ENDPROC(xen_save_fl_direct)
-        RELOC(xen_save_fl_direct, 0)
-
-
-/*
-        In principle the caller should be passing us a value return
-        from xen_save_fl_direct, but for robustness sake we test only
-        the X86_EFLAGS_IF flag rather than the whole byte. After
-        setting the interrupt mask state, it checks for unmasked
-        pending events and enters the hypervisor to get them delivered
-        if so.
- */
-ENTRY(xen_restore_fl_direct)
-        testb $X86_EFLAGS_IF>>8, %ah
-        setz PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_mask
-        /* Preempt here doesn't matter because that will deal with
-           any pending interrupts.  The pending check may end up being
-           run on the wrong CPU, but that doesn't hurt. */
-
-        /* check for unmasked and pending */
-        cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info)+XEN_vcpu_info_pending
-        jz 1f
-2:      call check_events
-1:
-ENDPATCH(xen_restore_fl_direct)
+check_events:
+        push %eax
+        push %ecx
+        push %edx
+        call xen_force_evtchn_callback
+        pop %edx
+        pop %ecx
+        pop %eax
         ret
-        ENDPROC(xen_restore_fl_direct)
-        RELOC(xen_restore_fl_direct, 2b+1)
 
 /*
-        We can't use sysexit directly, because we're not running in ring0.
-        But we can easily fake it up using iret.  Assuming xen_sysexit
-        is jumped to with a standard stack frame, we can just strip it
-        back to a standard iret frame and use iret.
+ * We can't use sysexit directly, because we're not running in ring0.
+ * But we can easily fake it up using iret.  Assuming xen_sysexit is
+ * jumped to with a standard stack frame, we can just strip it back to
+ * a standard iret frame and use iret.
  */
 ENTRY(xen_sysexit)
         movl PT_EAX(%esp), %eax                 /* Shouldn't be necessary? */
@@ -122,33 +48,31 @@ ENTRY(xen_sysexit)
 ENDPROC(xen_sysexit)
 
 /*
-        This is run where a normal iret would be run, with the same stack setup:
-              8: eflags
-              4: cs
-        esp-> 0: eip
-
-        This attempts to make sure that any pending events are dealt
-        with on return to usermode, but there is a small window in
-        which an event can happen just before entering usermode.  If
-        the nested interrupt ends up setting one of the TIF_WORK_MASK
-        pending work flags, they will not be tested again before
-        returning to usermode. This means that a process can end up
-        with pending work, which will be unprocessed until the process
-        enters and leaves the kernel again, which could be an
-        unbounded amount of time.  This means that a pending signal or
-        reschedule event could be indefinitely delayed.
-
-        The fix is to notice a nested interrupt in the critical
-        window, and if one occurs, then fold the nested interrupt into
-        the current interrupt stack frame, and re-process it
-        iteratively rather than recursively.  This means that it will
-        exit via the normal path, and all pending work will be dealt
-        with appropriately.
-
-        Because the nested interrupt handler needs to deal with the
-        current stack state in whatever form its in, we keep things
-        simple by only using a single register which is pushed/popped
-        on the stack.
+ * This is run where a normal iret would be run, with the same stack setup:
+ *      8: eflags
+ *      4: cs
+ *      esp-> 0: eip
+ *
+ * This attempts to make sure that any pending events are dealt with
+ * on return to usermode, but there is a small window in which an
+ * event can happen just before entering usermode.  If the nested
+ * interrupt ends up setting one of the TIF_WORK_MASK pending work
+ * flags, they will not be tested again before returning to
+ * usermode. This means that a process can end up with pending work,
+ * which will be unprocessed until the process enters and leaves the
+ * kernel again, which could be an unbounded amount of time.  This
+ * means that a pending signal or reschedule event could be
+ * indefinitely delayed.
+ *
+ * The fix is to notice a nested interrupt in the critical window, and
+ * if one occurs, then fold the nested interrupt into the current
+ * interrupt stack frame, and re-process it iteratively rather than
+ * recursively.  This means that it will exit via the normal path, and
+ * all pending work will be dealt with appropriately.
+ *
+ * Because the nested interrupt handler needs to deal with the current
+ * stack state in whatever form its in, we keep things simple by only
+ * using a single register which is pushed/popped on the stack.
  */
 ENTRY(xen_iret)
         /* test eflags for special cases */
@@ -158,13 +82,15 @@ ENTRY(xen_iret)
         push %eax
         ESP_OFFSET=4    # bytes pushed onto stack
 
-        /* Store vcpu_info pointer for easy access.  Do it this
-           way to avoid having to reload %fs */
+        /*
+         * Store vcpu_info pointer for easy access.  Do it this way to
+         * avoid having to reload %fs
+         */
 #ifdef CONFIG_SMP
         GET_THREAD_INFO(%eax)
-        movl TI_cpu(%eax),%eax
-        movl __per_cpu_offset(,%eax,4),%eax
-        mov per_cpu__xen_vcpu(%eax),%eax
+        movl TI_cpu(%eax), %eax
+        movl __per_cpu_offset(,%eax,4), %eax
+        mov per_cpu__xen_vcpu(%eax), %eax
 #else
         movl per_cpu__xen_vcpu, %eax
 #endif
@@ -172,37 +98,46 @@ ENTRY(xen_iret)
         /* check IF state we're restoring */
         testb $X86_EFLAGS_IF>>8, 8+1+ESP_OFFSET(%esp)
 
-        /* Maybe enable events.  Once this happens we could get a
-           recursive event, so the critical region starts immediately
-           afterwards.  However, if that happens we don't end up
-           resuming the code, so we don't have to be worried about
-           being preempted to another CPU. */
+        /*
+         * Maybe enable events.  Once this happens we could get a
+         * recursive event, so the critical region starts immediately
+         * afterwards.  However, if that happens we don't end up
+         * resuming the code, so we don't have to be worried about
+         * being preempted to another CPU.
+         */
         setz XEN_vcpu_info_mask(%eax)
 xen_iret_start_crit:
 
         /* check for unmasked and pending */
         cmpw $0x0001, XEN_vcpu_info_pending(%eax)
 
-        /* If there's something pending, mask events again so we
-           can jump back into xen_hypervisor_callback */
+        /*
+         * If there's something pending, mask events again so we can
+         * jump back into xen_hypervisor_callback
+         */
         sete XEN_vcpu_info_mask(%eax)
 
         popl %eax
 
-        /* From this point on the registers are restored and the stack
-           updated, so we don't need to worry about it if we're preempted */
+        /*
+         * From this point on the registers are restored and the stack
+         * updated, so we don't need to worry about it if we're
+         * preempted
+         */
 iret_restore_end:
 
-        /* Jump to hypervisor_callback after fixing up the stack.
-           Events are masked, so jumping out of the critical
-           region is OK. */
+        /*
+         * Jump to hypervisor_callback after fixing up the stack.
+         * Events are masked, so jumping out of the critical region is
+         * OK.
+         */
         je xen_hypervisor_callback
 
 1:      iret
 xen_iret_end_crit:
-.section __ex_table,"a"
+.section __ex_table, "a"
         .align 4
-        .long 1b,iret_exc
+        .long 1b, iret_exc
 .previous
 
 hyper_iret:
@@ -212,55 +147,55 @@ hyper_iret:
         .globl xen_iret_start_crit, xen_iret_end_crit
 
 /*
-   This is called by xen_hypervisor_callback in entry.S when it sees
-   that the EIP at the time of interrupt was between xen_iret_start_crit
-   and xen_iret_end_crit.  We're passed the EIP in %eax so we can do
-   a more refined determination of what to do.
-
-   The stack format at this point is:
-        ----------------
-         ss             : (ss/esp may be present if we came from usermode)
-         esp            :
-         eflags         }  outer exception info
-         cs             }
-         eip            }
-        ---------------- <- edi (copy dest)
-         eax            :  outer eax if it hasn't been restored
-        ----------------
-         eflags         }  nested exception info
-         cs             }   (no ss/esp because we're nested
-         eip            }    from the same ring)
-         orig_eax       }<- esi (copy src)
-         - - - - - - - -
-         fs             }
-         es             }
-         ds             }  SAVE_ALL state
-         eax            }
-          :             :
-         ebx            }<- esp
-        ----------------
-
-   In order to deliver the nested exception properly, we need to shift
-   everything from the return addr up to the error code so it
-   sits just under the outer exception info.  This means that when we
-   handle the exception, we do it in the context of the outer exception
-   rather than starting a new one.
-
-   The only caveat is that if the outer eax hasn't been
-   restored yet (ie, it's still on stack), we need to insert
-   its value into the SAVE_ALL state before going on, since
-   it's usermode state which we eventually need to restore.
+ * This is called by xen_hypervisor_callback in entry.S when it sees
+ * that the EIP at the time of interrupt was between
+ * xen_iret_start_crit and xen_iret_end_crit.  We're passed the EIP in
+ * %eax so we can do a more refined determination of what to do.
+ *
+ * The stack format at this point is:
+ *      ----------------
+ *       ss             : (ss/esp may be present if we came from usermode)
+ *       esp            :
+ *       eflags         }  outer exception info
+ *       cs             }
+ *       eip            }
+ *      ---------------- <- edi (copy dest)
+ *       eax            :  outer eax if it hasn't been restored
+ *      ----------------
+ *       eflags         }  nested exception info
+ *       cs             }   (no ss/esp because we're nested
+ *       eip            }    from the same ring)
+ *       orig_eax       }<- esi (copy src)
+ *       - - - - - - - -
+ *       fs             }
+ *       es             }
+ *       ds             }  SAVE_ALL state
+ *       eax            }
+ *        :             :
+ *       ebx            }<- esp
+ *      ----------------
+ *
+ * In order to deliver the nested exception properly, we need to shift
+ * everything from the return addr up to the error code so it sits
+ * just under the outer exception info.  This means that when we
+ * handle the exception, we do it in the context of the outer
+ * exception rather than starting a new one.
+ *
+ * The only caveat is that if the outer eax hasn't been restored yet
+ * (ie, it's still on stack), we need to insert its value into the
+ * SAVE_ALL state before going on, since it's usermode state which we
+ * eventually need to restore.
  */
 ENTRY(xen_iret_crit_fixup)
         /*
-           Paranoia: Make sure we're really coming from kernel space.
-           One could imagine a case where userspace jumps into the
-           critical range address, but just before the CPU delivers a GP,
-           it decides to deliver an interrupt instead.  Unlikely?
-           Definitely.  Easy to avoid?  Yes.  The Intel documents
-           explicitly say that the reported EIP for a bad jump is the
-           jump instruction itself, not the destination, but some virtual
-           environments get this wrong.
+         * Paranoia: Make sure we're really coming from kernel space.
+         * One could imagine a case where userspace jumps into the
+         * critical range address, but just before the CPU delivers a
+         * GP, it decides to deliver an interrupt instead.  Unlikely?
+         * Definitely.  Easy to avoid?  Yes.  The Intel documents
+         * explicitly say that the reported EIP for a bad jump is the
+         * jump instruction itself, not the destination, but some
+         * virtual environments get this wrong.
          */
         movl PT_CS(%esp), %ecx
         andl $SEGMENT_RPL_MASK, %ecx
@@ -270,15 +205,17 @@ ENTRY(xen_iret_crit_fixup)
         lea PT_ORIG_EAX(%esp), %esi
         lea PT_EFLAGS(%esp), %edi
 
-        /* If eip is before iret_restore_end then stack
-           hasn't been restored yet. */
+        /*
+         * If eip is before iret_restore_end then stack
+         * hasn't been restored yet.
+         */
         cmp $iret_restore_end, %eax
         jae 1f
 
-        movl 0+4(%edi),%eax             /* copy EAX (just above top of frame) */
+        movl 0+4(%edi), %eax            /* copy EAX (just above top of frame) */
         movl %eax, PT_EAX(%esp)
 
-        lea ESP_OFFSET(%edi),%edi       /* move dest up over saved regs */
+        lea ESP_OFFSET(%edi), %edi      /* move dest up over saved regs */
 
         /* set up the copy */
 1:      std
@@ -286,20 +223,6 @@ ENTRY(xen_iret_crit_fixup)
         rep movsl
         cld
 
-        lea 4(%edi),%esp                /* point esp to new frame */
+        lea 4(%edi), %esp               /* point esp to new frame */
 2:      jmp xen_do_upcall
 
-
-/*
-        Force an event check by making a hypercall,
-        but preserve regs before making the call.
- */
-check_events:
-        push %eax
-        push %ecx
-        push %edx
-        call xen_force_evtchn_callback
-        pop %edx
-        pop %ecx
-        pop %eax
-        ret
diff --git a/arch/x86/xen/xen-asm_64.S b/arch/x86/xen/xen-asm_64.S
index 05794c566e8..02f496a8dba 100644
--- a/arch/x86/xen/xen-asm_64.S
+++ b/arch/x86/xen/xen-asm_64.S
@@ -1,174 +1,45 @@
 /*
-        Asm versions of Xen pv-ops, suitable for either direct use or inlining.
-        The inline versions are the same as the direct-use versions, with the
-        pre- and post-amble chopped off.
-
-        This code is encoded for size rather than absolute efficiency,
-        with a view to being able to inline as much as possible.
-
-        We only bother with direct forms (ie, vcpu in pda) of the operations
-        here; the indirect forms are better handled in C, since they're
-        generally too large to inline anyway.
+ * Asm versions of Xen pv-ops, suitable for either direct use or
+ * inlining.  The inline versions are the same as the direct-use
+ * versions, with the pre- and post-amble chopped off.
+ *
+ * This code is encoded for size rather than absolute efficiency, with
+ * a view to being able to inline as much as possible.
+ *
+ * We only bother with direct forms (ie, vcpu in pda) of the
+ * operations here; the indirect forms are better handled in C, since
+ * they're generally too large to inline anyway.
  */
 
-#include <linux/linkage.h>
-
-#include <asm/asm-offsets.h>
-#include <asm/processor-flags.h>
 #include <asm/errno.h>
+#include <asm/percpu.h>
+#include <asm/processor-flags.h>
 #include <asm/segment.h>
 
 #include <xen/interface/xen.h>
 
-#define RELOC(x, v)     .globl x##_reloc; x##_reloc=v
-#define ENDPATCH(x)     .globl x##_end; x##_end=.
-
-/* Pseudo-flag used for virtual NMI, which we don't implement yet */
-#define XEN_EFLAGS_NMI  0x80000000
-
-#if 1
-/*
-        x86-64 does not yet support direct access to percpu variables
-        via a segment override, so we just need to make sure this code
-        never gets used
- */
-#define BUG                     ud2a
-#define PER_CPU_VAR(var, off)   0xdeadbeef
-#endif
-
-/*
-        Enable events.  This clears the event mask and tests the pending
-        event status with one and operation.  If there are pending
-        events, then enter the hypervisor to get them handled.
- */
-ENTRY(xen_irq_enable_direct)
-        BUG
-
-        /* Unmask events */
-        movb $0, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
-
-        /* Preempt here doesn't matter because that will deal with
-           any pending interrupts.  The pending check may end up being
-           run on the wrong CPU, but that doesn't hurt. */
-
-        /* Test for pending */
-        testb $0xff, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_pending)
-        jz 1f
-
-2:      call check_events
-1:
-ENDPATCH(xen_irq_enable_direct)
-        ret
-        ENDPROC(xen_irq_enable_direct)
-        RELOC(xen_irq_enable_direct, 2b+1)
-
-/*
-        Disabling events is simply a matter of making the event mask
-        non-zero.
- */
-ENTRY(xen_irq_disable_direct)
-        BUG
-
-        movb $1, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
-ENDPATCH(xen_irq_disable_direct)
-        ret
-        ENDPROC(xen_irq_disable_direct)
-        RELOC(xen_irq_disable_direct, 0)
-
-/*
-        (xen_)save_fl is used to get the current interrupt enable status.
-        Callers expect the status to be in X86_EFLAGS_IF, and other bits
-        may be set in the return value.  We take advantage of this by
-        making sure that X86_EFLAGS_IF has the right value (and other bits
-        in that byte are 0), but other bits in the return value are
-        undefined.  We need to toggle the state of the bit, because
-        Xen and x86 use opposite senses (mask vs enable).
- */
-ENTRY(xen_save_fl_direct)
-        BUG
-
-        testb $0xff, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
-        setz %ah
-        addb %ah,%ah
-ENDPATCH(xen_save_fl_direct)
-        ret
-        ENDPROC(xen_save_fl_direct)
-        RELOC(xen_save_fl_direct, 0)
-
-/*
-        In principle the caller should be passing us a value return
-        from xen_save_fl_direct, but for robustness sake we test only
-        the X86_EFLAGS_IF flag rather than the whole byte. After
-        setting the interrupt mask state, it checks for unmasked
-        pending events and enters the hypervisor to get them delivered
-        if so.
- */
-ENTRY(xen_restore_fl_direct)
-        BUG
-
-        testb $X86_EFLAGS_IF>>8, %ah
-        setz PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_mask)
-        /* Preempt here doesn't matter because that will deal with
-           any pending interrupts.  The pending check may end up being
-           run on the wrong CPU, but that doesn't hurt. */
-
-        /* check for unmasked and pending */
-        cmpw $0x0001, PER_CPU_VAR(xen_vcpu_info, XEN_vcpu_info_pending)
-        jz 1f
-2:      call check_events
-1:
-ENDPATCH(xen_restore_fl_direct)
-        ret
-        ENDPROC(xen_restore_fl_direct)
-        RELOC(xen_restore_fl_direct, 2b+1)
-
-
-/*
-        Force an event check by making a hypercall,
-        but preserve regs before making the call.
- */
-check_events:
-        push %rax
-        push %rcx
-        push %rdx
-        push %rsi
-        push %rdi
-        push %r8
-        push %r9
-        push %r10
-        push %r11
-        call xen_force_evtchn_callback
-        pop %r11
-        pop %r10
-        pop %r9
-        pop %r8
-        pop %rdi
-        pop %rsi
-        pop %rdx
-        pop %rcx
-        pop %rax
-        ret
+#include "xen-asm.h"
 
 ENTRY(xen_adjust_exception_frame)
-        mov 8+0(%rsp),%rcx
-        mov 8+8(%rsp),%r11
+        mov 8+0(%rsp), %rcx
+        mov 8+8(%rsp), %r11
         ret $16
 
 hypercall_iret = hypercall_page + __HYPERVISOR_iret * 32
 /*
-        Xen64 iret frame:
-
-        ss
-        rsp
-        rflags
-        cs
-        rip             <-- standard iret frame
-
-        flags
-
-        rcx             }
-        r11             }<-- pushed by hypercall page
-rsp ->  rax             }
+ * Xen64 iret frame:
+ *
+ *      ss
+ *      rsp
+ *      rflags
+ *      cs
+ *      rip             <-- standard iret frame
+ *
+ *      flags
+ *
+ *      rcx             }
+ *      r11             }<-- pushed by hypercall page
+ * rsp->rax             }
  */
 ENTRY(xen_iret)
         pushq $0
@@ -177,8 +48,8 @@ ENDPATCH(xen_iret)
 RELOC(xen_iret, 1b+1)
 
 /*
-        sysexit is not used for 64-bit processes, so it's
-        only ever used to return to 32-bit compat userspace.
+ * sysexit is not used for 64-bit processes, so it's only ever used to
+ * return to 32-bit compat userspace.
  */
 ENTRY(xen_sysexit)
         pushq $__USER32_DS
@@ -193,13 +64,15 @@ ENDPATCH(xen_sysexit)
 RELOC(xen_sysexit, 1b+1)
 
 ENTRY(xen_sysret64)
-        /* We're already on the usermode stack at this point, but still
-           with the kernel gs, so we can easily switch back */
-        movq %rsp, %gs:pda_oldrsp
-        movq %gs:pda_kernelstack,%rsp
+        /*
+         * We're already on the usermode stack at this point, but
+         * still with the kernel gs, so we can easily switch back
+         */
+        movq %rsp, PER_CPU_VAR(old_rsp)
+        movq PER_CPU_VAR(kernel_stack), %rsp
 
         pushq $__USER_DS
-        pushq %gs:pda_oldrsp
+        pushq PER_CPU_VAR(old_rsp)
         pushq %r11
         pushq $__USER_CS
         pushq %rcx
@@ -210,13 +83,15 @@ ENDPATCH(xen_sysret64)
 RELOC(xen_sysret64, 1b+1)
 
 ENTRY(xen_sysret32)
-        /* We're already on the usermode stack at this point, but still
-           with the kernel gs, so we can easily switch back */
-        movq %rsp, %gs:pda_oldrsp
-        movq %gs:pda_kernelstack, %rsp
+        /*
+         * We're already on the usermode stack at this point, but
+         * still with the kernel gs, so we can easily switch back
+         */
+        movq %rsp, PER_CPU_VAR(old_rsp)
+        movq PER_CPU_VAR(kernel_stack), %rsp
 
         pushq $__USER32_DS
-        pushq %gs:pda_oldrsp
+        pushq PER_CPU_VAR(old_rsp)
         pushq %r11
         pushq $__USER32_CS
         pushq %rcx
@@ -227,28 +102,27 @@ ENDPATCH(xen_sysret32)
 RELOC(xen_sysret32, 1b+1)
 
 /*
-        Xen handles syscall callbacks much like ordinary exceptions,
-        which means we have:
-         - kernel gs
-         - kernel rsp
-         - an iret-like stack frame on the stack (including rcx and r11):
-                ss
-                rsp
-                rflags
-                cs
-                rip
-                r11
-        rsp->   rcx
-
-        In all the entrypoints, we undo all that to make it look
-        like a CPU-generated syscall/sysenter and jump to the normal
-        entrypoint.
+ * Xen handles syscall callbacks much like ordinary exceptions, which
+ * means we have:
+ * - kernel gs
+ * - kernel rsp
+ * - an iret-like stack frame on the stack (including rcx and r11):
+ *      ss
+ *      rsp
+ *      rflags
+ *      cs
+ *      rip
+ *      r11
+ * rsp->rcx
+ *
+ * In all the entrypoints, we undo all that to make it look like a
+ * CPU-generated syscall/sysenter and jump to the normal entrypoint.
  */
 
 .macro undo_xen_syscall
-        mov 0*8(%rsp),%rcx
-        mov 1*8(%rsp),%r11
-        mov 5*8(%rsp),%rsp
+        mov 0*8(%rsp), %rcx
+        mov 1*8(%rsp), %r11
+        mov 5*8(%rsp), %rsp
 .endm
 
 /* Normal 64-bit system call target */
@@ -275,7 +149,7 @@ ENDPROC(xen_sysenter_target)
 
 ENTRY(xen_syscall32_target)
 ENTRY(xen_sysenter_target)
-        lea 16(%rsp), %rsp      /* strip %rcx,%r11 */
+        lea 16(%rsp), %rsp      /* strip %rcx, %r11 */
         mov $-ENOSYS, %rax
         pushq $VGCF_in_syscall
         jmp hypercall_iret
diff --git a/arch/x86/xen/xen-ops.h b/arch/x86/xen/xen-ops.h
index c1f8faf0a2c..2f5ef2632ea 100644
--- a/arch/x86/xen/xen-ops.h
+++ b/arch/x86/xen/xen-ops.h
@@ -10,9 +10,12 @@
 extern const char xen_hypervisor_callback[];
 extern const char xen_failsafe_callback[];
 
+extern void *xen_initial_gdt;
+
 struct trap_info;
 void xen_copy_trap_info(struct trap_info *traps);
 
+DECLARE_PER_CPU(struct vcpu_info, xen_vcpu_info);
 DECLARE_PER_CPU(unsigned long, xen_cr3);
 DECLARE_PER_CPU(unsigned long, xen_current_cr3);
 
@@ -22,6 +25,13 @@ extern struct shared_info *HYPERVISOR_shared_info;
 
 void xen_setup_mfn_list_list(void);
 void xen_setup_shared_info(void);
+void xen_setup_machphys_mapping(void);
+pgd_t *xen_setup_kernel_pagetable(pgd_t *pgd, unsigned long max_pfn);
+void xen_ident_map_ISA(void);
+void xen_reserve_top(void);
+
+void xen_leave_lazy(void);
+void xen_post_allocator_init(void);
 
 char * __init xen_memory_setup(void);
 void __init xen_arch_setup(void);
diff --git a/block/blk-barrier.c b/block/blk-barrier.c
index 8eba4e43bb0..f7dae57e6ca 100644
--- a/block/blk-barrier.c
+++ b/block/blk-barrier.c
@@ -302,7 +302,7 @@ static void bio_end_empty_barrier(struct bio *bio, int err)
  * Description:
  *    Issue a flush for the block device in question. Caller can supply
  *    room for storing the error offset in case of a flush error, if they
- *    wish to.  Caller must run wait_for_completion() on its own.
+ *    wish to.
  */
 int blkdev_issue_flush(struct block_device *bdev, sector_t *error_sector)
 {
diff --git a/block/blk-core.c b/block/blk-core.c
index a824e49c0d0..29bcfac6c68 100644
--- a/block/blk-core.c
+++ b/block/blk-core.c
@@ -64,11 +64,12 @@ static struct workqueue_struct *kblockd_workqueue;
 
 static void drive_stat_acct(struct request *rq, int new_io)
 {
+        struct gendisk *disk = rq->rq_disk;
         struct hd_struct *part;
         int rw = rq_data_dir(rq);
         int cpu;
 
-        if (!blk_fs_request(rq) || !rq->rq_disk)
+        if (!blk_fs_request(rq) || !disk || !blk_do_io_stat(disk->queue))
                 return;
 
         cpu = part_stat_lock();
@@ -599,8 +600,7 @@ blk_init_queue_node(request_fn_proc *rfn, spinlock_t *lock, int node_id)
         q->request_fn           = rfn;
         q->prep_rq_fn           = NULL;
         q->unplug_fn            = generic_unplug_device;
-        q->queue_flags          = (1 << QUEUE_FLAG_CLUSTER |
-                                   1 << QUEUE_FLAG_STACKABLE);
+        q->queue_flags          = QUEUE_FLAG_DEFAULT;
         q->queue_lock           = lock;
 
         blk_queue_segment_boundary(q, BLK_SEG_BOUNDARY_MASK);
@@ -1125,6 +1125,8 @@ void init_request_from_bio(struct request *req, struct bio *bio)
 
         if (bio_sync(bio))
                 req->cmd_flags |= REQ_RW_SYNC;
+        if (bio_unplug(bio))
+                req->cmd_flags |= REQ_UNPLUG;
         if (bio_rw_meta(bio))
                 req->cmd_flags |= REQ_RW_META;
 
@@ -1141,6 +1143,7 @@ static int __make_request(struct request_queue *q, struct bio *bio)
         int el_ret, nr_sectors;
         const unsigned short prio = bio_prio(bio);
         const int sync = bio_sync(bio);
+        const int unplug = bio_unplug(bio);
         int rw_flags;
 
         nr_sectors = bio_sectors(bio);
@@ -1244,7 +1247,7 @@ get_rq:
                 blk_plug_device(q);
         add_request(q, req);
 out:
-        if (sync || blk_queue_nonrot(q))
+        if (unplug || blk_queue_nonrot(q))
                 __generic_unplug_device(q);
         spin_unlock_irq(q->queue_lock);
         return 0;
@@ -1448,6 +1451,11 @@ static inline void __generic_make_request(struct bio *bio)
                         err = -EOPNOTSUPP;
                         goto end_io;
                 }
+                if (bio_barrier(bio) && bio_has_data(bio) &&
+                    (q->next_ordered == QUEUE_ORDERED_NONE)) {
+                        err = -EOPNOTSUPP;
+                        goto end_io;
+                }
 
                 ret = q->make_request_fn(q, bio);
         } while (ret);
@@ -1655,6 +1663,55 @@ void blkdev_dequeue_request(struct request *req)
 }
 EXPORT_SYMBOL(blkdev_dequeue_request);
 
+static void blk_account_io_completion(struct request *req, unsigned int bytes)
+{
+        struct gendisk *disk = req->rq_disk;
+
+        if (!disk || !blk_do_io_stat(disk->queue))
+                return;
+
+        if (blk_fs_request(req)) {
+                const int rw = rq_data_dir(req);
+                struct hd_struct *part;
+                int cpu;
+
+                cpu = part_stat_lock();
+                part = disk_map_sector_rcu(req->rq_disk, req->sector);
+                part_stat_add(cpu, part, sectors[rw], bytes >> 9);
+                part_stat_unlock();
+        }
+}
+
+static void blk_account_io_done(struct request *req)
+{
+        struct gendisk *disk = req->rq_disk;
+
+        if (!disk || !blk_do_io_stat(disk->queue))
+                return;
+
+        /*
+         * Account IO completion.  bar_rq isn't accounted as a normal
+         * IO on queueing nor completion.  Accounting the containing
+         * request is enough.
+         */
+        if (blk_fs_request(req) && req != &req->q->bar_rq) {
+                unsigned long duration = jiffies - req->start_time;
+                const int rw = rq_data_dir(req);
+                struct hd_struct *part;
+                int cpu;
+
+                cpu = part_stat_lock();
+                part = disk_map_sector_rcu(disk, req->sector);
+
+                part_stat_inc(cpu, part, ios[rw]);
+                part_stat_add(cpu, part, ticks[rw], duration);
+                part_round_stats(cpu, part);
+                part_dec_in_flight(part);
+
+                part_stat_unlock();
+        }
+}
+
 /**
  * __end_that_request_first - end I/O on a request
  * @req:      the request being processed
@@ -1690,16 +1747,7 @@ static int __end_that_request_first(struct request *req, int error,
                                 (unsigned long long)req->sector);
         }
 
-        if (blk_fs_request(req) && req->rq_disk) {
-                const int rw = rq_data_dir(req);
-                struct hd_struct *part;
-                int cpu;
-
-                cpu = part_stat_lock();
-                part = disk_map_sector_rcu(req->rq_disk, req->sector);
-                part_stat_add(cpu, part, sectors[rw], nr_bytes >> 9);
-                part_stat_unlock();
-        }
+        blk_account_io_completion(req, nr_bytes);
 
         total_bytes = bio_nbytes = 0;
         while ((bio = req->bio) != NULL) {
@@ -1779,8 +1827,6 @@ static int __end_that_request_first(struct request *req, int error,
  */
 static void end_that_request_last(struct request *req, int error)
 {
-        struct gendisk *disk = req->rq_disk;
-
         if (blk_rq_tagged(req))
                 blk_queue_end_tag(req->q, req);
 
@@ -1792,27 +1838,7 @@ static void end_that_request_last(struct request *req, int error)
 
         blk_delete_timer(req);
 
-        /*
-         * Account IO completion.  bar_rq isn't accounted as a normal
-         * IO on queueing nor completion.  Accounting the containing
-         * request is enough.
-         */
-        if (disk && blk_fs_request(req) && req != &req->q->bar_rq) {
-                unsigned long duration = jiffies - req->start_time;
-                const int rw = rq_data_dir(req);
-                struct hd_struct *part;
-                int cpu;
-
-                cpu = part_stat_lock();
-                part = disk_map_sector_rcu(disk, req->sector);
-
-                part_stat_inc(cpu, part, ios[rw]);
-                part_stat_add(cpu, part, ticks[rw], duration);
-                part_round_stats(cpu, part);
-                part_dec_in_flight(part);
-
-                part_stat_unlock();
-        }
+        blk_account_io_done(req);
 
         if (req->end_io)
                 req->end_io(req, error);
diff --git a/block/blk-integrity.c b/block/blk-integrity.c
index 61a8e2f8fdd..91fa8e06b6a 100644
--- a/block/blk-integrity.c
+++ b/block/blk-integrity.c
@@ -309,24 +309,24 @@ static struct kobj_type integrity_ktype = {
 /**
  * blk_integrity_register - Register a gendisk as being integrity-capable
  * @disk:       struct gendisk pointer to make integrity-aware
- * @template:   integrity profile
+ * @template:   optional integrity profile to register
  *
  * Description: When a device needs to advertise itself as being able
  * to send/receive integrity metadata it must use this function to
  * register the capability with the block layer.  The template is a
  * blk_integrity struct with values appropriate for the underlying
- * hardware.  See Documentation/block/data-integrity.txt.
+ * hardware.  If template is NULL the new profile is allocated but
+ * not filled out. See Documentation/block/data-integrity.txt.
  */
 int blk_integrity_register(struct gendisk *disk, struct blk_integrity *template)
 {
         struct blk_integrity *bi;
 
         BUG_ON(disk == NULL);
-        BUG_ON(template == NULL);
 
         if (disk->integrity == NULL) {
                 bi = kmem_cache_alloc(integrity_cachep,
-                                                GFP_KERNEL | __GFP_ZERO);
+                                      GFP_KERNEL | __GFP_ZERO);
                 if (!bi)
                         return -1;
 
@@ -346,13 +346,16 @@ int blk_integrity_register(struct gendisk *disk, struct blk_integrity *template)
                 bi = disk->integrity;
 
         /* Use the provided profile as template */
-        bi->name = template->name;
-        bi->generate_fn = template->generate_fn;
-        bi->verify_fn = template->verify_fn;
-        bi->tuple_size = template->tuple_size;
-        bi->set_tag_fn = template->set_tag_fn;
-        bi->get_tag_fn = template->get_tag_fn;
-        bi->tag_size = template->tag_size;
+        if (template != NULL) {
+                bi->name = template->name;
+                bi->generate_fn = template->generate_fn;
+                bi->verify_fn = template->verify_fn;
+                bi->tuple_size = template->tuple_size;
+                bi->set_tag_fn = template->set_tag_fn;
+                bi->get_tag_fn = template->get_tag_fn;
+                bi->tag_size = template->tag_size;
+        } else
+                bi->name = "unsupported";
 
         return 0;
 }
diff --git a/block/blk-sysfs.c b/block/blk-sysfs.c
index a29cb788e40..e29ddfc73cf 100644
--- a/block/blk-sysfs.c
+++ b/block/blk-sysfs.c
@@ -130,6 +130,27 @@ static ssize_t queue_max_hw_sectors_show(struct request_queue *q, char *page)
         return queue_var_show(max_hw_sectors_kb, (page));
 }
 
+static ssize_t queue_nonrot_show(struct request_queue *q, char *page)
+{
+        return queue_var_show(!blk_queue_nonrot(q), page);
+}
+
+static ssize_t queue_nonrot_store(struct request_queue *q, const char *page,
+                                  size_t count)
+{
+        unsigned long nm;
+        ssize_t ret = queue_var_store(&nm, page, count);
+
+        spin_lock_irq(q->queue_lock);
+        if (nm)
+                queue_flag_clear(QUEUE_FLAG_NONROT, q);
+        else
+                queue_flag_set(QUEUE_FLAG_NONROT, q);
+        spin_unlock_irq(q->queue_lock);
+
+        return ret;
+}
+
 static ssize_t queue_nomerges_show(struct request_queue *q, char *page)
 {
         return queue_var_show(blk_queue_nomerges(q), page);
@@ -146,8 +167,8 @@ static ssize_t queue_nomerges_store(struct request_queue *q, const char *page,
                 queue_flag_set(QUEUE_FLAG_NOMERGES, q);
         else
                 queue_flag_clear(QUEUE_FLAG_NOMERGES, q);
-
         spin_unlock_irq(q->queue_lock);
+
         return ret;
 }
 
@@ -176,6 +197,27 @@ queue_rq_affinity_store(struct request_queue *q, const char *page, size_t count)
         return ret;
 }
 
+static ssize_t queue_iostats_show(struct request_queue *q, char *page)
+{
+        return queue_var_show(blk_queue_io_stat(q), page);
+}
+
+static ssize_t queue_iostats_store(struct request_queue *q, const char *page,
+                                   size_t count)
+{
+        unsigned long stats;
+        ssize_t ret = queue_var_store(&stats, page, count);
+
+        spin_lock_irq(q->queue_lock);
+        if (stats)
+                queue_flag_set(QUEUE_FLAG_IO_STAT, q);
+        else
+                queue_flag_clear(QUEUE_FLAG_IO_STAT, q);
+        spin_unlock_irq(q->queue_lock);
+
+        return ret;
+}
+
 static struct queue_sysfs_entry queue_requests_entry = {
         .attr = {.name = "nr_requests", .mode = S_IRUGO | S_IWUSR },
         .show = queue_requests_show,
@@ -210,6 +252,12 @@ static struct queue_sysfs_entry queue_hw_sector_size_entry = {
         .show = queue_hw_sector_size_show,
 };
 
+static struct queue_sysfs_entry queue_nonrot_entry = {
+        .attr = {.name = "rotational", .mode = S_IRUGO | S_IWUSR },
+        .show = queue_nonrot_show,
+        .store = queue_nonrot_store,
+};
+
 static struct queue_sysfs_entry queue_nomerges_entry = {
         .attr = {.name = "nomerges", .mode = S_IRUGO | S_IWUSR },
         .show = queue_nomerges_show,
@@ -222,6 +270,12 @@ static struct queue_sysfs_entry queue_rq_affinity_entry = {
         .store = queue_rq_affinity_store,
 };
 
+static struct queue_sysfs_entry queue_iostats_entry = {
+        .attr = {.name = "iostats", .mode = S_IRUGO | S_IWUSR },
+        .show = queue_iostats_show,
+        .store = queue_iostats_store,
+};
+
 static struct attribute *default_attrs[] = {
         &queue_requests_entry.attr,
         &queue_ra_entry.attr,
@@ -229,8 +283,10 @@ static struct attribute *default_attrs[] = {
         &queue_max_sectors_entry.attr,
         &queue_iosched_entry.attr,
         &queue_hw_sector_size_entry.attr,
+        &queue_nonrot_entry.attr,
         &queue_nomerges_entry.attr,
         &queue_rq_affinity_entry.attr,
+        &queue_iostats_entry.attr,
         NULL,
 };
 
diff --git a/block/blk.h b/block/blk.h
index 6e1ed40534e..0dce92c3749 100644
--- a/block/blk.h
+++ b/block/blk.h
@@ -108,4 +108,12 @@ static inline int blk_cpu_to_group(int cpu)
 #endif
 }
 
+static inline int blk_do_io_stat(struct request_queue *q)
+{
+        if (q)
+                return blk_queue_io_stat(q);
+
+        return 0;
+}
+
 #endif
diff --git a/block/blktrace.c b/block/blktrace.c
index b0a2cae886d..39cc3bfe56e 100644
--- a/block/blktrace.c
+++ b/block/blktrace.c
@@ -187,59 +187,12 @@ static void __blk_add_trace(struct blk_trace *bt, sector_t sector, int bytes,
 
 static struct dentry *blk_tree_root;
 static DEFINE_MUTEX(blk_tree_mutex);
-static unsigned int root_users;
-
-static inline void blk_remove_root(void)
-{
-        if (blk_tree_root) {
-                debugfs_remove(blk_tree_root);
-                blk_tree_root = NULL;
-        }
-}
-
-static void blk_remove_tree(struct dentry *dir)
-{
-        mutex_lock(&blk_tree_mutex);
-        debugfs_remove(dir);
-        if (--root_users == 0)
-                blk_remove_root();
-        mutex_unlock(&blk_tree_mutex);
-}
-
-static struct dentry *blk_create_tree(const char *blk_name)
-{
-        struct dentry *dir = NULL;
-        int created = 0;
-
-        mutex_lock(&blk_tree_mutex);
-
-        if (!blk_tree_root) {
-                blk_tree_root = debugfs_create_dir("block", NULL);
-                if (!blk_tree_root)
-                        goto err;
-                created = 1;
-        }
-
-        dir = debugfs_create_dir(blk_name, blk_tree_root);
-        if (dir)
-                root_users++;
-        else {
-                /* Delete root only if we created it */
-                if (created)
-                        blk_remove_root();
-        }
-
-err:
-        mutex_unlock(&blk_tree_mutex);
-        return dir;
-}
 
 static void blk_trace_cleanup(struct blk_trace *bt)
 {
-        relay_close(bt->rchan);
         debugfs_remove(bt->msg_file);
         debugfs_remove(bt->dropped_file);
-        blk_remove_tree(bt->dir);
+        relay_close(bt->rchan);
         free_percpu(bt->sequence);
         free_percpu(bt->msg_data);
         kfree(bt);
@@ -346,7 +299,18 @@ static int blk_subbuf_start_callback(struct rchan_buf *buf, void *subbuf,
 
 static int blk_remove_buf_file_callback(struct dentry *dentry)
 {
+        struct dentry *parent = dentry->d_parent;
         debugfs_remove(dentry);
+
+        /*
+        * this will fail for all but the last file, but that is ok. what we
+        * care about is the top level buts->name directory going away, when
+        * the last trace file is gone. Then we don't have to rmdir() that
+        * manually on trace stop, so it nicely solves the issue with
+        * force killing of running traces.
+        */
+
+        debugfs_remove(parent);
         return 0;
 }
 
@@ -404,7 +368,15 @@ int do_blk_trace_setup(struct request_queue *q, char *name, dev_t dev,
                 goto err;
 
         ret = -ENOENT;
-        dir = blk_create_tree(buts->name);
+
+        if (!blk_tree_root) {
+                blk_tree_root = debugfs_create_dir("block", NULL);
+                if (!blk_tree_root)
+                        return -ENOMEM;
+        }
+
+        dir = debugfs_create_dir(buts->name, blk_tree_root);
+
         if (!dir)
                 goto err;
 
@@ -458,8 +430,6 @@ probe_err:
         atomic_dec(&blk_probes_ref);
         mutex_unlock(&blk_probe_mutex);
 err:
-        if (dir)
-                blk_remove_tree(dir);
         if (bt) {
                 if (bt->msg_file)
                         debugfs_remove(bt->msg_file);
diff --git a/block/cfq-iosched.c b/block/cfq-iosched.c
index e8525fa7282..664ebfd092e 100644
--- a/block/cfq-iosched.c
+++ b/block/cfq-iosched.c
@@ -84,6 +84,11 @@ struct cfq_data {
          */
         struct cfq_rb_root service_tree;
         unsigned int busy_queues;
+        /*
+         * Used to track any pending rt requests so we can pre-empt current
+         * non-RT cfqq in service when this value is non-zero.
+         */
+        unsigned int busy_rt_queues;
 
         int rq_in_driver;
         int sync_flight;
@@ -562,6 +567,8 @@ static void cfq_add_cfqq_rr(struct cfq_data *cfqd, struct cfq_queue *cfqq)
         BUG_ON(cfq_cfqq_on_rr(cfqq));
         cfq_mark_cfqq_on_rr(cfqq);
         cfqd->busy_queues++;
+        if (cfq_class_rt(cfqq))
+                cfqd->busy_rt_queues++;
 
         cfq_resort_rr_list(cfqd, cfqq);
 }
@@ -581,6 +588,8 @@ static void cfq_del_cfqq_rr(struct cfq_data *cfqd, struct cfq_queue *cfqq)
 
         BUG_ON(!cfqd->busy_queues);
         cfqd->busy_queues--;
+        if (cfq_class_rt(cfqq))
+                cfqd->busy_rt_queues--;
 }
 
 /*
@@ -1005,6 +1014,20 @@ static struct cfq_queue *cfq_select_queue(struct cfq_data *cfqd)
                 goto expire;
 
         /*
+         * If we have a RT cfqq waiting, then we pre-empt the current non-rt
+         * cfqq.
+         */
+        if (!cfq_class_rt(cfqq) && cfqd->busy_rt_queues) {
+                /*
+                 * We simulate this as cfqq timed out so that it gets to bank
+                 * the remaining of its time slice.
+                 */
+                cfq_log_cfqq(cfqd, cfqq, "preempt");
+                cfq_slice_expired(cfqd, 1);
+                goto new_queue;
+        }
+
+        /*
          * The active queue has requests and isn't expired, allow it to
          * dispatch.
          */
@@ -1067,6 +1090,13 @@ __cfq_dispatch_requests(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                 if (RB_EMPTY_ROOT(&cfqq->sort_list))
                         break;
 
+                /*
+                 * If there is a non-empty RT cfqq waiting for current
+                 * cfqq's timeslice to complete, pre-empt this cfqq
+                 */
+                if (!cfq_class_rt(cfqq) && cfqd->busy_rt_queues)
+                        break;
+
         } while (dispatched < max_dispatch);
 
         /*
@@ -1801,6 +1831,12 @@ cfq_should_preempt(struct cfq_data *cfqd, struct cfq_queue *new_cfqq,
         if (rq_is_meta(rq) && !cfqq->meta_pending)
                 return 1;
 
+        /*
+         * Allow an RT request to pre-empt an ongoing non-RT cfqq timeslice.
+         */
+        if (cfq_class_rt(new_cfqq) && !cfq_class_rt(cfqq))
+                return 1;
+
         if (!cfqd->active_cic || !cfq_cfqq_wait_request(cfqq))
                 return 0;
 
@@ -1870,7 +1906,8 @@ cfq_rq_enqueued(struct cfq_data *cfqd, struct cfq_queue *cfqq,
                 /*
                  * not the active queue - expire current slice if it is
                  * idle and has expired it's mean thinktime or this new queue
-                 * has some old slice time left and is of higher priority
+                 * has some old slice time left and is of higher priority or
+                 * this new queue is RT and the current one is BE
                  */
                 cfq_preempt_queue(cfqd, cfqq);
                 cfq_mark_cfqq_must_dispatch(cfqq);
diff --git a/crypto/algapi.c b/crypto/algapi.c
index 7c41e7405c4..56c62e2858d 100644
--- a/crypto/algapi.c
+++ b/crypto/algapi.c
@@ -149,6 +149,9 @@ static struct crypto_larval *__crypto_register_alg(struct crypto_alg *alg)
                 if (q == alg)
                         goto err;
 
+                if (crypto_is_moribund(q))
+                        continue;
+
                 if (crypto_is_larval(q)) {
                         if (!strcmp(alg->cra_driver_name, q->cra_driver_name))
                                 goto err;
@@ -197,7 +200,7 @@ void crypto_alg_tested(const char *name, int err)
 
         down_write(&crypto_alg_sem);
         list_for_each_entry(q, &crypto_alg_list, cra_list) {
-                if (!crypto_is_larval(q))
+                if (crypto_is_moribund(q) || !crypto_is_larval(q))
                         continue;
 
                 test = (struct crypto_larval *)q;
@@ -210,6 +213,7 @@ void crypto_alg_tested(const char *name, int err)
         goto unlock;
 
 found:
+        q->cra_flags |= CRYPTO_ALG_DEAD;
         alg = test->adult;
         if (err || list_empty(&alg->cra_list))
                 goto complete;
diff --git a/crypto/api.c b/crypto/api.c
index 9975a7bd246..efe77df6863 100644
--- a/crypto/api.c
+++ b/crypto/api.c
@@ -557,34 +557,34 @@ err:
         return ERR_PTR(err);
 }
 EXPORT_SYMBOL_GPL(crypto_alloc_tfm);
- 
+
 /*
- *      crypto_free_tfm - Free crypto transform
+ *      crypto_destroy_tfm - Free crypto transform
+ *      @mem: Start of tfm slab
  *      @tfm: Transform to free
  *
- *      crypto_free_tfm() frees up the transform and any associated resources,
+ *      This function frees up the transform and any associated resources,
  *      then drops the refcount on the associated algorithm.
  */
-void crypto_free_tfm(struct crypto_tfm *tfm)
+void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm)
 {
         struct crypto_alg *alg;
         int size;
 
-        if (unlikely(!tfm))
+        if (unlikely(!mem))
                 return;
 
         alg = tfm->__crt_alg;
-        size = sizeof(*tfm) + alg->cra_ctxsize;
+        size = ksize(mem);
 
         if (!tfm->exit && alg->cra_exit)
                 alg->cra_exit(tfm);
         crypto_exit_ops(tfm);
         crypto_mod_put(alg);
-        memset(tfm, 0, size);
-        kfree(tfm);
+        memset(mem, 0, size);
+        kfree(mem);
 }
-
-EXPORT_SYMBOL_GPL(crypto_free_tfm);
+EXPORT_SYMBOL_GPL(crypto_destroy_tfm);
 
 int crypto_has_alg(const char *name, u32 type, u32 mask)
 {
diff --git a/crypto/scatterwalk.c b/crypto/scatterwalk.c
index 9aeeb52004a..3de89a42440 100644
--- a/crypto/scatterwalk.c
+++ b/crypto/scatterwalk.c
@@ -54,7 +54,8 @@ static void scatterwalk_pagedone(struct scatter_walk *walk, int out,
                 struct page *page;
 
                 page = sg_page(walk->sg) + ((walk->offset - 1) >> PAGE_SHIFT);
-                flush_dcache_page(page);
+                if (!PageSlab(page))
+                        flush_dcache_page(page);
         }
 
         if (more) {
diff --git a/crypto/shash.c b/crypto/shash.c
index c9df367332f..d5a2b619c55 100644
--- a/crypto/shash.c
+++ b/crypto/shash.c
@@ -388,10 +388,15 @@ static int crypto_init_shash_ops_compat(struct crypto_tfm *tfm)
         struct shash_desc *desc = crypto_tfm_ctx(tfm);
         struct crypto_shash *shash;
 
+        if (!crypto_mod_get(calg))
+                return -EAGAIN;
+
         shash = __crypto_shash_cast(crypto_create_tfm(
                 calg, &crypto_shash_type));
-        if (IS_ERR(shash))
+        if (IS_ERR(shash)) {
+                crypto_mod_put(calg);
                 return PTR_ERR(shash);
+        }
 
         desc->tfm = shash;
         tfm->exit = crypto_exit_shash_ops_compat;
diff --git a/drivers/acpi/Kconfig b/drivers/acpi/Kconfig
index d7f9839ba26..a7799a99f2d 100644
--- a/drivers/acpi/Kconfig
+++ b/drivers/acpi/Kconfig
@@ -9,6 +9,7 @@ menuconfig ACPI
         depends on PCI
         depends on PM
         select PNP
+        select CPU_IDLE
         default y
         ---help---
           Advanced Configuration and Power Interface (ACPI) support for 
@@ -287,7 +288,7 @@ config ACPI_CONTAINER
           support physical cpu/memory hot-plug.
 
           If one selects "m", this driver can be loaded with
-          "modprobe acpi_container".
+          "modprobe container".
 
 config ACPI_HOTPLUG_MEMORY
         tristate "Memory Hotplug"
diff --git a/drivers/acpi/acpica/tbutils.c b/drivers/acpi/acpica/tbutils.c
index 9684cc82793..22ce4898572 100644
--- a/drivers/acpi/acpica/tbutils.c
+++ b/drivers/acpi/acpica/tbutils.c
@@ -538,10 +538,9 @@ acpi_tb_parse_root_table(acpi_physical_address rsdp_address, u8 flags)
                         if (ACPI_FAILURE(status)) {
                                 ACPI_WARNING((AE_INFO,
                                               "Truncating %u table entries!",
-                                              (unsigned)
-                                              (acpi_gbl_root_table_list.size -
-                                               acpi_gbl_root_table_list.
-                                               count)));
+                                              (unsigned) (table_count -
+                                               (acpi_gbl_root_table_list.
+                                               count - 2))));
                                 break;
                         }
                 }
diff --git a/drivers/acpi/acpica/tbxface.c b/drivers/acpi/acpica/tbxface.c
index c3e841f3cde..ab0aff3c7d6 100644
--- a/drivers/acpi/acpica/tbxface.c
+++ b/drivers/acpi/acpica/tbxface.c
@@ -365,7 +365,7 @@ ACPI_EXPORT_SYMBOL(acpi_unload_table_id)
 
 /*******************************************************************************
  *
- * FUNCTION:    acpi_get_table
+ * FUNCTION:    acpi_get_table_with_size
  *
  * PARAMETERS:  Signature           - ACPI signature of needed table
  *              Instance            - Which instance (for SSDTs)
@@ -377,8 +377,9 @@ ACPI_EXPORT_SYMBOL(acpi_unload_table_id)
  *
  *****************************************************************************/
 acpi_status
-acpi_get_table(char *signature,
-               u32 instance, struct acpi_table_header **out_table)
+acpi_get_table_with_size(char *signature,
+               u32 instance, struct acpi_table_header **out_table,
+               acpi_size *tbl_size)
 {
        u32 i;
        u32 j;
@@ -408,6 +409,7 @@ acpi_get_table(char *signature,
                     acpi_tb_verify_table(&acpi_gbl_root_table_list.tables[i]);
                 if (ACPI_SUCCESS(status)) {
                         *out_table = acpi_gbl_root_table_list.tables[i].pointer;
+                        *tbl_size = acpi_gbl_root_table_list.tables[i].length;
                 }
 
                 if (!acpi_gbl_permanent_mmap) {
@@ -420,6 +422,15 @@ acpi_get_table(char *signature,
         return (AE_NOT_FOUND);
 }
 
+acpi_status
+acpi_get_table(char *signature,
+               u32 instance, struct acpi_table_header **out_table)
+{
+        acpi_size tbl_size;
+
+        return acpi_get_table_with_size(signature,
+                       instance, out_table, &tbl_size);
+}
 ACPI_EXPORT_SYMBOL(acpi_get_table)
 
 /*******************************************************************************
diff --git a/drivers/acpi/acpica/uteval.c b/drivers/acpi/acpica/uteval.c
index da9450bc60f..9c9897dbe90 100644
--- a/drivers/acpi/acpica/uteval.c
+++ b/drivers/acpi/acpica/uteval.c
@@ -116,9 +116,9 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
                 return_ACPI_STATUS(AE_NO_MEMORY);
         }
 
-        /* Default return value is SUPPORTED */
+        /* Default return value is 0, NOT-SUPPORTED */
 
-        return_desc->integer.value = ACPI_UINT32_MAX;
+        return_desc->integer.value = 0;
         walk_state->return_desc = return_desc;
 
         /* Compare input string to static table of supported interfaces */
@@ -127,10 +127,8 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
                 if (!ACPI_STRCMP
                     (string_desc->string.pointer,
                      acpi_interfaces_supported[i])) {
-
-                        /* The interface is supported */
-
-                        return_ACPI_STATUS(AE_OK);
+                        return_desc->integer.value = ACPI_UINT32_MAX;
+                        goto done;
                 }
         }
 
@@ -141,15 +139,14 @@ acpi_status acpi_ut_osi_implementation(struct acpi_walk_state *walk_state)
          */
         status = acpi_os_validate_interface(string_desc->string.pointer);
         if (ACPI_SUCCESS(status)) {
-
-                /* The interface is supported */
-
-                return_ACPI_STATUS(AE_OK);
+                return_desc->integer.value = ACPI_UINT32_MAX;
         }
 
-        /* The interface is not supported */
+done:
+        ACPI_DEBUG_PRINT_RAW((ACPI_DB_INFO, "ACPI: BIOS _OSI(%s) %ssupported\n",
+                string_desc->string.pointer,
+                return_desc->integer.value == 0 ? "not-" : ""));
 
-        return_desc->integer.value = 0;
         return_ACPI_STATUS(AE_OK);
 }
 
diff --git a/drivers/acpi/container.c b/drivers/acpi/container.c
index 17020c12623..fe0cdf83641 100644
--- a/drivers/acpi/container.c
+++ b/drivers/acpi/container.c
@@ -163,7 +163,7 @@ static void container_notify_cb(acpi_handle handle, u32 type, void *context)
         case ACPI_NOTIFY_BUS_CHECK:
                 /* Fall through */
         case ACPI_NOTIFY_DEVICE_CHECK:
-                printk("Container driver received %s event\n",
+                printk(KERN_WARNING "Container driver received %s event\n",
                        (type == ACPI_NOTIFY_BUS_CHECK) ?
                        "ACPI_NOTIFY_BUS_CHECK" : "ACPI_NOTIFY_DEVICE_CHECK");
                 status = acpi_bus_get_device(handle, &device);
@@ -174,7 +174,8 @@ static void container_notify_cb(acpi_handle handle, u32 type, void *context)
                                         kobject_uevent(&device->dev.kobj,
                                                        KOBJ_ONLINE);
                                 else
-                                        printk("Failed to add container\n");
+                                        printk(KERN_WARNING
+                                               "Failed to add container\n");
                         }
                 } else {
                         if (ACPI_SUCCESS(status)) {
diff --git a/drivers/acpi/dock.c b/drivers/acpi/dock.c
index 5b30b8d91d7..35094f230b1 100644
--- a/drivers/acpi/dock.c
+++ b/drivers/acpi/dock.c
@@ -855,10 +855,14 @@ fdd_out:
 static ssize_t show_docked(struct device *dev,
                            struct device_attribute *attr, char *buf)
 {
+        struct acpi_device *tmp;
+
         struct dock_station *dock_station = *((struct dock_station **)
                 dev->platform_data);
-        return snprintf(buf, PAGE_SIZE, "%d\n", dock_present(dock_station));
 
+        if (ACPI_SUCCESS(acpi_bus_get_device(dock_station->handle, &tmp)))
+                return snprintf(buf, PAGE_SIZE, "1\n");
+        return snprintf(buf, PAGE_SIZE, "0\n");
 }
 static DEVICE_ATTR(docked, S_IRUGO, show_docked, NULL);
 
@@ -984,7 +988,7 @@ static int dock_add(acpi_handle handle)
 
         ret = device_create_file(&dock_device->dev, &dev_attr_docked);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 platform_device_unregister(dock_device);
                 kfree(dock_station);
                 dock_station = NULL;
@@ -992,7 +996,7 @@ static int dock_add(acpi_handle handle)
         }
         ret = device_create_file(&dock_device->dev, &dev_attr_undock);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 device_remove_file(&dock_device->dev, &dev_attr_docked);
                 platform_device_unregister(dock_device);
                 kfree(dock_station);
@@ -1001,7 +1005,7 @@ static int dock_add(acpi_handle handle)
         }
         ret = device_create_file(&dock_device->dev, &dev_attr_uid);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 device_remove_file(&dock_device->dev, &dev_attr_docked);
                 device_remove_file(&dock_device->dev, &dev_attr_undock);
                 platform_device_unregister(dock_device);
@@ -1011,7 +1015,7 @@ static int dock_add(acpi_handle handle)
         }
         ret = device_create_file(&dock_device->dev, &dev_attr_flags);
         if (ret) {
-                printk("Error %d adding sysfs file\n", ret);
+                printk(KERN_ERR "Error %d adding sysfs file\n", ret);
                 device_remove_file(&dock_device->dev, &dev_attr_docked);
                 device_remove_file(&dock_device->dev, &dev_attr_undock);
                 device_remove_file(&dock_device->dev, &dev_attr_uid);
diff --git a/drivers/acpi/ec.c b/drivers/acpi/ec.c
index a2b82c90a68..5c2f5d343be 100644
--- a/drivers/acpi/ec.c
+++ b/drivers/acpi/ec.c
@@ -982,7 +982,7 @@ int __init acpi_ec_ecdt_probe(void)
                 saved_ec = kmalloc(sizeof(struct acpi_ec), GFP_KERNEL);
                 if (!saved_ec)
                         return -ENOMEM;
-                memcpy(&saved_ec, boot_ec, sizeof(saved_ec));
+                memcpy(saved_ec, boot_ec, sizeof(*saved_ec));
         /* fall through */
         }
         /* This workaround is needed only on some broken machines,
diff --git a/drivers/acpi/glue.c b/drivers/acpi/glue.c
index adec3d15810..5479b9f4251 100644
--- a/drivers/acpi/glue.c
+++ b/drivers/acpi/glue.c
@@ -255,12 +255,12 @@ static int acpi_platform_notify(struct device *dev)
         }
         type = acpi_get_bus_type(dev->bus);
         if (!type) {
-                DBG("No ACPI bus support for %s\n", dev->bus_id);
+                DBG("No ACPI bus support for %s\n", dev_name(dev));
                 ret = -EINVAL;
                 goto end;
         }
         if ((ret = type->find_device(dev, &handle)) != 0)
-                DBG("Can't get handler for %s\n", dev->bus_id);
+                DBG("Can't get handler for %s\n", dev_name(dev));
       end:
         if (!ret)
                 acpi_bind_one(dev, handle);
@@ -271,10 +271,10 @@ static int acpi_platform_notify(struct device *dev)
 
                 acpi_get_name(dev->archdata.acpi_handle,
                               ACPI_FULL_PATHNAME, &buffer);
-                DBG("Device %s -> %s\n", dev->bus_id, (char *)buffer.pointer);
+                DBG("Device %s -> %s\n", dev_name(dev), (char *)buffer.pointer);
                 kfree(buffer.pointer);
         } else
-                DBG("Device %s -> No ACPI support\n", dev->bus_id);
+                DBG("Device %s -> No ACPI support\n", dev_name(dev));
 #endif
 
         return ret;
diff --git a/drivers/acpi/osl.c b/drivers/acpi/osl.c
index 6729a4992f2..d1dd5160daa 100644
--- a/drivers/acpi/osl.c
+++ b/drivers/acpi/osl.c
@@ -228,10 +228,10 @@ void acpi_os_vprintf(const char *fmt, va_list args)
         if (acpi_in_debugger) {
                 kdb_printf("%s", buffer);
         } else {
-                printk("%s", buffer);
+                printk(KERN_CONT "%s", buffer);
         }
 #else
-        printk("%s", buffer);
+        printk(KERN_CONT "%s", buffer);
 #endif
 }
 
@@ -274,12 +274,19 @@ EXPORT_SYMBOL_GPL(acpi_os_map_memory);
 
 void acpi_os_unmap_memory(void __iomem * virt, acpi_size size)
 {
-        if (acpi_gbl_permanent_mmap) {
+        if (acpi_gbl_permanent_mmap)
                 iounmap(virt);
-        }
+        else
+                __acpi_unmap_table(virt, size);
 }
 EXPORT_SYMBOL_GPL(acpi_os_unmap_memory);
 
+void early_acpi_os_unmap_memory(void __iomem * virt, acpi_size size)
+{
+        if (!acpi_gbl_permanent_mmap)
+                __acpi_unmap_table(virt, size);
+}
+
 #ifdef ACPI_FUTURE_USAGE
 acpi_status
 acpi_os_get_physical_address(void *virt, acpi_physical_address * phys)
@@ -1317,6 +1324,54 @@ acpi_os_validate_interface (char *interface)
         return AE_SUPPORT;
 }
 
+#ifdef  CONFIG_X86
+
+struct aml_port_desc {
+        uint    start;
+        uint    end;
+        char*   name;
+        char    warned;
+};
+
+static struct aml_port_desc aml_invalid_port_list[] = {
+        {0x20, 0x21, "PIC0", 0},
+        {0xA0, 0xA1, "PIC1", 0},
+        {0x4D0, 0x4D1, "ELCR", 0}
+};
+
+/*
+ * valid_aml_io_address()
+ *
+ * if valid, return true
+ * else invalid, warn once, return false
+ */
+static bool valid_aml_io_address(uint address, uint length)
+{
+        int i;
+        int entries = sizeof(aml_invalid_port_list) / sizeof(struct aml_port_desc);
+
+        for (i = 0; i < entries; ++i) {
+                if ((address >= aml_invalid_port_list[i].start &&
+                        address <= aml_invalid_port_list[i].end) ||
+                        (address + length >= aml_invalid_port_list[i].start &&
+                        address  + length <= aml_invalid_port_list[i].end))
+                {
+                        if (!aml_invalid_port_list[i].warned)
+                        {
+                                printk(KERN_ERR "ACPI: Denied BIOS AML access"
+                                        " to invalid port 0x%x+0x%x (%s)\n",
+                                        address, length,
+                                        aml_invalid_port_list[i].name);
+                                aml_invalid_port_list[i].warned = 1;
+                        }
+                        return false;   /* invalid */
+                }
+        }
+        return true;    /* valid */
+}
+#else
+static inline bool valid_aml_io_address(uint address, uint length) { return true; }
+#endif
 /******************************************************************************
  *
  * FUNCTION:    acpi_os_validate_address
@@ -1346,6 +1401,8 @@ acpi_os_validate_address (
 
         switch (space_id) {
         case ACPI_ADR_SPACE_SYSTEM_IO:
+                if (!valid_aml_io_address(address, length))
+                        return AE_AML_ILLEGAL_ADDRESS;
         case ACPI_ADR_SPACE_SYSTEM_MEMORY:
                 /* Only interference checks against SystemIO and SytemMemory
                    are needed */
diff --git a/drivers/acpi/pci_link.c b/drivers/acpi/pci_link.c
index 1c6e73c7865..6c772ca76bd 100644
--- a/drivers/acpi/pci_link.c
+++ b/drivers/acpi/pci_link.c
@@ -593,7 +593,7 @@ static int acpi_pci_link_allocate(struct acpi_pci_link *link)
                 return -ENODEV;
         } else {
                 acpi_irq_penalty[link->irq.active] += PIRQ_PENALTY_PCI_USING;
-                printk(PREFIX "%s [%s] enabled at IRQ %d\n",
+                printk(KERN_WARNING PREFIX "%s [%s] enabled at IRQ %d\n",
                        acpi_device_name(link->device),
                        acpi_device_bid(link->device), link->irq.active);
         }
diff --git a/drivers/acpi/processor_idle.c b/drivers/acpi/processor_idle.c
index 66a9d814556..7bc22a471fe 100644
--- a/drivers/acpi/processor_idle.c
+++ b/drivers/acpi/processor_idle.c
@@ -66,43 +66,17 @@ ACPI_MODULE_NAME("processor_idle");
 #define ACPI_PROCESSOR_FILE_POWER       "power"
 #define US_TO_PM_TIMER_TICKS(t)         ((t * (PM_TIMER_FREQUENCY/1000)) / 1000)
 #define PM_TIMER_TICK_NS                (1000000000ULL/PM_TIMER_FREQUENCY)
-#ifndef CONFIG_CPU_IDLE
-#define C2_OVERHEAD                     4       /* 1us (3.579 ticks per us) */
-#define C3_OVERHEAD                     4       /* 1us (3.579 ticks per us) */
-static void (*pm_idle_save) (void) __read_mostly;
-#else
 #define C2_OVERHEAD                     1       /* 1us */
 #define C3_OVERHEAD                     1       /* 1us */
-#endif
 #define PM_TIMER_TICKS_TO_US(p)         (((p) * 1000)/(PM_TIMER_FREQUENCY/1000))
 
 static unsigned int max_cstate __read_mostly = ACPI_PROCESSOR_MAX_POWER;
-#ifdef CONFIG_CPU_IDLE
 module_param(max_cstate, uint, 0000);
-#else
-module_param(max_cstate, uint, 0644);
-#endif
 static unsigned int nocst __read_mostly;
 module_param(nocst, uint, 0000);
 
-#ifndef CONFIG_CPU_IDLE
-/*
- * bm_history -- bit-mask with a bit per jiffy of bus-master activity
- * 1000 HZ: 0xFFFFFFFF: 32 jiffies = 32ms
- * 800 HZ: 0xFFFFFFFF: 32 jiffies = 40ms
- * 100 HZ: 0x0000000F: 4 jiffies = 40ms
- * reduce history for more aggressive entry into C3
- */
-static unsigned int bm_history __read_mostly =
-    (HZ >= 800 ? 0xFFFFFFFF : ((1U << (HZ / 25)) - 1));
-module_param(bm_history, uint, 0644);
-
-static int acpi_processor_set_power_policy(struct acpi_processor *pr);
-
-#else   /* CONFIG_CPU_IDLE */
 static unsigned int latency_factor __read_mostly = 2;
 module_param(latency_factor, uint, 0644);
-#endif
 
 /*
  * IBM ThinkPad R40e crashes mysteriously when going into C2 or C3.
@@ -224,71 +198,6 @@ static void acpi_safe_halt(void)
         current_thread_info()->status |= TS_POLLING;
 }
 
-#ifndef CONFIG_CPU_IDLE
-
-static void
-acpi_processor_power_activate(struct acpi_processor *pr,
-                              struct acpi_processor_cx *new)
-{
-        struct acpi_processor_cx *old;
-
-        if (!pr || !new)
-                return;
-
-        old = pr->power.state;
-
-        if (old)
-                old->promotion.count = 0;
-        new->demotion.count = 0;
-
-        /* Cleanup from old state. */
-        if (old) {
-                switch (old->type) {
-                case ACPI_STATE_C3:
-                        /* Disable bus master reload */
-                        if (new->type != ACPI_STATE_C3 && pr->flags.bm_check)
-                                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
-                        break;
-                }
-        }
-
-        /* Prepare to use new state. */
-        switch (new->type) {
-        case ACPI_STATE_C3:
-                /* Enable bus master reload */
-                if (old->type != ACPI_STATE_C3 && pr->flags.bm_check)
-                        acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
-                break;
-        }
-
-        pr->power.state = new;
-
-        return;
-}
-
-static atomic_t c3_cpu_count;
-
-/* Common C-state entry for C2, C3, .. */
-static void acpi_cstate_enter(struct acpi_processor_cx *cstate)
-{
-        /* Don't trace irqs off for idle */
-        stop_critical_timings();
-        if (cstate->entry_method == ACPI_CSTATE_FFH) {
-                /* Call into architectural FFH based C-state */
-                acpi_processor_ffh_cstate_enter(cstate);
-        } else {
-                int unused;
-                /* IO port based C-state */
-                inb(cstate->address);
-                /* Dummy wait op - must do something useless after P_LVL2 read
-                   because chipsets cannot guarantee that STPCLK# signal
-                   gets asserted in time to freeze execution properly. */
-                unused = inl(acpi_gbl_FADT.xpm_timer_block.address);
-        }
-        start_critical_timings();
-}
-#endif /* !CONFIG_CPU_IDLE */
-
 #ifdef ARCH_APICTIMER_STOPS_ON_C3
 
 /*
@@ -390,421 +299,6 @@ static int tsc_halts_in_c(int state)
 }
 #endif
 
-#ifndef CONFIG_CPU_IDLE
-static void acpi_processor_idle(void)
-{
-        struct acpi_processor *pr = NULL;
-        struct acpi_processor_cx *cx = NULL;
-        struct acpi_processor_cx *next_state = NULL;
-        int sleep_ticks = 0;
-        u32 t1, t2 = 0;
-
-        /*
-         * Interrupts must be disabled during bus mastering calculations and
-         * for C2/C3 transitions.
-         */
-        local_irq_disable();
-
-        pr = __get_cpu_var(processors);
-        if (!pr) {
-                local_irq_enable();
-                return;
-        }
-
-        /*
-         * Check whether we truly need to go idle, or should
-         * reschedule:
-         */
-        if (unlikely(need_resched())) {
-                local_irq_enable();
-                return;
-        }
-
-        cx = pr->power.state;
-        if (!cx || acpi_idle_suspend) {
-                if (pm_idle_save) {
-                        pm_idle_save(); /* enables IRQs */
-                } else {
-                        acpi_safe_halt();
-                        local_irq_enable();
-                }
-
-                return;
-        }
-
-        /*
-         * Check BM Activity
-         * -----------------
-         * Check for bus mastering activity (if required), record, and check
-         * for demotion.
-         */
-        if (pr->flags.bm_check) {
-                u32 bm_status = 0;
-                unsigned long diff = jiffies - pr->power.bm_check_timestamp;
-
-                if (diff > 31)
-                        diff = 31;
-
-                pr->power.bm_activity <<= diff;
-
-                acpi_get_register(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
-                if (bm_status) {
-                        pr->power.bm_activity |= 0x1;
-                        acpi_set_register(ACPI_BITREG_BUS_MASTER_STATUS, 1);
-                }
-                /*
-                 * PIIX4 Erratum #18: Note that BM_STS doesn't always reflect
-                 * the true state of bus mastering activity; forcing us to
-                 * manually check the BMIDEA bit of each IDE channel.
-                 */
-                else if (errata.piix4.bmisx) {
-                        if ((inb_p(errata.piix4.bmisx + 0x02) & 0x01)
-                            || (inb_p(errata.piix4.bmisx + 0x0A) & 0x01))
-                                pr->power.bm_activity |= 0x1;
-                }
-
-                pr->power.bm_check_timestamp = jiffies;
-
-                /*
-                 * If bus mastering is or was active this jiffy, demote
-                 * to avoid a faulty transition.  Note that the processor
-                 * won't enter a low-power state during this call (to this
-                 * function) but should upon the next.
-                 *
-                 * TBD: A better policy might be to fallback to the demotion
-                 *      state (use it for this quantum only) istead of
-                 *      demoting -- and rely on duration as our sole demotion
-                 *      qualification.  This may, however, introduce DMA
-                 *      issues (e.g. floppy DMA transfer overrun/underrun).
-                 */
-                if ((pr->power.bm_activity & 0x1) &&
-                    cx->demotion.threshold.bm) {
-                        local_irq_enable();
-                        next_state = cx->demotion.state;
-                        goto end;
-                }
-        }
-
-#ifdef CONFIG_HOTPLUG_CPU
-        /*
-         * Check for P_LVL2_UP flag before entering C2 and above on
-         * an SMP system. We do it here instead of doing it at _CST/P_LVL
-         * detection phase, to work cleanly with logical CPU hotplug.
-         */
-        if ((cx->type != ACPI_STATE_C1) && (num_online_cpus() > 1) &&
-            !pr->flags.has_cst && !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED))
-                cx = &pr->power.states[ACPI_STATE_C1];
-#endif
-
-        /*
-         * Sleep:
-         * ------
-         * Invoke the current Cx state to put the processor to sleep.
-         */
-        if (cx->type == ACPI_STATE_C2 || cx->type == ACPI_STATE_C3) {
-                current_thread_info()->status &= ~TS_POLLING;
-                /*
-                 * TS_POLLING-cleared state must be visible before we
-                 * test NEED_RESCHED:
-                 */
-                smp_mb();
-                if (need_resched()) {
-                        current_thread_info()->status |= TS_POLLING;
-                        local_irq_enable();
-                        return;
-                }
-        }
-
-        switch (cx->type) {
-
-        case ACPI_STATE_C1:
-                /*
-                 * Invoke C1.
-                 * Use the appropriate idle routine, the one that would
-                 * be used without acpi C-states.
-                 */
-                if (pm_idle_save) {
-                        pm_idle_save(); /* enables IRQs */
-                } else {
-                        acpi_safe_halt();
-                        local_irq_enable();
-                }
-
-                /*
-                 * TBD: Can't get time duration while in C1, as resumes
-                 *      go to an ISR rather than here.  Need to instrument
-                 *      base interrupt handler.
-                 *
-                 * Note: the TSC better not stop in C1, sched_clock() will
-                 *       skew otherwise.
-                 */
-                sleep_ticks = 0xFFFFFFFF;
-
-                break;
-
-        case ACPI_STATE_C2:
-                /* Get start time (ticks) */
-                t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                /* Tell the scheduler that we are going deep-idle: */
-                sched_clock_idle_sleep_event();
-                /* Invoke C2 */
-                acpi_state_timer_broadcast(pr, cx, 1);
-                acpi_cstate_enter(cx);
-                /* Get end time (ticks) */
-                t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC halts in C2, so notify users */
-                if (tsc_halts_in_c(ACPI_STATE_C2))
-                        mark_tsc_unstable("possible TSC halt in C2");
-#endif
-                /* Compute time (ticks) that we were actually asleep */
-                sleep_ticks = ticks_elapsed(t1, t2);
-
-                /* Tell the scheduler how much we idled: */
-                sched_clock_idle_wakeup_event(sleep_ticks*PM_TIMER_TICK_NS);
-
-                /* Re-enable interrupts */
-                local_irq_enable();
-                /* Do not account our idle-switching overhead: */
-                sleep_ticks -= cx->latency_ticks + C2_OVERHEAD;
-
-                current_thread_info()->status |= TS_POLLING;
-                acpi_state_timer_broadcast(pr, cx, 0);
-                break;
-
-        case ACPI_STATE_C3:
-                acpi_unlazy_tlb(smp_processor_id());
-                /*
-                 * Must be done before busmaster disable as we might
-                 * need to access HPET !
-                 */
-                acpi_state_timer_broadcast(pr, cx, 1);
-                /*
-                 * disable bus master
-                 * bm_check implies we need ARB_DIS
-                 * !bm_check implies we need cache flush
-                 * bm_control implies whether we can do ARB_DIS
-                 *
-                 * That leaves a case where bm_check is set and bm_control is
-                 * not set. In that case we cannot do much, we enter C3
-                 * without doing anything.
-                 */
-                if (pr->flags.bm_check && pr->flags.bm_control) {
-                        if (atomic_inc_return(&c3_cpu_count) ==
-                            num_online_cpus()) {
-                                /*
-                                 * All CPUs are trying to go to C3
-                                 * Disable bus master arbitration
-                                 */
-                                acpi_set_register(ACPI_BITREG_ARB_DISABLE, 1);
-                        }
-                } else if (!pr->flags.bm_check) {
-                        /* SMP with no shared cache... Invalidate cache  */
-                        ACPI_FLUSH_CPU_CACHE();
-                }
-
-                /* Get start time (ticks) */
-                t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                /* Invoke C3 */
-                /* Tell the scheduler that we are going deep-idle: */
-                sched_clock_idle_sleep_event();
-                acpi_cstate_enter(cx);
-                /* Get end time (ticks) */
-                t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
-                if (pr->flags.bm_check && pr->flags.bm_control) {
-                        /* Enable bus master arbitration */
-                        atomic_dec(&c3_cpu_count);
-                        acpi_set_register(ACPI_BITREG_ARB_DISABLE, 0);
-                }
-
-#if defined (CONFIG_GENERIC_TIME) && defined (CONFIG_X86)
-                /* TSC halts in C3, so notify users */
-                if (tsc_halts_in_c(ACPI_STATE_C3))
-                        mark_tsc_unstable("TSC halts in C3");
-#endif
-                /* Compute time (ticks) that we were actually asleep */
-                sleep_ticks = ticks_elapsed(t1, t2);
-                /* Tell the scheduler how much we idled: */
-                sched_clock_idle_wakeup_event(sleep_ticks*PM_TIMER_TICK_NS);
-
-                /* Re-enable interrupts */
-                local_irq_enable();
-                /* Do not account our idle-switching overhead: */
-                sleep_ticks -= cx->latency_ticks + C3_OVERHEAD;
-
-                current_thread_info()->status |= TS_POLLING;
-                acpi_state_timer_broadcast(pr, cx, 0);
-                break;
-
-        default:
-                local_irq_enable();
-                return;
-        }
-        cx->usage++;
-        if ((cx->type != ACPI_STATE_C1) && (sleep_ticks > 0))
-                cx->time += sleep_ticks;
-
-        next_state = pr->power.state;
-
-#ifdef CONFIG_HOTPLUG_CPU
-        /* Don't do promotion/demotion */
-        if ((cx->type == ACPI_STATE_C1) && (num_online_cpus() > 1) &&
-            !pr->flags.has_cst && !(acpi_gbl_FADT.flags & ACPI_FADT_C2_MP_SUPPORTED)) {
-                next_state = cx;
-                goto end;
-        }
-#endif
-
-        /*
-         * Promotion?
-         * ----------
-         * Track the number of longs (time asleep is greater than threshold)
-         * and promote when the count threshold is reached.  Note that bus
-         * mastering activity may prevent promotions.
-         * Do not promote above max_cstate.
-         */
-        if (cx->promotion.state &&
-            ((cx->promotion.state - pr->power.states) <= max_cstate)) {
-                if (sleep_ticks > cx->promotion.threshold.ticks &&
-                  cx->promotion.state->latency <=
-                                pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY)) {
-                        cx->promotion.count++;
-                        cx->demotion.count = 0;
-                        if (cx->promotion.count >=
-                            cx->promotion.threshold.count) {
-                                if (pr->flags.bm_check) {
-                                        if (!
-                                            (pr->power.bm_activity & cx->
-                                             promotion.threshold.bm)) {
-                                                next_state =
-                                                    cx->promotion.state;
-                                                goto end;
-                                        }
-                                } else {
-                                        next_state = cx->promotion.state;
-                                        goto end;
-                                }
-                        }
-                }
-        }
-
-        /*
-         * Demotion?
-         * ---------
-         * Track the number of shorts (time asleep is less than time threshold)
-         * and demote when the usage threshold is reached.
-         */
-        if (cx->demotion.state) {
-                if (sleep_ticks < cx->demotion.threshold.ticks) {
-                        cx->demotion.count++;
-                        cx->promotion.count = 0;
-                        if (cx->demotion.count >= cx->demotion.threshold.count) {
-                                next_state = cx->demotion.state;
-                                goto end;
-                        }
-                }
-        }
-
-      end:
-        /*
-         * Demote if current state exceeds max_cstate
-         * or if the latency of the current state is unacceptable
-         */
-        if ((pr->power.state - pr->power.states) > max_cstate ||
-                pr->power.state->latency >
-                                pm_qos_requirement(PM_QOS_CPU_DMA_LATENCY)) {
-                if (cx->demotion.state)
-                        next_state = cx->demotion.state;
-        }
-
-        /*
-         * New Cx State?
-         * -------------
-         * If we're going to start using a new Cx state we must clean up
-         * from the previous and prepare to use the new.
-         */
-        if (next_state != pr->power.state)
-                acpi_processor_power_activate(pr, next_state);
-}
-
-static int acpi_processor_set_power_policy(struct acpi_processor *pr)
-{
-        unsigned int i;
-        unsigned int state_is_set = 0;
-        struct acpi_processor_cx *lower = NULL;
-        struct acpi_processor_cx *higher = NULL;
-        struct acpi_processor_cx *cx;
-
-
-        if (!pr)
-                return -EINVAL;
-
-        /*
-         * This function sets the default Cx state policy (OS idle handler).
-         * Our scheme is to promote quickly to C2 but more conservatively
-         * to C3.  We're favoring C2  for its characteristics of low latency
-         * (quick response), good power savings, and ability to allow bus
-         * mastering activity.  Note that the Cx state policy is completely
-         * customizable and can be altered dynamically.
-         */
-
-        /* startup state */
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-
-                if (!state_is_set)
-                        pr->power.state = cx;
-                state_is_set++;
-                break;
-        }
-
-        if (!state_is_set)
-                return -ENODEV;
-
-        /* demotion */
-        for (i = 1; i < ACPI_PROCESSOR_MAX_POWER; i++) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-
-                if (lower) {
-                        cx->demotion.state = lower;
-                        cx->demotion.threshold.ticks = cx->latency_ticks;
-                        cx->demotion.threshold.count = 1;
-                        if (cx->type == ACPI_STATE_C3)
-                                cx->demotion.threshold.bm = bm_history;
-                }
-
-                lower = cx;
-        }
-
-        /* promotion */
-        for (i = (ACPI_PROCESSOR_MAX_POWER - 1); i > 0; i--) {
-                cx = &pr->power.states[i];
-                if (!cx->valid)
-                        continue;
-
-                if (higher) {
-                        cx->promotion.state = higher;
-                        cx->promotion.threshold.ticks = cx->latency_ticks;
-                        if (cx->type >= ACPI_STATE_C2)
-                                cx->promotion.threshold.count = 4;
-                        else
-                                cx->promotion.threshold.count = 10;
-                        if (higher->type == ACPI_STATE_C3)
-                                cx->promotion.threshold.bm = bm_history;
-                }
-
-                higher = cx;
-        }
-
-        return 0;
-}
-#endif /* !CONFIG_CPU_IDLE */
-
 static int acpi_processor_get_power_info_fadt(struct acpi_processor *pr)
 {
 
@@ -1047,11 +541,7 @@ static void acpi_processor_power_verify_c2(struct acpi_processor_cx *cx)
          */
         cx->valid = 1;
 
-#ifndef CONFIG_CPU_IDLE
-        cx->latency_ticks = US_TO_PM_TIMER_TICKS(cx->latency);
-#else
         cx->latency_ticks = cx->latency;
-#endif
 
         return;
 }
@@ -1121,7 +611,6 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
                                           " for C3 to be enabled on SMP systems\n"));
                         return;
                 }
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
         }
 
         /*
@@ -1132,11 +621,16 @@ static void acpi_processor_power_verify_c3(struct acpi_processor *pr,
          */
         cx->valid = 1;
 
-#ifndef CONFIG_CPU_IDLE
-        cx->latency_ticks = US_TO_PM_TIMER_TICKS(cx->latency);
-#else
         cx->latency_ticks = cx->latency;
-#endif
+        /*
+         * On older chipsets, BM_RLD needs to be set
+         * in order for Bus Master activity to wake the
+         * system from C3.  Newer chipsets handle DMA
+         * during C3 automatically and BM_RLD is a NOP.
+         * In either case, the proper way to
+         * handle BM_RLD is to set it and leave it set.
+         */
+        acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
 
         return;
 }
@@ -1201,20 +695,6 @@ static int acpi_processor_get_power_info(struct acpi_processor *pr)
 
         pr->power.count = acpi_processor_power_verify(pr);
 
-#ifndef CONFIG_CPU_IDLE
-        /*
-         * Set Default Policy
-         * ------------------
-         * Now that we know which states are supported, set the default
-         * policy.  Note that this policy can be changed dynamically
-         * (e.g. encourage deeper sleeps to conserve battery life when
-         * not on AC).
-         */
-        result = acpi_processor_set_power_policy(pr);
-        if (result)
-                return result;
-#endif
-
         /*
          * if one state of type C2 or C3 is available, mark this
          * CPU as being "idle manageable"
@@ -1312,69 +792,6 @@ static const struct file_operations acpi_processor_power_fops = {
         .release = single_release,
 };
 
-#ifndef CONFIG_CPU_IDLE
-
-int acpi_processor_cst_has_changed(struct acpi_processor *pr)
-{
-        int result = 0;
-
-        if (boot_option_idle_override)
-                return 0;
-
-        if (!pr)
-                return -EINVAL;
-
-        if (nocst) {
-                return -ENODEV;
-        }
-
-        if (!pr->flags.power_setup_done)
-                return -ENODEV;
-
-        /*
-         * Fall back to the default idle loop, when pm_idle_save had
-         * been initialized.
-         */
-        if (pm_idle_save) {
-                pm_idle = pm_idle_save;
-                /* Relies on interrupts forcing exit from idle. */
-                synchronize_sched();
-        }
-
-        pr->flags.power = 0;
-        result = acpi_processor_get_power_info(pr);
-        if ((pr->flags.power == 1) && (pr->flags.power_setup_done))
-                pm_idle = acpi_processor_idle;
-
-        return result;
-}
-
-#ifdef CONFIG_SMP
-static void smp_callback(void *v)
-{
-        /* we already woke the CPU up, nothing more to do */
-}
-
-/*
- * This function gets called when a part of the kernel has a new latency
- * requirement.  This means we need to get all processors out of their C-state,
- * and then recalculate a new suitable C-state. Just do a cross-cpu IPI; that
- * wakes them all right up.
- */
-static int acpi_processor_latency_notify(struct notifier_block *b,
-                unsigned long l, void *v)
-{
-        smp_call_function(smp_callback, NULL, 1);
-        return NOTIFY_OK;
-}
-
-static struct notifier_block acpi_processor_latency_notifier = {
-        .notifier_call = acpi_processor_latency_notify,
-};
-
-#endif
-
-#else /* CONFIG_CPU_IDLE */
 
 /**
  * acpi_idle_bm_check - checks if bus master activity was detected
@@ -1383,7 +800,7 @@ static int acpi_idle_bm_check(void)
 {
         u32 bm_status = 0;
 
-        acpi_get_register(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
+        acpi_get_register_unlocked(ACPI_BITREG_BUS_MASTER_STATUS, &bm_status);
         if (bm_status)
                 acpi_set_register(ACPI_BITREG_BUS_MASTER_STATUS, 1);
         /*
@@ -1400,25 +817,6 @@ static int acpi_idle_bm_check(void)
 }
 
 /**
- * acpi_idle_update_bm_rld - updates the BM_RLD bit depending on target state
- * @pr: the processor
- * @target: the new target state
- */
-static inline void acpi_idle_update_bm_rld(struct acpi_processor *pr,
-                                           struct acpi_processor_cx *target)
-{
-        if (pr->flags.bm_rld_set && target->type != ACPI_STATE_C3) {
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 0);
-                pr->flags.bm_rld_set = 0;
-        }
-
-        if (!pr->flags.bm_rld_set && target->type == ACPI_STATE_C3) {
-                acpi_set_register(ACPI_BITREG_BUS_MASTER_RLD, 1);
-                pr->flags.bm_rld_set = 1;
-        }
-}
-
-/**
  * acpi_idle_do_entry - a helper function that does C2 and C3 type entry
  * @cx: cstate data
  *
@@ -1473,9 +871,6 @@ static int acpi_idle_enter_c1(struct cpuidle_device *dev,
                 return 0;
         }
 
-        if (pr->flags.bm_check)
-                acpi_idle_update_bm_rld(pr, cx);
-
         t1 = inl(acpi_gbl_FADT.xpm_timer_block.address);
         acpi_idle_do_entry(cx);
         t2 = inl(acpi_gbl_FADT.xpm_timer_block.address);
@@ -1527,9 +922,6 @@ static int acpi_idle_enter_simple(struct cpuidle_device *dev,
          */
         acpi_state_timer_broadcast(pr, cx, 1);
 
-        if (pr->flags.bm_check)
-                acpi_idle_update_bm_rld(pr, cx);
-
         if (cx->type == ACPI_STATE_C3)
                 ACPI_FLUSH_CPU_CACHE();
 
@@ -1621,8 +1013,6 @@ static int acpi_idle_enter_bm(struct cpuidle_device *dev,
          */
         acpi_state_timer_broadcast(pr, cx, 1);
 
-        acpi_idle_update_bm_rld(pr, cx);
-
         /*
          * disable bus master
          * bm_check implies we need ARB_DIS
@@ -1795,8 +1185,6 @@ int acpi_processor_cst_has_changed(struct acpi_processor *pr)
         return ret;
 }
 
-#endif /* CONFIG_CPU_IDLE */
-
 int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                               struct acpi_device *device)
 {
@@ -1825,10 +1213,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                                "ACPI: processor limited to max C-state %d\n",
                                max_cstate);
                 first_run++;
-#if !defined(CONFIG_CPU_IDLE) && defined(CONFIG_SMP)
-                pm_qos_add_notifier(PM_QOS_CPU_DMA_LATENCY,
-                                &acpi_processor_latency_notifier);
-#endif
         }
 
         if (!pr)
@@ -1852,11 +1236,9 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
          * platforms that only support C1.
          */
         if (pr->flags.power) {
-#ifdef CONFIG_CPU_IDLE
                 acpi_processor_setup_cpuidle(pr);
                 if (cpuidle_register_device(&pr->power.dev))
                         return -EIO;
-#endif
 
                 printk(KERN_INFO PREFIX "CPU%d (power states:", pr->id);
                 for (i = 1; i <= pr->power.count; i++)
@@ -1864,13 +1246,6 @@ int __cpuinit acpi_processor_power_init(struct acpi_processor *pr,
                                 printk(" C%d[C%d]", i,
                                        pr->power.states[i].type);
                 printk(")\n");
-
-#ifndef CONFIG_CPU_IDLE
-                if (pr->id == 0) {
-                        pm_idle_save = pm_idle;
-                        pm_idle = acpi_processor_idle;
-                }
-#endif
         }
 
         /* 'power' [R] */
@@ -1889,34 +1264,12 @@ int acpi_processor_power_exit(struct acpi_processor *pr,
         if (boot_option_idle_override)
                 return 0;
 
-#ifdef CONFIG_CPU_IDLE
         cpuidle_unregister_device(&pr->power.dev);
-#endif
         pr->flags.power_setup_done = 0;
 
         if (acpi_device_dir(device))
                 remove_proc_entry(ACPI_PROCESSOR_FILE_POWER,
                                   acpi_device_dir(device));
 
-#ifndef CONFIG_CPU_IDLE
-
-        /* Unregister the idle handler when processor #0 is removed. */
-        if (pr->id == 0) {
-                if (pm_idle_save)
-                        pm_idle = pm_idle_save;
-
-                /*
-                 * We are about to unload the current idle thread pm callback
-                 * (pm_idle), Wait for all processors to update cached/local
-                 * copies of pm_idle before proceeding.
-                 */
-                cpu_idle_wait();
-#ifdef CONFIG_SMP
-                pm_qos_remove_notifier(PM_QOS_CPU_DMA_LATENCY,
-                                &acpi_processor_latency_notifier);
-#endif
-        }
-#endif
-
         return 0;
 }
diff --git a/drivers/acpi/processor_perflib.c b/drivers/acpi/processor_perflib.c
index 846e227592d..9cc769b587f 100644
--- a/drivers/acpi/processor_perflib.c
+++ b/drivers/acpi/processor_perflib.c
@@ -31,14 +31,6 @@
 #include <linux/init.h>
 #include <linux/cpufreq.h>
 
-#ifdef CONFIG_X86_ACPI_CPUFREQ_PROC_INTF
-#include <linux/proc_fs.h>
-#include <linux/seq_file.h>
-#include <linux/mutex.h>
-
-#include <asm/uaccess.h>
-#endif
-
 #ifdef CONFIG_X86
 #include <asm/cpufeature.h>
 #endif
@@ -434,96 +426,6 @@ int acpi_processor_notify_smm(struct module *calling_module)
 
 EXPORT_SYMBOL(acpi_processor_notify_smm);
 
-#ifdef CONFIG_X86_ACPI_CPUFREQ_PROC_INTF
-/* /proc/acpi/processor/../performance interface (DEPRECATED) */
-
-static int acpi_processor_perf_open_fs(struct inode *inode, struct file *file);
-static struct file_operations acpi_processor_perf_fops = {
-        .owner = THIS_MODULE,
-        .open = acpi_processor_perf_open_fs,
-        .read = seq_read,
-        .llseek = seq_lseek,
-        .release = single_release,
-};
-
-static int acpi_processor_perf_seq_show(struct seq_file *seq, void *offset)
-{
-        struct acpi_processor *pr = seq->private;
-        int i;
-
-
-        if (!pr)
-                goto end;
-
-        if (!pr->performance) {
-                seq_puts(seq, "<not supported>\n");
-                goto end;
-        }
-
-        seq_printf(seq, "state count:             %d\n"
-                   "active state:            P%d\n",
-                   pr->performance->state_count, pr->performance->state);
-
-        seq_puts(seq, "states:\n");
-        for (i = 0; i < pr->performance->state_count; i++)
-                seq_printf(seq,
-                           "   %cP%d:                  %d MHz, %d mW, %d uS\n",
-                           (i == pr->performance->state ? '*' : ' '), i,
-                           (u32) pr->performance->states[i].core_frequency,
-                           (u32) pr->performance->states[i].power,
-                           (u32) pr->performance->states[i].transition_latency);
-
-      end:
-        return 0;
-}
-
-static int acpi_processor_perf_open_fs(struct inode *inode, struct file *file)
-{
-        return single_open(file, acpi_processor_perf_seq_show,
-                           PDE(inode)->data);
-}
-
-static void acpi_cpufreq_add_file(struct acpi_processor *pr)
-{
-        struct acpi_device *device = NULL;
-
-
-        if (acpi_bus_get_device(pr->handle, &device))
-                return;
-
-        /* add file 'performance' [R/W] */
-        proc_create_data(ACPI_PROCESSOR_FILE_PERFORMANCE, S_IFREG | S_IRUGO,
-                         acpi_device_dir(device),
-                         &acpi_processor_perf_fops, acpi_driver_data(device));
-        return;
-}
-
-static void acpi_cpufreq_remove_file(struct acpi_processor *pr)
-{
-        struct acpi_device *device = NULL;
-
-
-        if (acpi_bus_get_device(pr->handle, &device))
-                return;
-
-        /* remove file 'performance' */
-        remove_proc_entry(ACPI_PROCESSOR_FILE_PERFORMANCE,
-                          acpi_device_dir(device));
-
-        return;
-}
-
-#else
-static void acpi_cpufreq_add_file(struct acpi_processor *pr)
-{
-        return;
-}
-static void acpi_cpufreq_remove_file(struct acpi_processor *pr)
-{
-        return;
-}
-#endif                          /* CONFIG_X86_ACPI_CPUFREQ_PROC_INTF */
-
 static int acpi_processor_get_psd(struct acpi_processor *pr)
 {
         int result = 0;
@@ -747,14 +649,12 @@ err_ret:
 }
 EXPORT_SYMBOL(acpi_processor_preregister_performance);
 
-
 int
 acpi_processor_register_performance(struct acpi_processor_performance
                                     *performance, unsigned int cpu)
 {
         struct acpi_processor *pr;
 
-
         if (!(acpi_processor_ppc_status & PPC_REGISTERED))
                 return -EINVAL;
 
@@ -781,8 +681,6 @@ acpi_processor_register_performance(struct acpi_processor_performance
                 return -EIO;
         }
 
-        acpi_cpufreq_add_file(pr);
-
         mutex_unlock(&performance_mutex);
         return 0;
 }
@@ -795,7 +693,6 @@ acpi_processor_unregister_performance(struct acpi_processor_performance
 {
         struct acpi_processor *pr;
 
-
         mutex_lock(&performance_mutex);
 
         pr = per_cpu(processors, cpu);
@@ -808,8 +705,6 @@ acpi_processor_unregister_performance(struct acpi_processor_performance
                 kfree(pr->performance->states);
         pr->performance = NULL;
 
-        acpi_cpufreq_remove_file(pr);
-
         mutex_unlock(&performance_mutex);
 
         return;
diff --git a/drivers/acpi/sleep.c b/drivers/acpi/sleep.c
index 7e3c609cbef..519266654f0 100644
--- a/drivers/acpi/sleep.c
+++ b/drivers/acpi/sleep.c
@@ -90,31 +90,6 @@ void __init acpi_old_suspend_ordering(void)
         old_suspend_ordering = true;
 }
 
-/*
- * According to the ACPI specification the BIOS should make sure that ACPI is
- * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
- * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
- * on such systems during resume.  Unfortunately that doesn't help in
- * particularly pathological cases in which SCI_EN has to be set directly on
- * resume, although the specification states very clearly that this flag is
- * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
- * cases.
- */
-static bool set_sci_en_on_resume;
-/*
- * The ACPI specification wants us to save NVS memory regions during hibernation
- * and to restore them during the subsequent resume.  However, it is not certain
- * if this mechanism is going to work on all machines, so we allow the user to
- * disable this mechanism using the 'acpi_sleep=s4_nonvs' kernel command line
- * option.
- */
-static bool s4_no_nvs;
-
-void __init acpi_s4_no_nvs(void)
-{
-        s4_no_nvs = true;
-}
-
 /**
  *      acpi_pm_disable_gpes - Disable the GPEs.
  */
@@ -193,6 +168,18 @@ static void acpi_pm_end(void)
 #endif /* CONFIG_ACPI_SLEEP */
 
 #ifdef CONFIG_SUSPEND
+/*
+ * According to the ACPI specification the BIOS should make sure that ACPI is
+ * enabled and SCI_EN bit is set on wake-up from S1 - S3 sleep states.  Still,
+ * some BIOSes don't do that and therefore we use acpi_enable() to enable ACPI
+ * on such systems during resume.  Unfortunately that doesn't help in
+ * particularly pathological cases in which SCI_EN has to be set directly on
+ * resume, although the specification states very clearly that this flag is
+ * owned by the hardware.  The set_sci_en_on_resume variable will be set in such
+ * cases.
+ */
+static bool set_sci_en_on_resume;
+
 extern void do_suspend_lowlevel(void);
 
 static u32 acpi_suspend_states[] = {
@@ -396,6 +383,20 @@ static struct dmi_system_id __initdata acpisleep_dmi_table[] = {
 #endif /* CONFIG_SUSPEND */
 
 #ifdef CONFIG_HIBERNATION
+/*
+ * The ACPI specification wants us to save NVS memory regions during hibernation
+ * and to restore them during the subsequent resume.  However, it is not certain
+ * if this mechanism is going to work on all machines, so we allow the user to
+ * disable this mechanism using the 'acpi_sleep=s4_nonvs' kernel command line
+ * option.
+ */
+static bool s4_no_nvs;
+
+void __init acpi_s4_no_nvs(void)
+{
+        s4_no_nvs = true;
+}
+
 static unsigned long s4_hardware_signature;
 static struct acpi_table_facs *facs;
 static bool nosigcheck;
@@ -679,7 +680,7 @@ static void acpi_power_off_prepare(void)
 static void acpi_power_off(void)
 {
         /* acpi_sleep_prepare(ACPI_STATE_S5) should have already been called */
-        printk("%s called\n", __func__);
+        printk(KERN_DEBUG "%s called\n", __func__);
         local_irq_disable();
         acpi_enable_wakeup_device(ACPI_STATE_S5);
         acpi_enter_sleep_state(ACPI_STATE_S5);
diff --git a/drivers/acpi/tables.c b/drivers/acpi/tables.c
index 775c97a282b..fec1ae36d43 100644
--- a/drivers/acpi/tables.c
+++ b/drivers/acpi/tables.c
@@ -181,14 +181,15 @@ acpi_table_parse_entries(char *id,
         struct acpi_subtable_header *entry;
         unsigned int count = 0;
         unsigned long table_end;
+        acpi_size tbl_size;
 
         if (!handler)
                 return -EINVAL;
 
         if (strncmp(id, ACPI_SIG_MADT, 4) == 0)
-                acpi_get_table(id, acpi_apic_instance, &table_header);
+                acpi_get_table_with_size(id, acpi_apic_instance, &table_header, &tbl_size);
         else
-                acpi_get_table(id, 0, &table_header);
+                acpi_get_table_with_size(id, 0, &table_header, &tbl_size);
 
         if (!table_header) {
                 printk(KERN_WARNING PREFIX "%4.4s not present\n", id);
@@ -206,8 +207,10 @@ acpi_table_parse_entries(char *id,
                table_end) {
                 if (entry->type == entry_id
                     && (!max_entries || count++ < max_entries))
-                        if (handler(entry, table_end))
+                        if (handler(entry, table_end)) {
+                                early_acpi_os_unmap_memory((char *)table_header, tbl_size);
                                 return -EINVAL;
+                        }
 
                 entry = (struct acpi_subtable_header *)
                     ((unsigned long)entry + entry->length);
@@ -217,6 +220,7 @@ acpi_table_parse_entries(char *id,
                        "%i found\n", id, entry_id, count - max_entries, count);
         }
 
+        early_acpi_os_unmap_memory((char *)table_header, tbl_size);
         return count;
 }
 
@@ -241,17 +245,19 @@ acpi_table_parse_madt(enum acpi_madt_type id,
 int __init acpi_table_parse(char *id, acpi_table_handler handler)
 {
         struct acpi_table_header *table = NULL;
+        acpi_size tbl_size;
 
         if (!handler)
                 return -EINVAL;
 
         if (strncmp(id, ACPI_SIG_MADT, 4) == 0)
-                acpi_get_table(id, acpi_apic_instance, &table);
+                acpi_get_table_with_size(id, acpi_apic_instance, &table, &tbl_size);
         else
-                acpi_get_table(id, 0, &table);
+                acpi_get_table_with_size(id, 0, &table, &tbl_size);
 
         if (table) {
                 handler(table);
+                early_acpi_os_unmap_memory(table, tbl_size);
                 return 0;
         } else
                 return 1;
@@ -265,8 +271,9 @@ int __init acpi_table_parse(char *id, acpi_table_handler handler)
 static void __init check_multiple_madt(void)
 {
         struct acpi_table_header *table = NULL;
+        acpi_size tbl_size;
 
-        acpi_get_table(ACPI_SIG_MADT, 2, &table);
+        acpi_get_table_with_size(ACPI_SIG_MADT, 2, &table, &tbl_size);
         if (table) {
                 printk(KERN_WARNING PREFIX
                        "BIOS bug: multiple APIC/MADT found,"
@@ -275,6 +282,7 @@ static void __init check_multiple_madt(void)
                        "If \"acpi_apic_instance=%d\" works better, "
                        "notify linux-acpi@vger.kernel.org\n",
                        acpi_apic_instance ? 0 : 2);
+                early_acpi_os_unmap_memory(table, tbl_size);
 
         } else
                 acpi_apic_instance = 0;
@@ -293,7 +301,12 @@ static void __init check_multiple_madt(void)
 
 int __init acpi_table_init(void)
 {
-        acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
+        acpi_status status;
+
+        status = acpi_initialize_tables(initial_tables, ACPI_MAX_TABLES, 0);
+        if (ACPI_FAILURE(status))
+                return 1;
+
         check_multiple_madt();
         return 0;
 }
diff --git a/drivers/acpi/video.c b/drivers/acpi/video.c
index f261737636d..bb5ed059114 100644
--- a/drivers/acpi/video.c
+++ b/drivers/acpi/video.c
@@ -1020,7 +1020,7 @@ acpi_video_device_brightness_seq_show(struct seq_file *seq, void *offset)
         }
 
         seq_printf(seq, "levels: ");
-        for (i = 0; i < dev->brightness->count; i++)
+        for (i = 2; i < dev->brightness->count; i++)
                 seq_printf(seq, " %d", dev->brightness->levels[i]);
         seq_printf(seq, "\ncurrent: %d\n", dev->brightness->curr);
 
@@ -1059,7 +1059,7 @@ acpi_video_device_write_brightness(struct file *file,
                 return -EFAULT;
 
         /* validate through the list of available levels */
-        for (i = 0; i < dev->brightness->count; i++)
+        for (i = 2; i < dev->brightness->count; i++)
                 if (level == dev->brightness->levels[i]) {
                         if (ACPI_SUCCESS
                             (acpi_video_device_lcd_set_level(dev, level)))
@@ -1260,7 +1260,7 @@ static int acpi_video_bus_POST_info_seq_show(struct seq_file *seq, void *offset)
                         printk(KERN_WARNING PREFIX
                                "This indicates a BIOS bug. Please contact the manufacturer.\n");
                 }
-                printk("%llx\n", options);
+                printk(KERN_WARNING "%llx\n", options);
                 seq_printf(seq, "can POST: <integrated video>");
                 if (options & 2)
                         seq_printf(seq, " <PCI video>");
@@ -1712,7 +1712,7 @@ acpi_video_get_next_level(struct acpi_video_device *device,
         max = max_below = 0;
         min = min_above = 255;
         /* Find closest level to level_current */
-        for (i = 0; i < device->brightness->count; i++) {
+        for (i = 2; i < device->brightness->count; i++) {
                 l = device->brightness->levels[i];
                 if (abs(l - level_current) < abs(delta)) {
                         delta = l - level_current;
@@ -1722,7 +1722,7 @@ acpi_video_get_next_level(struct acpi_video_device *device,
         }
         /* Ajust level_current to closest available level */
         level_current += delta;
-        for (i = 0; i < device->brightness->count; i++) {
+        for (i = 2; i < device->brightness->count; i++) {
                 l = device->brightness->levels[i];
                 if (l < min)
                         min = l;
@@ -2006,6 +2006,12 @@ static int acpi_video_bus_add(struct acpi_device *device)
                         device->pnp.bus_id[3] = '0' + instance;
                 instance ++;
         }
+        /* a hack to fix the duplicate name "VGA" problem on Pa 3553 */
+        if (!strcmp(device->pnp.bus_id, "VGA")) {
+                if (instance)
+                        device->pnp.bus_id[3] = '0' + instance;
+                instance++;
+        }
 
         video->device = device;
         strcpy(acpi_device_name(device), ACPI_VIDEO_BUS_NAME);
diff --git a/drivers/ata/ahci.c b/drivers/ata/ahci.c
index 77bba4c083c..a603bbf9b1b 100644
--- a/drivers/ata/ahci.c
+++ b/drivers/ata/ahci.c
@@ -61,9 +61,14 @@
 #define EM_MSG_LED_VALUE_ON           0x00010000
 
 static int ahci_skip_host_reset;
+static int ahci_ignore_sss;
+
 module_param_named(skip_host_reset, ahci_skip_host_reset, int, 0444);
 MODULE_PARM_DESC(skip_host_reset, "skip global host reset (0=don't skip, 1=skip)");
 
+module_param_named(ignore_sss, ahci_ignore_sss, int, 0444);
+MODULE_PARM_DESC(ignore_sss, "Ignore staggered spinup flag (0=don't ignore, 1=ignore)");
+
 static int ahci_enable_alpm(struct ata_port *ap,
                 enum link_pm policy);
 static void ahci_disable_alpm(struct ata_port *ap);
@@ -2692,8 +2697,10 @@ static int ahci_init_one(struct pci_dev *pdev, const struct pci_device_id *ent)
         host->iomap = pcim_iomap_table(pdev);
         host->private_data = hpriv;
 
-        if (!(hpriv->cap & HOST_CAP_SSS))
+        if (!(hpriv->cap & HOST_CAP_SSS) || ahci_ignore_sss)
                 host->flags |= ATA_HOST_PARALLEL_SCAN;
+        else
+                printk(KERN_INFO "ahci: SSS flag set, parallel bus scan disabled\n");
 
         if (pi.flags & ATA_FLAG_EM)
                 ahci_reset_em(host);
diff --git a/drivers/ata/libata-core.c b/drivers/ata/libata-core.c
index 88c242856da..9fbf0595f3d 100644
--- a/drivers/ata/libata-core.c
+++ b/drivers/ata/libata-core.c
@@ -164,6 +164,11 @@ MODULE_LICENSE("GPL");
 MODULE_VERSION(DRV_VERSION);
 
 
+static bool ata_sstatus_online(u32 sstatus)
+{
+        return (sstatus & 0xf) == 0x3;
+}
+
 /**
  *      ata_link_next - link iteration helper
  *      @link: the previous link, NULL to start
@@ -1015,18 +1020,6 @@ static const char *sata_spd_string(unsigned int spd)
         return spd_str[spd - 1];
 }
 
-void ata_dev_disable(struct ata_device *dev)
-{
-        if (ata_dev_enabled(dev)) {
-                if (ata_msg_drv(dev->link->ap))
-                        ata_dev_printk(dev, KERN_WARNING, "disabled\n");
-                ata_acpi_on_disable(dev);
-                ata_down_xfermask_limit(dev, ATA_DNXFER_FORCE_PIO0 |
-                                             ATA_DNXFER_QUIET);
-                dev->class++;
-        }
-}
-
 static int ata_dev_set_dipm(struct ata_device *dev, enum link_pm policy)
 {
         struct ata_link *link = dev->link;
@@ -2239,6 +2232,40 @@ retry:
         return rc;
 }
 
+static int ata_do_link_spd_horkage(struct ata_device *dev)
+{
+        struct ata_link *plink = ata_dev_phys_link(dev);
+        u32 target, target_limit;
+
+        if (!sata_scr_valid(plink))
+                return 0;
+
+        if (dev->horkage & ATA_HORKAGE_1_5_GBPS)
+                target = 1;
+        else
+                return 0;
+
+        target_limit = (1 << target) - 1;
+
+        /* if already on stricter limit, no need to push further */
+        if (plink->sata_spd_limit <= target_limit)
+                return 0;
+
+        plink->sata_spd_limit = target_limit;
+
+        /* Request another EH round by returning -EAGAIN if link is
+         * going faster than the target speed.  Forward progress is
+         * guaranteed by setting sata_spd_limit to target_limit above.
+         */
+        if (plink->sata_spd > target) {
+                ata_dev_printk(dev, KERN_INFO,
+                               "applying link speed limit horkage to %s\n",
+                               sata_spd_string(target));
+                return -EAGAIN;
+        }
+        return 0;
+}
+
 static inline u8 ata_dev_knobble(struct ata_device *dev)
 {
         struct ata_port *ap = dev->link->ap;
@@ -2329,6 +2356,10 @@ int ata_dev_configure(struct ata_device *dev)
                 return 0;
         }
 
+        rc = ata_do_link_spd_horkage(dev);
+        if (rc)
+                return rc;
+
         /* let ACPI work its magic */
         rc = ata_acpi_on_devcfg(dev);
         if (rc)
@@ -2784,7 +2815,7 @@ int ata_bus_probe(struct ata_port *ap)
                         /* This is the last chance, better to slow
                          * down than lose it.
                          */
-                        sata_down_spd_limit(&ap->link);
+                        sata_down_spd_limit(&ap->link, 0);
                         ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                 }
         }
@@ -2880,21 +2911,27 @@ void ata_port_disable(struct ata_port *ap)
 /**
  *      sata_down_spd_limit - adjust SATA spd limit downward
  *      @link: Link to adjust SATA spd limit for
+ *      @spd_limit: Additional limit
  *
  *      Adjust SATA spd limit of @link downward.  Note that this
  *      function only adjusts the limit.  The change must be applied
  *      using sata_set_spd().
  *
+ *      If @spd_limit is non-zero, the speed is limited to equal to or
+ *      lower than @spd_limit if such speed is supported.  If
+ *      @spd_limit is slower than any supported speed, only the lowest
+ *      supported speed is allowed.
+ *
  *      LOCKING:
  *      Inherited from caller.
  *
  *      RETURNS:
  *      0 on success, negative errno on failure
  */
-int sata_down_spd_limit(struct ata_link *link)
+int sata_down_spd_limit(struct ata_link *link, u32 spd_limit)
 {
         u32 sstatus, spd, mask;
-        int rc, highbit;
+        int rc, bit;
 
         if (!sata_scr_valid(link))
                 return -EOPNOTSUPP;
@@ -2903,7 +2940,7 @@ int sata_down_spd_limit(struct ata_link *link)
          * If not, use cached value in link->sata_spd.
          */
         rc = sata_scr_read(link, SCR_STATUS, &sstatus);
-        if (rc == 0)
+        if (rc == 0 && ata_sstatus_online(sstatus))
                 spd = (sstatus >> 4) & 0xf;
         else
                 spd = link->sata_spd;
@@ -2913,8 +2950,8 @@ int sata_down_spd_limit(struct ata_link *link)
                 return -EINVAL;
 
         /* unconditionally mask off the highest bit */
-        highbit = fls(mask) - 1;
-        mask &= ~(1 << highbit);
+        bit = fls(mask) - 1;
+        mask &= ~(1 << bit);
 
         /* Mask off all speeds higher than or equal to the current
          * one.  Force 1.5Gbps if current SPD is not available.
@@ -2928,6 +2965,15 @@ int sata_down_spd_limit(struct ata_link *link)
         if (!mask)
                 return -EINVAL;
 
+        if (spd_limit) {
+                if (mask & ((1 << spd_limit) - 1))
+                        mask &= (1 << spd_limit) - 1;
+                else {
+                        bit = ffs(mask) - 1;
+                        mask = 1 << bit;
+                }
+        }
+
         link->sata_spd_limit = mask;
 
         ata_link_printk(link, KERN_WARNING, "limiting SATA link speed to %s\n",
@@ -4215,6 +4261,9 @@ static const struct ata_blacklist_entry ata_device_blacklist [] = {
         /* Devices that do not need bridging limits applied */
         { "MTRON MSP-SATA*",            NULL,   ATA_HORKAGE_BRIDGE_OK, },
 
+        /* Devices which aren't very happy with higher link speeds */
+        { "WD My Book",                 NULL,   ATA_HORKAGE_1_5_GBPS, },
+
         /* End Marker */
         { }
 };
@@ -4709,8 +4758,7 @@ void swap_buf_le16(u16 *buf, unsigned int buf_words)
 
 /**
  *      ata_qc_new - Request an available ATA command, for queueing
- *      @ap: Port associated with device @dev
- *      @dev: Device from whom we request an available command structure
+ *      @ap: target port
  *
  *      LOCKING:
  *      None.
@@ -5175,7 +5223,7 @@ bool ata_phys_link_online(struct ata_link *link)
         u32 sstatus;
 
         if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
-            (sstatus & 0xf) == 0x3)
+            ata_sstatus_online(sstatus))
                 return true;
         return false;
 }
@@ -5199,7 +5247,7 @@ bool ata_phys_link_offline(struct ata_link *link)
         u32 sstatus;
 
         if (sata_scr_read(link, SCR_STATUS, &sstatus) == 0 &&
-            (sstatus & 0xf) != 0x3)
+            !ata_sstatus_online(sstatus))
                 return true;
         return false;
 }
@@ -5412,8 +5460,8 @@ void ata_dev_init(struct ata_device *dev)
         dev->horkage = 0;
         spin_unlock_irqrestore(ap->lock, flags);
 
-        memset((void *)dev + ATA_DEVICE_CLEAR_OFFSET, 0,
-               sizeof(*dev) - ATA_DEVICE_CLEAR_OFFSET);
+        memset((void *)dev + ATA_DEVICE_CLEAR_BEGIN, 0,
+               ATA_DEVICE_CLEAR_END - ATA_DEVICE_CLEAR_BEGIN);
         dev->pio_mask = UINT_MAX;
         dev->mwdma_mask = UINT_MAX;
         dev->udma_mask = UINT_MAX;
diff --git a/drivers/ata/libata-eh.c b/drivers/ata/libata-eh.c
index 8147a838637..ce2ef047533 100644
--- a/drivers/ata/libata-eh.c
+++ b/drivers/ata/libata-eh.c
@@ -82,6 +82,10 @@ enum {
         ATA_EH_FASTDRAIN_INTERVAL       =  3000,
 
         ATA_EH_UA_TRIES                 = 5,
+
+        /* probe speed down parameters, see ata_eh_schedule_probe() */
+        ATA_EH_PROBE_TRIAL_INTERVAL     = 60000,        /* 1 min */
+        ATA_EH_PROBE_TRIALS             = 2,
 };
 
 /* The following table determines how we sequence resets.  Each entry
@@ -1176,6 +1180,32 @@ void ata_eh_qc_retry(struct ata_queued_cmd *qc)
 }
 
 /**
+ *      ata_dev_disable - disable ATA device
+ *      @dev: ATA device to disable
+ *
+ *      Disable @dev.
+ *
+ *      Locking:
+ *      EH context.
+ */
+void ata_dev_disable(struct ata_device *dev)
+{
+        if (!ata_dev_enabled(dev))
+                return;
+
+        if (ata_msg_drv(dev->link->ap))
+                ata_dev_printk(dev, KERN_WARNING, "disabled\n");
+        ata_acpi_on_disable(dev);
+        ata_down_xfermask_limit(dev, ATA_DNXFER_FORCE_PIO0 | ATA_DNXFER_QUIET);
+        dev->class++;
+
+        /* From now till the next successful probe, ering is used to
+         * track probe failures.  Clear accumulated device error info.
+         */
+        ata_ering_clear(&dev->ering);
+}
+
+/**
  *      ata_eh_detach_dev - detach ATA device
  *      @dev: ATA device to detach
  *
@@ -1849,7 +1879,7 @@ static unsigned int ata_eh_speed_down(struct ata_device *dev,
         /* speed down? */
         if (verdict & ATA_EH_SPDN_SPEED_DOWN) {
                 /* speed down SATA link speed if possible */
-                if (sata_down_spd_limit(link) == 0) {
+                if (sata_down_spd_limit(link, 0) == 0) {
                         action |= ATA_EH_RESET;
                         goto done;
                 }
@@ -2601,11 +2631,11 @@ int ata_eh_reset(struct ata_link *link, int classify,
         }
 
         if (try == max_tries - 1) {
-                sata_down_spd_limit(link);
+                sata_down_spd_limit(link, 0);
                 if (slave)
-                        sata_down_spd_limit(slave);
+                        sata_down_spd_limit(slave, 0);
         } else if (rc == -EPIPE)
-                sata_down_spd_limit(failed_link);
+                sata_down_spd_limit(failed_link, 0);
 
         if (hardreset)
                 reset = hardreset;
@@ -2744,6 +2774,8 @@ static int ata_eh_revalidate_and_attach(struct ata_link *link,
                                                      readid_flags, dev->id);
                         switch (rc) {
                         case 0:
+                                /* clear error info accumulated during probe */
+                                ata_ering_clear(&dev->ering);
                                 new_mask |= 1 << dev->devno;
                                 break;
                         case -ENOENT:
@@ -2947,9 +2979,24 @@ static int ata_eh_skip_recovery(struct ata_link *link)
         return 1;
 }
 
+static int ata_count_probe_trials_cb(struct ata_ering_entry *ent, void *void_arg)
+{
+        u64 interval = msecs_to_jiffies(ATA_EH_PROBE_TRIAL_INTERVAL);
+        u64 now = get_jiffies_64();
+        int *trials = void_arg;
+
+        if (ent->timestamp < now - min(now, interval))
+                return -1;
+
+        (*trials)++;
+        return 0;
+}
+
 static int ata_eh_schedule_probe(struct ata_device *dev)
 {
         struct ata_eh_context *ehc = &dev->link->eh_context;
+        struct ata_link *link = ata_dev_phys_link(dev);
+        int trials = 0;
 
         if (!(ehc->i.probe_mask & (1 << dev->devno)) ||
             (ehc->did_probe_mask & (1 << dev->devno)))
@@ -2962,6 +3009,25 @@ static int ata_eh_schedule_probe(struct ata_device *dev)
         ehc->saved_xfer_mode[dev->devno] = 0;
         ehc->saved_ncq_enabled &= ~(1 << dev->devno);
 
+        /* Record and count probe trials on the ering.  The specific
+         * error mask used is irrelevant.  Because a successful device
+         * detection clears the ering, this count accumulates only if
+         * there are consecutive failed probes.
+         *
+         * If the count is equal to or higher than ATA_EH_PROBE_TRIALS
+         * in the last ATA_EH_PROBE_TRIAL_INTERVAL, link speed is
+         * forced to 1.5Gbps.
+         *
+         * This is to work around cases where failed link speed
+         * negotiation results in device misdetection leading to
+         * infinite DEVXCHG or PHRDY CHG events.
+         */
+        ata_ering_record(&dev->ering, 0, AC_ERR_OTHER);
+        ata_ering_map(&dev->ering, ata_count_probe_trials_cb, &trials);
+
+        if (trials > ATA_EH_PROBE_TRIALS)
+                sata_down_spd_limit(link, 1);
+
         return 1;
 }
 
@@ -2969,7 +3035,11 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
 {
         struct ata_eh_context *ehc = &dev->link->eh_context;
 
-        ehc->tries[dev->devno]--;
+        /* -EAGAIN from EH routine indicates retry without prejudice.
+         * The requester is responsible for ensuring forward progress.
+         */
+        if (err != -EAGAIN)
+                ehc->tries[dev->devno]--;
 
         switch (err) {
         case -ENODEV:
@@ -2979,12 +3049,13 @@ static int ata_eh_handle_dev_fail(struct ata_device *dev, int err)
                 /* give it just one more chance */
                 ehc->tries[dev->devno] = min(ehc->tries[dev->devno], 1);
         case -EIO:
-                if (ehc->tries[dev->devno] == 1 && dev->pio_mode > XFER_PIO_0) {
+                if (ehc->tries[dev->devno] == 1) {
                         /* This is the last chance, better to slow
                          * down than lose it.
                          */
-                        sata_down_spd_limit(ata_dev_phys_link(dev));
-                        ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
+                        sata_down_spd_limit(ata_dev_phys_link(dev), 0);
+                        if (dev->pio_mode > XFER_PIO_0)
+                                ata_down_xfermask_limit(dev, ATA_DNXFER_PIO);
                 }
         }
 
diff --git a/drivers/ata/libata-pmp.c b/drivers/ata/libata-pmp.c
index 98ca07a2db8..619f2c33950 100644
--- a/drivers/ata/libata-pmp.c
+++ b/drivers/ata/libata-pmp.c
@@ -729,7 +729,7 @@ static int sata_pmp_eh_recover_pmp(struct ata_port *ap,
                 if (tries) {
                         /* consecutive revalidation failures? speed down */
                         if (reval_failed)
-                                sata_down_spd_limit(link);
+                                sata_down_spd_limit(link, 0);
                         else
                                 reval_failed = 1;
 
diff --git a/drivers/ata/libata-scsi.c b/drivers/ata/libata-scsi.c
index 3c4c5ae277b..b9747fa59e5 100644
--- a/drivers/ata/libata-scsi.c
+++ b/drivers/ata/libata-scsi.c
@@ -415,6 +415,7 @@ int ata_std_bios_param(struct scsi_device *sdev, struct block_device *bdev,
 
 /**
  *      ata_get_identity - Handler for HDIO_GET_IDENTITY ioctl
+ *      @ap: target port
  *      @sdev: SCSI device to get identify data for
  *      @arg: User buffer area for identify data
  *
diff --git a/drivers/ata/libata.h b/drivers/ata/libata.h
index fe2839e5877..cea8014cd87 100644
--- a/drivers/ata/libata.h
+++ b/drivers/ata/libata.h
@@ -79,7 +79,6 @@ extern int ata_build_rw_tf(struct ata_taskfile *tf, struct ata_device *dev,
                            u64 block, u32 n_block, unsigned int tf_flags,
                            unsigned int tag);
 extern u64 ata_tf_read_block(struct ata_taskfile *tf, struct ata_device *dev);
-extern void ata_dev_disable(struct ata_device *dev);
 extern void ata_pio_queue_task(struct ata_port *ap, void *data,
                                unsigned long delay);
 extern void ata_port_flush_task(struct ata_port *ap);
@@ -100,7 +99,7 @@ extern int ata_dev_reread_id(struct ata_device *dev, unsigned int readid_flags);
 extern int ata_dev_revalidate(struct ata_device *dev, unsigned int new_class,
                               unsigned int readid_flags);
 extern int ata_dev_configure(struct ata_device *dev);
-extern int sata_down_spd_limit(struct ata_link *link);
+extern int sata_down_spd_limit(struct ata_link *link, u32 spd_limit);
 extern int ata_down_xfermask_limit(struct ata_device *dev, unsigned int sel);
 extern void ata_sg_clean(struct ata_queued_cmd *qc);
 extern void ata_qc_free(struct ata_queued_cmd *qc);
@@ -160,6 +159,7 @@ extern void ata_scsi_error(struct Scsi_Host *host);
 extern void ata_port_wait_eh(struct ata_port *ap);
 extern void ata_eh_fastdrain_timerfn(unsigned long arg);
 extern void ata_qc_schedule_eh(struct ata_queued_cmd *qc);
+extern void ata_dev_disable(struct ata_device *dev);
 extern void ata_eh_detach_dev(struct ata_device *dev);
 extern void ata_eh_about_to_do(struct ata_link *link, struct ata_device *dev,
                                unsigned int action);
diff --git a/drivers/ata/pata_qdi.c b/drivers/ata/pata_qdi.c
index 3080f371222..f1b26f7c8e4 100644
--- a/drivers/ata/pata_qdi.c
+++ b/drivers/ata/pata_qdi.c
@@ -12,7 +12,7 @@
  *
  * Probe code based on drivers/ide/legacy/qd65xx.c
  * Rewritten from the work of Colten Edwards <pje120@cs.usask.ca> by
- * Samuel Thibault <samuel.thibault@fnac.net>
+ * Samuel Thibault <samuel.thibault@ens-lyon.org>
  */
 
 #include <linux/kernel.h>
diff --git a/drivers/ata/sata_mv.c b/drivers/ata/sata_mv.c
index f2d8a020ea5..4ae1a4138b4 100644
--- a/drivers/ata/sata_mv.c
+++ b/drivers/ata/sata_mv.c
@@ -663,8 +663,8 @@ static const struct pci_device_id mv_pci_tbl[] = {
         { PCI_VDEVICE(MARVELL, 0x5081), chip_508x },
         /* RocketRAID 1720/174x have different identifiers */
         { PCI_VDEVICE(TTI, 0x1720), chip_6042 },
-        { PCI_VDEVICE(TTI, 0x1740), chip_508x },
-        { PCI_VDEVICE(TTI, 0x1742), chip_508x },
+        { PCI_VDEVICE(TTI, 0x1740), chip_6042 },
+        { PCI_VDEVICE(TTI, 0x1742), chip_6042 },
 
         { PCI_VDEVICE(MARVELL, 0x6040), chip_604x },
         { PCI_VDEVICE(MARVELL, 0x6041), chip_604x },
diff --git a/drivers/ata/sata_nv.c b/drivers/ata/sata_nv.c
index c49ad0e61b6..444af0415ca 100644
--- a/drivers/ata/sata_nv.c
+++ b/drivers/ata/sata_nv.c
@@ -436,11 +436,16 @@ static struct ata_port_operations nv_nf2_ops = {
         .hardreset              = nv_noclassify_hardreset,
 };
 
-/* CK804 finally gets hardreset right */
+/* For initial probing after boot and hot plugging, hardreset mostly
+ * works fine on CK804 but curiously, reprobing on the initial port by
+ * rescanning or rmmod/insmod fails to acquire the initial D2H Reg FIS
+ * in somewhat undeterministic way.  Use noclassify hardreset.
+ */
 static struct ata_port_operations nv_ck804_ops = {
         .inherits               = &nv_common_ops,
         .freeze                 = nv_ck804_freeze,
         .thaw                   = nv_ck804_thaw,
+        .hardreset              = nv_noclassify_hardreset,
         .host_stop              = nv_ck804_host_stop,
 };
 
diff --git a/drivers/ata/sata_sil.c b/drivers/ata/sata_sil.c
index 9f029595f45..d0091609e21 100644
--- a/drivers/ata/sata_sil.c
+++ b/drivers/ata/sata_sil.c
@@ -324,7 +324,7 @@ static void sil_fill_sg(struct ata_queued_cmd *qc)
 
                 prd->addr = cpu_to_le32(addr);
                 prd->flags_len = cpu_to_le32(sg_len);
-                VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", pi, addr, sg_len);
+                VPRINTK("PRD[%u] = (0x%X, 0x%X)\n", si, addr, sg_len);
 
                 last_prd = prd;
                 prd++;
diff --git a/drivers/atm/solos-pci.c b/drivers/atm/solos-pci.c
index 72fc0f799a6..89d7a6e94c9 100644
--- a/drivers/atm/solos-pci.c
+++ b/drivers/atm/solos-pci.c
@@ -685,6 +685,7 @@ static int fpga_probe(struct pci_dev *dev, const struct pci_device_id *id)
  out_release_regions:
         pci_release_regions(dev);
  out:
+        kfree(card);
         return err;
 }
 
diff --git a/drivers/base/cpu.c b/drivers/base/cpu.c
index 719ee5c1c8d..5b257a57bc5 100644
--- a/drivers/base/cpu.c
+++ b/drivers/base/cpu.c
@@ -107,7 +107,7 @@ static SYSDEV_ATTR(crash_notes, 0400, show_crash_notes, NULL);
 /*
  * Print cpu online, possible, present, and system maps
  */
-static ssize_t print_cpus_map(char *buf, cpumask_t *map)
+static ssize_t print_cpus_map(char *buf, const struct cpumask *map)
 {
         int n = cpulist_scnprintf(buf, PAGE_SIZE-2, map);
 
diff --git a/drivers/base/topology.c b/drivers/base/topology.c
index a778fb52b11..bf6b13206d0 100644
--- a/drivers/base/topology.c
+++ b/drivers/base/topology.c
@@ -31,7 +31,10 @@
 #include <linux/hardirq.h>
 #include <linux/topology.h>
 
-#define define_one_ro(_name)            \
+#define define_one_ro_named(_name, _func)                               \
+static SYSDEV_ATTR(_name, 0444, _func, NULL)
+
+#define define_one_ro(_name)                            \
 static SYSDEV_ATTR(_name, 0444, show_##_name, NULL)
 
 #define define_id_show_func(name)                               \
@@ -42,8 +45,8 @@ static ssize_t show_##name(struct sys_device *dev,		\
         return sprintf(buf, "%d\n", topology_##name(cpu));      \
 }
 
-#if defined(topology_thread_siblings) || defined(topology_core_siblings)
-static ssize_t show_cpumap(int type, cpumask_t *mask, char *buf)
+#if defined(topology_thread_cpumask) || defined(topology_core_cpumask)
+static ssize_t show_cpumap(int type, const struct cpumask *mask, char *buf)
 {
         ptrdiff_t len = PTR_ALIGN(buf + PAGE_SIZE - 1, PAGE_SIZE) - buf;
         int n = 0;
@@ -65,7 +68,7 @@ static ssize_t show_##name(struct sys_device *dev,			\
                            struct sysdev_attribute *attr, char *buf)    \
 {                                                                       \
         unsigned int cpu = dev->id;                                     \
-        return show_cpumap(0, &(topology_##name(cpu)), buf);            \
+        return show_cpumap(0, topology_##name(cpu), buf);               \
 }
 
 #define define_siblings_show_list(name)                                 \
@@ -74,7 +77,7 @@ static ssize_t show_##name##_list(struct sys_device *dev,		\
                                   char *buf)                            \
 {                                                                       \
         unsigned int cpu = dev->id;                                     \
-        return show_cpumap(1, &(topology_##name(cpu)), buf);            \
+        return show_cpumap(1, topology_##name(cpu), buf);               \
 }
 
 #else
@@ -82,9 +85,7 @@ static ssize_t show_##name##_list(struct sys_device *dev,		\
 static ssize_t show_##name(struct sys_device *dev,                      \
                            struct sysdev_attribute *attr, char *buf)    \
 {                                                                       \
-        unsigned int cpu = dev->id;                                     \
-        cpumask_t mask = topology_##name(cpu);                          \
-        return show_cpumap(0, &mask, buf);                              \
+        return show_cpumap(0, topology_##name(dev->id), buf);           \
 }
 
 #define define_siblings_show_list(name)                                 \
@@ -92,9 +93,7 @@ static ssize_t show_##name##_list(struct sys_device *dev,		\
                                   struct sysdev_attribute *attr,        \
                                   char *buf)                            \
 {                                                                       \
-        unsigned int cpu = dev->id;                                     \
-        cpumask_t mask = topology_##name(cpu);                          \
-        return show_cpumap(1, &mask, buf);                              \
+        return show_cpumap(1, topology_##name(dev->id), buf);           \
 }
 #endif
 
@@ -107,13 +106,13 @@ define_one_ro(physical_package_id);
 define_id_show_func(core_id);
 define_one_ro(core_id);
 
-define_siblings_show_func(thread_siblings);
-define_one_ro(thread_siblings);
-define_one_ro(thread_siblings_list);
+define_siblings_show_func(thread_cpumask);
+define_one_ro_named(thread_siblings, show_thread_cpumask);
+define_one_ro_named(thread_siblings_list, show_thread_cpumask_list);
 
-define_siblings_show_func(core_siblings);
-define_one_ro(core_siblings);
-define_one_ro(core_siblings_list);
+define_siblings_show_func(core_cpumask);
+define_one_ro_named(core_siblings, show_core_cpumask);
+define_one_ro_named(core_siblings_list, show_core_cpumask_list);
 
 static struct attribute *default_attrs[] = {
         &attr_physical_package_id.attr,
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
index 34f80fa6fed..8299e2d3b61 100644
--- a/drivers/block/nbd.c
+++ b/drivers/block/nbd.c
@@ -549,6 +549,15 @@ static void do_nbd_request(struct request_queue * q)
 
                 BUG_ON(lo->magic != LO_MAGIC);
 
+                if (unlikely(!lo->sock)) {
+                        printk(KERN_ERR "%s: Attempted send on closed socket\n",
+                                lo->disk->disk_name);
+                        req->errors++;
+                        nbd_end_request(req);
+                        spin_lock_irq(q->queue_lock);
+                        continue;
+                }
+
                 spin_lock_irq(&lo->queue_lock);
                 list_add_tail(&req->queuelist, &lo->waiting_queue);
                 spin_unlock_irq(&lo->queue_lock);
diff --git a/drivers/char/Kconfig b/drivers/char/Kconfig
index f5be8081cd8..735bbe2be51 100644
--- a/drivers/char/Kconfig
+++ b/drivers/char/Kconfig
@@ -761,7 +761,7 @@ source "drivers/char/hw_random/Kconfig"
 
 config NVRAM
         tristate "/dev/nvram support"
-        depends on ATARI || X86 || ARM || GENERIC_NVRAM
+        depends on ATARI || X86 || (ARM && RTC_DRV_CMOS) || GENERIC_NVRAM
         ---help---
           If you say Y here and create a character special file /dev/nvram
           with major number 10 and minor number 144 using mknod ("man mknod"),
diff --git a/drivers/char/selection.c b/drivers/char/selection.c
index f29fbe9b8ed..cb8ca569896 100644
--- a/drivers/char/selection.c
+++ b/drivers/char/selection.c
@@ -268,7 +268,7 @@ int set_selection(const struct tiocl_selection __user *sel, struct tty_struct *t
 
         /* Allocate a new buffer before freeing the old one ... */
         multiplier = use_unicode ? 3 : 1;  /* chars can take up to 3 bytes */
-        bp = kmalloc((sel_end-sel_start)/2*multiplier+1, GFP_KERNEL);
+        bp = kmalloc(((sel_end-sel_start)/2+1)*multiplier, GFP_KERNEL);
         if (!bp) {
                 printk(KERN_WARNING "selection: kmalloc() failed\n");
                 clear_selection();
diff --git a/drivers/char/sx.c b/drivers/char/sx.c
index b60be7b0dec..f146e90404f 100644
--- a/drivers/char/sx.c
+++ b/drivers/char/sx.c
@@ -1713,8 +1713,8 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 for (i = 0; i < SX_NBOARDS; i++)
                         sx_dprintk(SX_DEBUG_FIRMWARE, "<%x> ", boards[i].flags);
                 sx_dprintk(SX_DEBUG_FIRMWARE, "\n");
-                unlock_kernel();
-                return -EIO;
+                rc = -EIO;
+                goto out;
         }
 
         switch (cmd) {
@@ -1747,7 +1747,8 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 break;
         case SXIO_DO_RAMTEST:
                 if (sx_initialized)     /* Already initialized: better not ramtest the board.  */
-                        return -EPERM;
+                        rc = -EPERM;
+                        break;
                 if (IS_SX_BOARD(board)) {
                         rc = do_memtest(board, 0, 0x7000);
                         if (!rc)
@@ -1844,6 +1845,7 @@ static long sx_fw_ioctl(struct file *filp, unsigned int cmd,
                 rc = -ENOTTY;
                 break;
         }
+out:
         unlock_kernel();
         func_exit();
         return rc;
diff --git a/drivers/char/tpm/tpm_infineon.c b/drivers/char/tpm/tpm_infineon.c
index 726ee8a0277..ecba4942fc8 100644
--- a/drivers/char/tpm/tpm_infineon.c
+++ b/drivers/char/tpm/tpm_infineon.c
@@ -4,7 +4,7 @@
  * SLD 9630 TT 1.1 and SLB 9635 TT 1.2 Trusted Platform Module
  * Specifications at www.trustedcomputinggroup.org
  *
- * Copyright (C) 2005, Marcel Selhorst <selhorst@crypto.rub.de>
+ * Copyright (C) 2005, Marcel Selhorst <m.selhorst@sirrix.com>
  * Sirrix AG - security technologies, http://www.sirrix.com and
  * Applied Data Security Group, Ruhr-University Bochum, Germany
  * Project-Homepage: http://www.prosec.rub.de/tpm
@@ -636,7 +636,7 @@ static void __exit cleanup_inf(void)
 module_init(init_inf);
 module_exit(cleanup_inf);
 
-MODULE_AUTHOR("Marcel Selhorst <selhorst@crypto.rub.de>");
+MODULE_AUTHOR("Marcel Selhorst <m.selhorst@sirrix.com>");
 MODULE_DESCRIPTION("Driver for Infineon TPM SLD 9630 TT 1.1 / SLB 9635 TT 1.2");
 MODULE_VERSION("1.9");
 MODULE_LICENSE("GPL");
diff --git a/drivers/clocksource/acpi_pm.c b/drivers/clocksource/acpi_pm.c
index e1129fad96d..ee19b6e8fcb 100644
--- a/drivers/clocksource/acpi_pm.c
+++ b/drivers/clocksource/acpi_pm.c
@@ -143,7 +143,7 @@ DECLARE_PCI_FIXUP_EARLY(PCI_VENDOR_ID_SERVERWORKS, PCI_DEVICE_ID_SERVERWORKS_LE,
 #endif
 
 #ifndef CONFIG_X86_64
-#include "mach_timer.h"
+#include <asm/mach_timer.h>
 #define PMTMR_EXPECTED_RATE \
   ((CALIBRATE_LATCH * (PMTMR_TICKS_PER_SEC >> 10)) / (CLOCK_TICK_RATE>>10))
 /*
diff --git a/drivers/clocksource/cyclone.c b/drivers/clocksource/cyclone.c
index 1bde303b970..8615059a872 100644
--- a/drivers/clocksource/cyclone.c
+++ b/drivers/clocksource/cyclone.c
@@ -7,7 +7,7 @@
 #include <asm/pgtable.h>
 #include <asm/io.h>
 
-#include "mach_timer.h"
+#include <asm/mach_timer.h>
 
 #define CYCLONE_CBAR_ADDR       0xFEB00CD0      /* base address ptr */
 #define CYCLONE_PMCC_OFFSET     0x51A0          /* offset to control register */
diff --git a/drivers/cpufreq/cpufreq_ondemand.c b/drivers/cpufreq/cpufreq_ondemand.c
index 6a2b036c938..6f45b1658a6 100644
--- a/drivers/cpufreq/cpufreq_ondemand.c
+++ b/drivers/cpufreq/cpufreq_ondemand.c
@@ -117,11 +117,7 @@ static inline cputime64_t get_cpu_idle_time_jiffy(unsigned int cpu,
         busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.irq);
         busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.softirq);
         busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.steal);
-
-        if (!dbs_tuners_ins.ignore_nice) {
-                busy_time = cputime64_add(busy_time,
-                                kstat_cpu(cpu).cpustat.nice);
-        }
+        busy_time = cputime64_add(busy_time, kstat_cpu(cpu).cpustat.nice);
 
         idle_time = cputime64_sub(cur_wall_time, busy_time);
         if (wall)
@@ -137,23 +133,6 @@ static inline cputime64_t get_cpu_idle_time(unsigned int cpu, cputime64_t *wall)
         if (idle_time == -1ULL)
                 return get_cpu_idle_time_jiffy(cpu, wall);
 
-        if (dbs_tuners_ins.ignore_nice) {
-                cputime64_t cur_nice;
-                unsigned long cur_nice_jiffies;
-                struct cpu_dbs_info_s *dbs_info;
-
-                dbs_info = &per_cpu(cpu_dbs_info, cpu);
-                cur_nice = cputime64_sub(kstat_cpu(cpu).cpustat.nice,
-                                         dbs_info->prev_cpu_nice);
-                /*
-                 * Assumption: nice time between sampling periods will be
-                 * less than 2^32 jiffies for 32 bit sys
-                 */
-                cur_nice_jiffies = (unsigned long)
-                                        cputime64_to_jiffies64(cur_nice);
-                dbs_info->prev_cpu_nice = kstat_cpu(cpu).cpustat.nice;
-                return idle_time + jiffies_to_usecs(cur_nice_jiffies);
-        }
         return idle_time;
 }
 
@@ -319,6 +298,9 @@ static ssize_t store_ignore_nice_load(struct cpufreq_policy *policy,
                 dbs_info = &per_cpu(cpu_dbs_info, j);
                 dbs_info->prev_cpu_idle = get_cpu_idle_time(j,
                                                 &dbs_info->prev_cpu_wall);
+                if (dbs_tuners_ins.ignore_nice)
+                        dbs_info->prev_cpu_nice = kstat_cpu(j).cpustat.nice;
+
         }
         mutex_unlock(&dbs_mutex);
 
@@ -419,6 +401,23 @@ static void dbs_check_cpu(struct cpu_dbs_info_s *this_dbs_info)
                                 j_dbs_info->prev_cpu_idle);
                 j_dbs_info->prev_cpu_idle = cur_idle_time;
 
+                if (dbs_tuners_ins.ignore_nice) {
+                        cputime64_t cur_nice;
+                        unsigned long cur_nice_jiffies;
+
+                        cur_nice = cputime64_sub(kstat_cpu(j).cpustat.nice,
+                                         j_dbs_info->prev_cpu_nice);
+                        /*
+                         * Assumption: nice time between sampling periods will
+                         * be less than 2^32 jiffies for 32 bit sys
+                         */
+                        cur_nice_jiffies = (unsigned long)
+                                        cputime64_to_jiffies64(cur_nice);
+
+                        j_dbs_info->prev_cpu_nice = kstat_cpu(j).cpustat.nice;
+                        idle_time += jiffies_to_usecs(cur_nice_jiffies);
+                }
+
                 if (unlikely(!wall_time || wall_time < idle_time))
                         continue;
 
@@ -575,6 +574,10 @@ static int cpufreq_governor_dbs(struct cpufreq_policy *policy,
 
                         j_dbs_info->prev_cpu_idle = get_cpu_idle_time(j,
                                                 &j_dbs_info->prev_cpu_wall);
+                        if (dbs_tuners_ins.ignore_nice) {
+                                j_dbs_info->prev_cpu_nice =
+                                                kstat_cpu(j).cpustat.nice;
+                        }
                 }
                 this_dbs_info->cpu = cpu;
                 /*
diff --git a/drivers/dca/dca-core.c b/drivers/dca/dca-core.c
index 55433849bfa..33bd7534751 100644
--- a/drivers/dca/dca-core.c
+++ b/drivers/dca/dca-core.c
@@ -28,7 +28,7 @@
 #include <linux/device.h>
 #include <linux/dca.h>
 
-#define DCA_VERSION "1.4"
+#define DCA_VERSION "1.8"
 
 MODULE_VERSION(DCA_VERSION);
 MODULE_LICENSE("GPL");
@@ -60,16 +60,17 @@ int dca_add_requester(struct device *dev)
 {
         struct dca_provider *dca;
         int err, slot = -ENODEV;
+        unsigned long flags;
 
         if (!dev)
                 return -EFAULT;
 
-        spin_lock(&dca_lock);
+        spin_lock_irqsave(&dca_lock, flags);
 
         /* check if the requester has not been added already */
         dca = dca_find_provider_by_dev(dev);
         if (dca) {
-                spin_unlock(&dca_lock);
+                spin_unlock_irqrestore(&dca_lock, flags);
                 return -EEXIST;
         }
 
@@ -78,19 +79,21 @@ int dca_add_requester(struct device *dev)
                 if (slot >= 0)
                         break;
         }
-        if (slot < 0) {
-                spin_unlock(&dca_lock);
+
+        spin_unlock_irqrestore(&dca_lock, flags);
+
+        if (slot < 0)
                 return slot;
-        }
 
         err = dca_sysfs_add_req(dca, dev, slot);
         if (err) {
-                dca->ops->remove_requester(dca, dev);
-                spin_unlock(&dca_lock);
+                spin_lock_irqsave(&dca_lock, flags);
+                if (dca == dca_find_provider_by_dev(dev))
+                        dca->ops->remove_requester(dca, dev);
+                spin_unlock_irqrestore(&dca_lock, flags);
                 return err;
         }
 
-        spin_unlock(&dca_lock);
         return 0;
 }
 EXPORT_SYMBOL_GPL(dca_add_requester);
@@ -103,25 +106,25 @@ int dca_remove_requester(struct device *dev)
 {
         struct dca_provider *dca;
         int slot;
+        unsigned long flags;
 
         if (!dev)
                 return -EFAULT;
 
-        spin_lock(&dca_lock);
+        spin_lock_irqsave(&dca_lock, flags);
         dca = dca_find_provider_by_dev(dev);
         if (!dca) {
-                spin_unlock(&dca_lock);
+                spin_unlock_irqrestore(&dca_lock, flags);
                 return -ENODEV;
         }
         slot = dca->ops->remove_requester(dca, dev);
-        if (slot < 0) {
-                spin_unlock(&dca_lock);
+        spin_unlock_irqrestore(&dca_lock, flags);
+
+        if (slot < 0)
                 return slot;
-        }
 
         dca_sysfs_remove_req(dca, slot);
 
-        spin_unlock(&dca_lock);
         return 0;
 }
 EXPORT_SYMBOL_GPL(dca_remove_requester);
@@ -135,17 +138,18 @@ u8 dca_common_get_tag(struct device *dev, int cpu)
 {
         struct dca_provider *dca;
         u8 tag;
+        unsigned long flags;
 
-        spin_lock(&dca_lock);
+        spin_lock_irqsave(&dca_lock, flags);
 
         dca = dca_find_provider_by_dev(dev);
         if (!dca) {
-                spin_unlock(&dca_lock);
+                spin_unlock_irqrestore(&dca_lock, flags);
                 return -ENODEV;
         }
         tag = dca->ops->get_tag(dca, dev, cpu);
 
-        spin_unlock(&dca_lock);
+        spin_unlock_irqrestore(&dca_lock, flags);
         return tag;
 }
 
@@ -217,11 +221,16 @@ static BLOCKING_NOTIFIER_HEAD(dca_provider_chain);
 int register_dca_provider(struct dca_provider *dca, struct device *dev)
 {
         int err;
+        unsigned long flags;
 
         err = dca_sysfs_add_provider(dca, dev);
         if (err)
                 return err;
+
+        spin_lock_irqsave(&dca_lock, flags);
         list_add(&dca->node, &dca_providers);
+        spin_unlock_irqrestore(&dca_lock, flags);
+
         blocking_notifier_call_chain(&dca_provider_chain,
                                      DCA_PROVIDER_ADD, NULL);
         return 0;
@@ -234,9 +243,15 @@ EXPORT_SYMBOL_GPL(register_dca_provider);
  */
 void unregister_dca_provider(struct dca_provider *dca)
 {
+        unsigned long flags;
+
         blocking_notifier_call_chain(&dca_provider_chain,
                                      DCA_PROVIDER_REMOVE, NULL);
+
+        spin_lock_irqsave(&dca_lock, flags);
         list_del(&dca->node);
+        spin_unlock_irqrestore(&dca_lock, flags);
+
         dca_sysfs_remove_provider(dca);
 }
 EXPORT_SYMBOL_GPL(unregister_dca_provider);
diff --git a/drivers/eisa/Kconfig b/drivers/eisa/Kconfig
index c0646576cf4..2705284f622 100644
--- a/drivers/eisa/Kconfig
+++ b/drivers/eisa/Kconfig
@@ -3,7 +3,7 @@
 #
 config EISA_VLB_PRIMING
         bool "Vesa Local Bus priming"
-        depends on X86_PC && EISA
+        depends on X86 && EISA
         default n
         ---help---
           Activate this option if your system contains a Vesa Local
@@ -24,11 +24,11 @@ config EISA_PCI_EISA
           When in doubt, say Y.
 
 # Using EISA_VIRTUAL_ROOT on something other than an Alpha or
-# an X86_PC may lead to crashes...
+# an X86 may lead to crashes...
 
 config EISA_VIRTUAL_ROOT
         bool "EISA virtual root device"
-        depends on EISA && (ALPHA || X86_PC)
+        depends on EISA && (ALPHA || X86)
         default y
         ---help---
           Activate this option if your system only have EISA bus
diff --git a/drivers/firewire/fw-card.c b/drivers/firewire/fw-card.c
index 7be2cf3514e..a5dd7a665aa 100644
--- a/drivers/firewire/fw-card.c
+++ b/drivers/firewire/fw-card.c
@@ -412,6 +412,7 @@ fw_card_add(struct fw_card *card,
 {
         u32 *config_rom;
         size_t length;
+        int err;
 
         card->max_receive = max_receive;
         card->link_speed = link_speed;
@@ -422,7 +423,13 @@ fw_card_add(struct fw_card *card,
         list_add_tail(&card->link, &card_list);
         mutex_unlock(&card_mutex);
 
-        return card->driver->enable(card, config_rom, length);
+        err = card->driver->enable(card, config_rom, length);
+        if (err < 0) {
+                mutex_lock(&card_mutex);
+                list_del(&card->link);
+                mutex_unlock(&card_mutex);
+        }
+        return err;
 }
 EXPORT_SYMBOL(fw_card_add);
 
diff --git a/drivers/firmware/dcdbas.c b/drivers/firmware/dcdbas.c
index 777fba48d2d..3009e0171e5 100644
--- a/drivers/firmware/dcdbas.c
+++ b/drivers/firmware/dcdbas.c
@@ -244,7 +244,7 @@ static ssize_t host_control_on_shutdown_store(struct device *dev,
  */
 int dcdbas_smi_request(struct smi_cmd *smi_cmd)
 {
-        cpumask_t old_mask;
+        cpumask_var_t old_mask;
         int ret = 0;
 
         if (smi_cmd->magic != SMI_CMD_MAGIC) {
@@ -254,8 +254,11 @@ int dcdbas_smi_request(struct smi_cmd *smi_cmd)
         }
 
         /* SMI requires CPU 0 */
-        old_mask = current->cpus_allowed;
-        set_cpus_allowed_ptr(current, &cpumask_of_cpu(0));
+        if (!alloc_cpumask_var(&old_mask, GFP_KERNEL))
+                return -ENOMEM;
+
+        cpumask_copy(old_mask, &current->cpus_allowed);
+        set_cpus_allowed_ptr(current, cpumask_of(0));
         if (smp_processor_id() != 0) {
                 dev_dbg(&dcdbas_pdev->dev, "%s: failed to get CPU 0\n",
                         __func__);
@@ -275,7 +278,8 @@ int dcdbas_smi_request(struct smi_cmd *smi_cmd)
         );
 
 out:
-        set_cpus_allowed_ptr(current, &old_mask);
+        set_cpus_allowed_ptr(current, old_mask);
+        free_cpumask_var(old_mask);
         return ret;
 }
 
diff --git a/drivers/firmware/iscsi_ibft.c b/drivers/firmware/iscsi_ibft.c
index 3ab3e4a41d6..7b7ddc2d51c 100644
--- a/drivers/firmware/iscsi_ibft.c
+++ b/drivers/firmware/iscsi_ibft.c
@@ -938,8 +938,8 @@ static int __init ibft_init(void)
                 return -ENOMEM;
 
         if (ibft_addr) {
-                printk(KERN_INFO "iBFT detected at 0x%lx.\n",
-                       virt_to_phys((void *)ibft_addr));
+                printk(KERN_INFO "iBFT detected at 0x%llx.\n",
+                       (u64)virt_to_phys((void *)ibft_addr));
 
                 rc = ibft_check_device();
                 if (rc)
diff --git a/drivers/gpu/drm/Kconfig b/drivers/gpu/drm/Kconfig
index 5130b72d593..4be3acbaaf9 100644
--- a/drivers/gpu/drm/Kconfig
+++ b/drivers/gpu/drm/Kconfig
@@ -70,7 +70,7 @@ config DRM_I915
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
         select FB_CFB_IMAGEBLIT
-        depends on FB
+        select FB
         tristate "i915 driver"
         help
           Choose this option if you have a system that has Intel 830M, 845G,
diff --git a/drivers/gpu/drm/drm_gem.c b/drivers/gpu/drm/drm_gem.c
index 9da58145287..6915fb82d0b 100644
--- a/drivers/gpu/drm/drm_gem.c
+++ b/drivers/gpu/drm/drm_gem.c
@@ -136,7 +136,7 @@ drm_gem_object_alloc(struct drm_device *dev, size_t size)
         obj = kcalloc(1, sizeof(*obj), GFP_KERNEL);
 
         obj->dev = dev;
-        obj->filp = shmem_file_setup("drm mm object", size, 0);
+        obj->filp = shmem_file_setup("drm mm object", size, VM_NORESERVE);
         if (IS_ERR(obj->filp)) {
                 kfree(obj);
                 return NULL;
diff --git a/drivers/gpu/drm/drm_irq.c b/drivers/gpu/drm/drm_irq.c
index 69aa0ab2840..3795dbc0f50 100644
--- a/drivers/gpu/drm/drm_irq.c
+++ b/drivers/gpu/drm/drm_irq.c
@@ -276,6 +276,7 @@ int drm_irq_uninstall(struct drm_device * dev)
         for (i = 0; i < dev->num_crtcs; i++) {
                 DRM_WAKEUP(&dev->vbl_queue[i]);
                 dev->vblank_enabled[i] = 0;
+                dev->last_vblank[i] = dev->driver->get_vblank_counter(dev, i);
         }
         spin_unlock_irqrestore(&dev->vbl_lock, irqflags);
 
diff --git a/drivers/gpu/drm/drm_memory.c b/drivers/gpu/drm/drm_memory.c
index 803bc9e7ce3..bcc869bc409 100644
--- a/drivers/gpu/drm/drm_memory.c
+++ b/drivers/gpu/drm/drm_memory.c
@@ -171,9 +171,14 @@ EXPORT_SYMBOL(drm_core_ioremap);
 
 void drm_core_ioremap_wc(struct drm_map *map, struct drm_device *dev)
 {
-        map->handle = ioremap_wc(map->offset, map->size);
+        if (drm_core_has_AGP(dev) &&
+            dev->agp && dev->agp->cant_use_aperture && map->type == _DRM_AGP)
+                map->handle = agp_remap(map->offset, map->size, dev);
+        else
+                map->handle = ioremap_wc(map->offset, map->size);
 }
 EXPORT_SYMBOL(drm_core_ioremap_wc);
+
 void drm_core_ioremapfree(struct drm_map *map, struct drm_device *dev)
 {
         if (!map->handle || !map->size)
diff --git a/drivers/gpu/drm/drm_proc.c b/drivers/gpu/drm/drm_proc.c
index 8df849f6683..b756f043a5f 100644
--- a/drivers/gpu/drm/drm_proc.c
+++ b/drivers/gpu/drm/drm_proc.c
@@ -678,9 +678,9 @@ static int drm__vma_info(char *buf, char **start, off_t offset, int request,
         *start = &buf[offset];
         *eof = 0;
 
-        DRM_PROC_PRINT("vma use count: %d, high_memory = %p, 0x%08lx\n",
+        DRM_PROC_PRINT("vma use count: %d, high_memory = %p, 0x%llx\n",
                        atomic_read(&dev->vma_count),
-                       high_memory, virt_to_phys(high_memory));
+                       high_memory, (u64)virt_to_phys(high_memory));
         list_for_each_entry(pt, &dev->vmalist, head) {
                 if (!(vma = pt->vma))
                         continue;
diff --git a/drivers/gpu/drm/i915/i915_dma.c b/drivers/gpu/drm/i915/i915_dma.c
index ee64b7301f6..81f1cff56fd 100644
--- a/drivers/gpu/drm/i915/i915_dma.c
+++ b/drivers/gpu/drm/i915/i915_dma.c
@@ -731,8 +731,11 @@ static int i915_getparam(struct drm_device *dev, void *data,
         case I915_PARAM_HAS_GEM:
                 value = dev_priv->has_gem;
                 break;
+        case I915_PARAM_NUM_FENCES_AVAIL:
+                value = dev_priv->num_fence_regs - dev_priv->fence_reg_start;
+                break;
         default:
-                DRM_ERROR("Unknown parameter %d\n", param->param);
+                DRM_DEBUG("Unknown parameter %d\n", param->param);
                 return -EINVAL;
         }
 
@@ -764,8 +767,15 @@ static int i915_setparam(struct drm_device *dev, void *data,
         case I915_SETPARAM_ALLOW_BATCHBUFFER:
                 dev_priv->allow_batchbuffer = param->value;
                 break;
+        case I915_SETPARAM_NUM_USED_FENCES:
+                if (param->value > dev_priv->num_fence_regs ||
+                    param->value < 0)
+                        return -EINVAL;
+                /* Userspace can use first N regs */
+                dev_priv->fence_reg_start = param->value;
+                break;
         default:
-                DRM_ERROR("unknown parameter %d\n", param->param);
+                DRM_DEBUG("unknown parameter %d\n", param->param);
                 return -EINVAL;
         }
 
@@ -966,10 +976,6 @@ static int i915_load_modeset_init(struct drm_device *dev)
         if (ret)
                 goto kfree_devname;
 
-        dev_priv->mm.gtt_mapping =
-                io_mapping_create_wc(dev->agp->base,
-                                     dev->agp->agp_info.aper_size * 1024*1024);
-
         /* Allow hardware batchbuffers unless told otherwise.
          */
         dev_priv->allow_batchbuffer = 1;
@@ -1081,6 +1087,23 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
                 goto free_priv;
         }
 
+        dev_priv->mm.gtt_mapping =
+                io_mapping_create_wc(dev->agp->base,
+                                     dev->agp->agp_info.aper_size * 1024*1024);
+        /* Set up a WC MTRR for non-PAT systems.  This is more common than
+         * one would think, because the kernel disables PAT on first
+         * generation Core chips because WC PAT gets overridden by a UC
+         * MTRR if present.  Even if a UC MTRR isn't present.
+         */
+        dev_priv->mm.gtt_mtrr = mtrr_add(dev->agp->base,
+                                         dev->agp->agp_info.aper_size *
+                                         1024 * 1024,
+                                         MTRR_TYPE_WRCOMB, 1);
+        if (dev_priv->mm.gtt_mtrr < 0) {
+                DRM_INFO("MTRR allocation failed\n.  Graphics "
+                         "performance may suffer.\n");
+        }
+
 #ifdef CONFIG_HIGHMEM64G
         /* don't enable GEM on PAE - needs agp + set_memory_* interface fixes */
         dev_priv->has_gem = 0;
@@ -1089,6 +1112,10 @@ int i915_driver_load(struct drm_device *dev, unsigned long flags)
         dev_priv->has_gem = 1;
 #endif
 
+        dev->driver->get_vblank_counter = i915_get_vblank_counter;
+        if (IS_GM45(dev))
+                dev->driver->get_vblank_counter = gm45_get_vblank_counter;
+
         i915_gem_load(dev);
 
         /* Init HWS */
@@ -1145,8 +1172,14 @@ int i915_driver_unload(struct drm_device *dev)
 {
         struct drm_i915_private *dev_priv = dev->dev_private;
 
+        io_mapping_free(dev_priv->mm.gtt_mapping);
+        if (dev_priv->mm.gtt_mtrr >= 0) {
+                mtrr_del(dev_priv->mm.gtt_mtrr, dev->agp->base,
+                         dev->agp->agp_info.aper_size * 1024 * 1024);
+                dev_priv->mm.gtt_mtrr = -1;
+        }
+
         if (drm_core_check_feature(dev, DRIVER_MODESET)) {
-                io_mapping_free(dev_priv->mm.gtt_mapping);
                 drm_irq_uninstall(dev);
         }
 
diff --git a/drivers/gpu/drm/i915/i915_drv.c b/drivers/gpu/drm/i915/i915_drv.c
index f8b3df0926c..aac12ee31a4 100644
--- a/drivers/gpu/drm/i915/i915_drv.c
+++ b/drivers/gpu/drm/i915/i915_drv.c
@@ -112,7 +112,6 @@ static struct drm_driver driver = {
         .suspend = i915_suspend,
         .resume = i915_resume,
         .device_is_agp = i915_driver_device_is_agp,
-        .get_vblank_counter = i915_get_vblank_counter,
         .enable_vblank = i915_enable_vblank,
         .disable_vblank = i915_disable_vblank,
         .irq_preinstall = i915_driver_irq_preinstall,
diff --git a/drivers/gpu/drm/i915/i915_drv.h b/drivers/gpu/drm/i915/i915_drv.h
index e1351825200..7325363164f 100644
--- a/drivers/gpu/drm/i915/i915_drv.h
+++ b/drivers/gpu/drm/i915/i915_drv.h
@@ -284,6 +284,7 @@ typedef struct drm_i915_private {
                 struct drm_mm gtt_space;
 
                 struct io_mapping *gtt_mapping;
+                int gtt_mtrr;
 
                 /**
                  * List of objects currently involved in rendering from the
@@ -534,6 +535,7 @@ extern int i915_vblank_pipe_get(struct drm_device *dev, void *data,
 extern int i915_enable_vblank(struct drm_device *dev, int crtc);
 extern void i915_disable_vblank(struct drm_device *dev, int crtc);
 extern u32 i915_get_vblank_counter(struct drm_device *dev, int crtc);
+extern u32 gm45_get_vblank_counter(struct drm_device *dev, int crtc);
 extern int i915_vblank_swap(struct drm_device *dev, void *data,
                             struct drm_file *file_priv);
 extern void i915_enable_irq(drm_i915_private_t *dev_priv, u32 mask);
@@ -601,6 +603,7 @@ int i915_gem_init_object(struct drm_gem_object *obj);
 void i915_gem_free_object(struct drm_gem_object *obj);
 int i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment);
 void i915_gem_object_unpin(struct drm_gem_object *obj);
+int i915_gem_object_unbind(struct drm_gem_object *obj);
 void i915_gem_lastclose(struct drm_device *dev);
 uint32_t i915_get_gem_seqno(struct drm_device *dev);
 void i915_gem_retire_requests(struct drm_device *dev);
@@ -784,6 +787,11 @@ extern int i915_wait_ring(struct drm_device * dev, int n, const char *caller);
                         IS_I945GM(dev) || IS_I965GM(dev) || IS_GM45(dev))
 
 #define I915_NEED_GFX_HWS(dev) (IS_G33(dev) || IS_GM45(dev) || IS_G4X(dev))
+/* With the 945 and later, Y tiling got adjusted so that it was 32 128-byte
+ * rows, which changed the alignment requirements and fence programming.
+ */
+#define HAS_128_BYTE_Y_TILING(dev) (IS_I9XX(dev) && !(IS_I915G(dev) || \
+                                                      IS_I915GM(dev)))
 #define SUPPORTS_INTEGRATED_HDMI(dev)   (IS_G4X(dev))
 
 #define PRIMARY_RINGBUFFER_SIZE         (128*1024)
diff --git a/drivers/gpu/drm/i915/i915_gem.c b/drivers/gpu/drm/i915/i915_gem.c
index debad5c04cc..81857665409 100644
--- a/drivers/gpu/drm/i915/i915_gem.c
+++ b/drivers/gpu/drm/i915/i915_gem.c
@@ -52,7 +52,7 @@ static void i915_gem_object_free_page_list(struct drm_gem_object *obj);
 static int i915_gem_object_wait_rendering(struct drm_gem_object *obj);
 static int i915_gem_object_bind_to_gtt(struct drm_gem_object *obj,
                                            unsigned alignment);
-static void i915_gem_object_get_fence_reg(struct drm_gem_object *obj);
+static int i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write);
 static void i915_gem_clear_fence_reg(struct drm_gem_object *obj);
 static int i915_gem_evict_something(struct drm_device *dev);
 static int i915_gem_phys_pwrite(struct drm_device *dev, struct drm_gem_object *obj,
@@ -567,6 +567,7 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
         pgoff_t page_offset;
         unsigned long pfn;
         int ret = 0;
+        bool write = !!(vmf->flags & FAULT_FLAG_WRITE);
 
         /* We don't use vmf->pgoff since that has the fake offset */
         page_offset = ((unsigned long)vmf->virtual_address - vma->vm_start) >>
@@ -585,8 +586,13 @@ int i915_gem_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
 
         /* Need a new fence register? */
         if (obj_priv->fence_reg == I915_FENCE_REG_NONE &&
-            obj_priv->tiling_mode != I915_TILING_NONE)
-                i915_gem_object_get_fence_reg(obj);
+            obj_priv->tiling_mode != I915_TILING_NONE) {
+                ret = i915_gem_object_get_fence_reg(obj, write);
+                if (ret) {
+                        mutex_unlock(&dev->struct_mutex);
+                        return VM_FAULT_SIGBUS;
+                }
+        }
 
         pfn = ((dev->agp->base + obj_priv->gtt_offset) >> PAGE_SHIFT) +
                 page_offset;
@@ -1211,7 +1217,7 @@ i915_gem_object_wait_rendering(struct drm_gem_object *obj)
 /**
  * Unbinds an object from the GTT aperture.
  */
-static int
+int
 i915_gem_object_unbind(struct drm_gem_object *obj)
 {
         struct drm_device *dev = obj->dev;
@@ -1445,21 +1451,26 @@ static void i915_write_fence_reg(struct drm_i915_fence_reg *reg)
         drm_i915_private_t *dev_priv = dev->dev_private;
         struct drm_i915_gem_object *obj_priv = obj->driver_private;
         int regnum = obj_priv->fence_reg;
+        int tile_width;
         uint32_t val;
         uint32_t pitch_val;
 
         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
             (obj_priv->gtt_offset & (obj->size - 1))) {
-                WARN(1, "%s: object not 1M or size aligned\n", __func__);
+                WARN(1, "%s: object 0x%08x not 1M or size (0x%zx) aligned\n",
+                     __func__, obj_priv->gtt_offset, obj->size);
                 return;
         }
 
-        if (obj_priv->tiling_mode == I915_TILING_Y && (IS_I945G(dev) ||
-                                                       IS_I945GM(dev) ||
-                                                       IS_G33(dev)))
-                pitch_val = (obj_priv->stride / 128) - 1;
+        if (obj_priv->tiling_mode == I915_TILING_Y &&
+            HAS_128_BYTE_Y_TILING(dev))
+                tile_width = 128;
         else
-                pitch_val = (obj_priv->stride / 512) - 1;
+                tile_width = 512;
+
+        /* Note: pitch better be a power of two tile widths */
+        pitch_val = obj_priv->stride / tile_width;
+        pitch_val = ffs(pitch_val) - 1;
 
         val = obj_priv->gtt_offset;
         if (obj_priv->tiling_mode == I915_TILING_Y)
@@ -1483,7 +1494,8 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
 
         if ((obj_priv->gtt_offset & ~I915_FENCE_START_MASK) ||
             (obj_priv->gtt_offset & (obj->size - 1))) {
-                WARN(1, "%s: object not 1M or size aligned\n", __func__);
+                WARN(1, "%s: object 0x%08x not 1M or size aligned\n",
+                     __func__, obj_priv->gtt_offset);
                 return;
         }
 
@@ -1503,6 +1515,7 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
 /**
  * i915_gem_object_get_fence_reg - set up a fence reg for an object
  * @obj: object to map through a fence reg
+ * @write: object is about to be written
  *
  * When mapping objects through the GTT, userspace wants to be able to write
  * to them without having to worry about swizzling if the object is tiled.
@@ -1513,8 +1526,8 @@ static void i830_write_fence_reg(struct drm_i915_fence_reg *reg)
  * It then sets up the reg based on the object's properties: address, pitch
  * and tiling format.
  */
-static void
-i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
+static int
+i915_gem_object_get_fence_reg(struct drm_gem_object *obj, bool write)
 {
         struct drm_device *dev = obj->dev;
         struct drm_i915_private *dev_priv = dev->dev_private;
@@ -1527,12 +1540,18 @@ i915_gem_object_get_fence_reg(struct drm_gem_object *obj)
                 WARN(1, "allocating a fence for non-tiled object?\n");
                 break;
         case I915_TILING_X:
-                WARN(obj_priv->stride & (512 - 1),
-                     "object is X tiled but has non-512B pitch\n");
+                if (!obj_priv->stride)
+                        return -EINVAL;
+                WARN((obj_priv->stride & (512 - 1)),
+                     "object 0x%08x is X tiled but has non-512B pitch\n",
+                     obj_priv->gtt_offset);
                 break;
         case I915_TILING_Y:
-                WARN(obj_priv->stride & (128 - 1),
-                     "object is Y tiled but has non-128B pitch\n");
+                if (!obj_priv->stride)
+                        return -EINVAL;
+                WARN((obj_priv->stride & (128 - 1)),
+                     "object 0x%08x is Y tiled but has non-128B pitch\n",
+                     obj_priv->gtt_offset);
                 break;
         }
 
@@ -1563,10 +1582,11 @@ try_again:
                  * objects to finish before trying again.
                  */
                 if (i == dev_priv->num_fence_regs) {
-                        ret = i915_gem_object_wait_rendering(reg->obj);
+                        ret = i915_gem_object_set_to_gtt_domain(reg->obj, 0);
                         if (ret) {
-                                WARN(ret, "wait_rendering failed: %d\n", ret);
-                                return;
+                                WARN(ret != -ERESTARTSYS,
+                                     "switch to GTT domain failed: %d\n", ret);
+                                return ret;
                         }
                         goto try_again;
                 }
@@ -1591,6 +1611,8 @@ try_again:
                 i915_write_fence_reg(reg);
         else
                 i830_write_fence_reg(reg);
+
+        return 0;
 }
 
 /**
@@ -1631,7 +1653,7 @@ i915_gem_object_bind_to_gtt(struct drm_gem_object *obj, unsigned alignment)
         if (dev_priv->mm.suspended)
                 return -EBUSY;
         if (alignment == 0)
-                alignment = PAGE_SIZE;
+                alignment = i915_gem_get_gtt_alignment(obj);
         if (alignment & (PAGE_SIZE - 1)) {
                 DRM_ERROR("Invalid object alignment requested %u\n", alignment);
                 return -EINVAL;
@@ -2652,6 +2674,14 @@ i915_gem_object_pin(struct drm_gem_object *obj, uint32_t alignment)
                                 DRM_ERROR("Failure to bind: %d", ret);
                         return ret;
                 }
+                /*
+                 * Pre-965 chips need a fence register set up in order to
+                 * properly handle tiled surfaces.
+                 */
+                if (!IS_I965G(dev) &&
+                    obj_priv->fence_reg == I915_FENCE_REG_NONE &&
+                    obj_priv->tiling_mode != I915_TILING_NONE)
+                        i915_gem_object_get_fence_reg(obj, true);
         }
         obj_priv->pin_count++;
 
@@ -3229,10 +3259,6 @@ i915_gem_entervt_ioctl(struct drm_device *dev, void *data,
                 dev_priv->mm.wedged = 0;
         }
 
-        dev_priv->mm.gtt_mapping = io_mapping_create_wc(dev->agp->base,
-                                                        dev->agp->agp_info.aper_size
-                                                        * 1024 * 1024);
-
         mutex_lock(&dev->struct_mutex);
         dev_priv->mm.suspended = 0;
 
@@ -3255,7 +3281,6 @@ int
 i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
                        struct drm_file *file_priv)
 {
-        drm_i915_private_t *dev_priv = dev->dev_private;
         int ret;
 
         if (drm_core_check_feature(dev, DRIVER_MODESET))
@@ -3264,7 +3289,6 @@ i915_gem_leavevt_ioctl(struct drm_device *dev, void *data,
         ret = i915_gem_idle(dev);
         drm_irq_uninstall(dev);
 
-        io_mapping_free(dev_priv->mm.gtt_mapping);
         return ret;
 }
 
@@ -3273,6 +3297,9 @@ i915_gem_lastclose(struct drm_device *dev)
 {
         int ret;
 
+        if (drm_core_check_feature(dev, DRIVER_MODESET))
+                return;
+
         ret = i915_gem_idle(dev);
         if (ret)
                 DRM_ERROR("failed to idle hardware: %d\n", ret);
@@ -3294,7 +3321,7 @@ i915_gem_load(struct drm_device *dev)
         /* Old X drivers will take 0-2 for front, back, depth buffers */
         dev_priv->fence_reg_start = 3;
 
-        if (IS_I965G(dev))
+        if (IS_I965G(dev) || IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev))
                 dev_priv->num_fence_regs = 16;
         else
                 dev_priv->num_fence_regs = 8;
diff --git a/drivers/gpu/drm/i915/i915_gem_tiling.c b/drivers/gpu/drm/i915/i915_gem_tiling.c
index 241f39b7f46..fa1685cba84 100644
--- a/drivers/gpu/drm/i915/i915_gem_tiling.c
+++ b/drivers/gpu/drm/i915/i915_gem_tiling.c
@@ -173,6 +173,73 @@ i915_gem_detect_bit_6_swizzle(struct drm_device *dev)
         dev_priv->mm.bit_6_swizzle_y = swizzle_y;
 }
 
+
+/**
+ * Returns the size of the fence for a tiled object of the given size.
+ */
+static int
+i915_get_fence_size(struct drm_device *dev, int size)
+{
+        int i;
+        int start;
+
+        if (IS_I965G(dev)) {
+                /* The 965 can have fences at any page boundary. */
+                return ALIGN(size, 4096);
+        } else {
+                /* Align the size to a power of two greater than the smallest
+                 * fence size.
+                 */
+                if (IS_I9XX(dev))
+                        start = 1024 * 1024;
+                else
+                        start = 512 * 1024;
+
+                for (i = start; i < size; i <<= 1)
+                        ;
+
+                return i;
+        }
+}
+
+/* Check pitch constriants for all chips & tiling formats */
+static bool
+i915_tiling_ok(struct drm_device *dev, int stride, int size, int tiling_mode)
+{
+        int tile_width;
+
+        /* Linear is always fine */
+        if (tiling_mode == I915_TILING_NONE)
+                return true;
+
+        if (tiling_mode == I915_TILING_Y && HAS_128_BYTE_Y_TILING(dev))
+                tile_width = 128;
+        else
+                tile_width = 512;
+
+        /* 965+ just needs multiples of tile width */
+        if (IS_I965G(dev)) {
+                if (stride & (tile_width - 1))
+                        return false;
+                return true;
+        }
+
+        /* Pre-965 needs power of two tile widths */
+        if (stride < tile_width)
+                return false;
+
+        if (stride & (stride - 1))
+                return false;
+
+        /* We don't handle the aperture area covered by the fence being bigger
+         * than the object size.
+         */
+        if (i915_get_fence_size(dev, size) != size)
+                return false;
+
+        return true;
+}
+
 /**
  * Sets the tiling mode of an object, returning the required swizzling of
  * bit 6 of addresses in the object.
@@ -191,6 +258,11 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                 return -EINVAL;
         obj_priv = obj->driver_private;
 
+        if (!i915_tiling_ok(dev, args->stride, obj->size, args->tiling_mode)) {
+                drm_gem_object_unreference(obj);
+                return -EINVAL;
+        }
+
         mutex_lock(&dev->struct_mutex);
 
         if (args->tiling_mode == I915_TILING_NONE) {
@@ -207,7 +279,24 @@ i915_gem_set_tiling(struct drm_device *dev, void *data,
                         args->swizzle_mode = I915_BIT_6_SWIZZLE_NONE;
                 }
         }
-        obj_priv->tiling_mode = args->tiling_mode;
+        if (args->tiling_mode != obj_priv->tiling_mode) {
+                int ret;
+
+                /* Unbind the object, as switching tiling means we're
+                 * switching the cache organization due to fencing, probably.
+                 */
+                ret = i915_gem_object_unbind(obj);
+                if (ret != 0) {
+                        WARN(ret != -ERESTARTSYS,
+                             "failed to unbind object for tiling switch");
+                        args->tiling_mode = obj_priv->tiling_mode;
+                        mutex_unlock(&dev->struct_mutex);
+                        drm_gem_object_unreference(obj);
+
+                        return ret;
+                }
+                obj_priv->tiling_mode = args->tiling_mode;
+        }
         obj_priv->stride = args->stride;
 
         mutex_unlock(&dev->struct_mutex);
diff --git a/drivers/gpu/drm/i915/i915_irq.c b/drivers/gpu/drm/i915/i915_irq.c
index 6290219de6c..548ff2c6643 100644
--- a/drivers/gpu/drm/i915/i915_irq.c
+++ b/drivers/gpu/drm/i915/i915_irq.c
@@ -174,6 +174,19 @@ u32 i915_get_vblank_counter(struct drm_device *dev, int pipe)
         return count;
 }
 
+u32 gm45_get_vblank_counter(struct drm_device *dev, int pipe)
+{
+        drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
+        int reg = pipe ? PIPEB_FRMCOUNT_GM45 : PIPEA_FRMCOUNT_GM45;
+
+        if (!i915_pipe_enabled(dev, pipe)) {
+                DRM_ERROR("trying to get vblank count for disabled pipe %d\n", pipe);
+                return 0;
+        }
+
+        return I915_READ(reg);
+}
+
 irqreturn_t i915_driver_irq_handler(DRM_IRQ_ARGS)
 {
         struct drm_device *dev = (struct drm_device *) arg;
diff --git a/drivers/gpu/drm/i915/i915_reg.h b/drivers/gpu/drm/i915/i915_reg.h
index 273162579e1..9d6539a868b 100644
--- a/drivers/gpu/drm/i915/i915_reg.h
+++ b/drivers/gpu/drm/i915/i915_reg.h
@@ -186,12 +186,12 @@
 #define FENCE_REG_830_0                 0x2000
 #define   I830_FENCE_START_MASK         0x07f80000
 #define   I830_FENCE_TILING_Y_SHIFT     12
-#define   I830_FENCE_SIZE_BITS(size)    ((get_order(size >> 19) - 1) << 8)
+#define   I830_FENCE_SIZE_BITS(size)    ((ffs((size) >> 19) - 1) << 8)
 #define   I830_FENCE_PITCH_SHIFT        4
 #define   I830_FENCE_REG_VALID          (1<<0)
 
 #define   I915_FENCE_START_MASK         0x0ff00000
-#define   I915_FENCE_SIZE_BITS(size)    ((get_order(size >> 20) - 1) << 8)
+#define   I915_FENCE_SIZE_BITS(size)    ((ffs((size) >> 20) - 1) << 8)
 
 #define FENCE_REG_965_0                 0x03000
 #define   I965_FENCE_PITCH_SHIFT        2
@@ -1371,6 +1371,9 @@
 #define   PIPE_FRAME_LOW_SHIFT    24
 #define   PIPE_PIXEL_MASK         0x00ffffff
 #define   PIPE_PIXEL_SHIFT        0
+/* GM45+ just has to be different */
+#define PIPEA_FRMCOUNT_GM45     0x70040
+#define PIPEA_FLIPCOUNT_GM45    0x70044
 
 /* Cursor A & B regs */
 #define CURACNTR                0x70080
@@ -1439,6 +1442,9 @@
 #define PIPEBSTAT               0x71024
 #define PIPEBFRAMEHIGH          0x71040
 #define PIPEBFRAMEPIXEL         0x71044
+#define PIPEB_FRMCOUNT_GM45     0x71040
+#define PIPEB_FLIPCOUNT_GM45    0x71044
+
 
 /* Display B control */
 #define DSPBCNTR                0x71180
diff --git a/drivers/gpu/drm/i915/intel_display.c b/drivers/gpu/drm/i915/intel_display.c
index 31c3732b7a6..bbdd72909a1 100644
--- a/drivers/gpu/drm/i915/intel_display.c
+++ b/drivers/gpu/drm/i915/intel_display.c
@@ -755,6 +755,8 @@ static void intel_crtc_mode_set(struct drm_crtc *crtc,
                 case INTEL_OUTPUT_SDVO:
                 case INTEL_OUTPUT_HDMI:
                         is_sdvo = true;
+                        if (intel_output->needs_tv_clock)
+                                is_tv = true;
                         break;
                 case INTEL_OUTPUT_DVO:
                         is_dvo = true;
@@ -1452,6 +1454,7 @@ static int intel_connector_clones(struct drm_device *dev, int type_mask)
 
 static void intel_setup_outputs(struct drm_device *dev)
 {
+        struct drm_i915_private *dev_priv = dev->dev_private;
         struct drm_connector *connector;
 
         intel_crt_init(dev);
@@ -1463,13 +1466,16 @@ static void intel_setup_outputs(struct drm_device *dev)
         if (IS_I9XX(dev)) {
                 int found;
 
-                found = intel_sdvo_init(dev, SDVOB);
-                if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
-                        intel_hdmi_init(dev, SDVOB);
-
-                found = intel_sdvo_init(dev, SDVOC);
-                if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
-                        intel_hdmi_init(dev, SDVOC);
+                if (I915_READ(SDVOB) & SDVO_DETECTED) {
+                        found = intel_sdvo_init(dev, SDVOB);
+                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+                                intel_hdmi_init(dev, SDVOB);
+                }
+                if (!IS_G4X(dev) || (I915_READ(SDVOB) & SDVO_DETECTED)) {
+                        found = intel_sdvo_init(dev, SDVOC);
+                        if (!found && SUPPORTS_INTEGRATED_HDMI(dev))
+                                intel_hdmi_init(dev, SDVOC);
+                }
         } else
                 intel_dvo_init(dev);
 
diff --git a/drivers/gpu/drm/i915/intel_drv.h b/drivers/gpu/drm/i915/intel_drv.h
index 8a4cc50c5b4..957daef8edf 100644
--- a/drivers/gpu/drm/i915/intel_drv.h
+++ b/drivers/gpu/drm/i915/intel_drv.h
@@ -82,6 +82,7 @@ struct intel_output {
         struct intel_i2c_chan *i2c_bus; /* for control functions */
         struct intel_i2c_chan *ddc_bus; /* for DDC only stuff */
         bool load_detect_temp;
+        bool needs_tv_clock;
         void *dev_priv;
 };
 
diff --git a/drivers/gpu/drm/i915/intel_lvds.c b/drivers/gpu/drm/i915/intel_lvds.c
index b36a5214d8d..6d4f9126535 100644
--- a/drivers/gpu/drm/i915/intel_lvds.c
+++ b/drivers/gpu/drm/i915/intel_lvds.c
@@ -27,6 +27,7 @@
  *      Jesse Barnes <jesse.barnes@intel.com>
  */
 
+#include <linux/dmi.h>
 #include <linux/i2c.h>
 #include "drmP.h"
 #include "drm.h"
@@ -311,10 +312,8 @@ static int intel_lvds_get_modes(struct drm_connector *connector)
         if (dev_priv->panel_fixed_mode != NULL) {
                 struct drm_display_mode *mode;
 
-                mutex_lock(&dev->mode_config.mutex);
                 mode = drm_mode_duplicate(dev, dev_priv->panel_fixed_mode);
                 drm_mode_probed_add(connector, mode);
-                mutex_unlock(&dev->mode_config.mutex);
 
                 return 1;
         }
@@ -405,6 +404,16 @@ void intel_lvds_init(struct drm_device *dev)
         u32 lvds;
         int pipe;
 
+        /* Blacklist machines that we know falsely report LVDS. */
+        /* FIXME: add a check for the Aopen Mini PC */
+
+        /* Apple Mac Mini Core Duo and Mac Mini Core 2 Duo */
+        if(dmi_match(DMI_PRODUCT_NAME, "Macmini1,1") ||
+           dmi_match(DMI_PRODUCT_NAME, "Macmini2,1")) {
+                DRM_DEBUG("Skipping LVDS initialization for Apple Mac Mini\n");
+                return;
+        }
+
         intel_output = kzalloc(sizeof(struct intel_output), GFP_KERNEL);
         if (!intel_output) {
                 return;
@@ -458,7 +467,7 @@ void intel_lvds_init(struct drm_device *dev)
                         dev_priv->panel_fixed_mode =
                                 drm_mode_duplicate(dev, scan);
                         mutex_unlock(&dev->mode_config.mutex);
-                        goto out; /* FIXME: check for quirks */
+                        goto out;
                 }
                 mutex_unlock(&dev->mode_config.mutex);
         }
@@ -492,7 +501,7 @@ void intel_lvds_init(struct drm_device *dev)
                 if (dev_priv->panel_fixed_mode) {
                         dev_priv->panel_fixed_mode->type |=
                                 DRM_MODE_TYPE_PREFERRED;
-                        goto out; /* FIXME: check for quirks */
+                        goto out;
                 }
         }
 
@@ -500,38 +509,6 @@ void intel_lvds_init(struct drm_device *dev)
         if (!dev_priv->panel_fixed_mode)
                 goto failed;
 
-        /* FIXME: detect aopen & mac mini type stuff automatically? */
-        /*
-         * Blacklist machines with BIOSes that list an LVDS panel without
-         * actually having one.
-         */
-        if (IS_I945GM(dev)) {
-                /* aopen mini pc */
-                if (dev->pdev->subsystem_vendor == 0xa0a0)
-                        goto failed;
-
-                if ((dev->pdev->subsystem_vendor == 0x8086) &&
-                    (dev->pdev->subsystem_device == 0x7270)) {
-                        /* It's a Mac Mini or Macbook Pro.
-                         *
-                         * Apple hardware is out to get us.  The macbook pro
-                         * has a real LVDS panel, but the mac mini does not,
-                         * and they have the same device IDs.  We'll
-                         * distinguish by panel size, on the assumption
-                         * that Apple isn't about to make any machines with an
-                         * 800x600 display.
-                         */
-
-                        if (dev_priv->panel_fixed_mode != NULL &&
-                            dev_priv->panel_fixed_mode->hdisplay == 800 &&
-                            dev_priv->panel_fixed_mode->vdisplay == 600) {
-                                DRM_DEBUG("Suspected Mac Mini, ignoring the LVDS\n");
-                                goto failed;
-                        }
-                }
-        }
-
-
 out:
         drm_sysfs_connector_add(connector);
         return;
diff --git a/drivers/gpu/drm/i915/intel_sdvo.c b/drivers/gpu/drm/i915/intel_sdvo.c
index 40721546910..a30508b639b 100644
--- a/drivers/gpu/drm/i915/intel_sdvo.c
+++ b/drivers/gpu/drm/i915/intel_sdvo.c
@@ -40,13 +40,59 @@
 struct intel_sdvo_priv {
         struct intel_i2c_chan *i2c_bus;
         int slaveaddr;
+
+        /* Register for the SDVO device: SDVOB or SDVOC */
         int output_device;
 
-        u16 active_outputs;
+        /* Active outputs controlled by this SDVO output */
+        uint16_t controlled_output;
 
+        /*
+         * Capabilities of the SDVO device returned by
+         * i830_sdvo_get_capabilities()
+         */
         struct intel_sdvo_caps caps;
+
+        /* Pixel clock limitations reported by the SDVO device, in kHz */
         int pixel_clock_min, pixel_clock_max;
 
+        /**
+         * This is set if we're going to treat the device as TV-out.
+         *
+         * While we have these nice friendly flags for output types that ought
+         * to decide this for us, the S-Video output on our HDMI+S-Video card
+         * shows up as RGB1 (VGA).
+         */
+        bool is_tv;
+
+        /**
+         * This is set if we treat the device as HDMI, instead of DVI.
+         */
+        bool is_hdmi;
+
+        /**
+         * Returned SDTV resolutions allowed for the current format, if the
+         * device reported it.
+         */
+        struct intel_sdvo_sdtv_resolution_reply sdtv_resolutions;
+
+        /**
+         * Current selected TV format.
+         *
+         * This is stored in the same structure that's passed to the device, for
+         * convenience.
+         */
+        struct intel_sdvo_tv_format tv_format;
+
+        /*
+         * supported encoding mode, used to determine whether HDMI is
+         * supported
+         */
+        struct intel_sdvo_encode encode;
+
+        /* DDC bus used by this SDVO output */
+        uint8_t ddc_bus;
+
         int save_sdvo_mult;
         u16 save_active_outputs;
         struct intel_sdvo_dtd save_input_dtd_1, save_input_dtd_2;
@@ -148,8 +194,8 @@ static bool intel_sdvo_write_byte(struct intel_output *intel_output, int addr,
 #define SDVO_CMD_NAME_ENTRY(cmd) {cmd, #cmd}
 /** Mapping of command numbers to names, for debug output */
 const static struct _sdvo_cmd_name {
-    u8 cmd;
-    char *name;
+        u8 cmd;
+        char *name;
 } sdvo_cmd_names[] = {
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_RESET),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_DEVICE_CAPS),
@@ -186,8 +232,35 @@ const static struct _sdvo_cmd_name {
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPPORTED_TV_FORMATS),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_TV_FORMAT),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_TV_FORMAT),
-    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_TV_RESOLUTION_SUPPORT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPPORTED_POWER_STATES),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_POWER_STATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_ENCODER_POWER_STATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_DISPLAY_POWER_STATE),
     SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_CONTROL_BUS_SWITCH),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SDTV_RESOLUTION_SUPPORT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SCALED_HDTV_RESOLUTION_SUPPORT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS),
+    /* HDMI op code */
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_SUPP_ENCODE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_ENCODE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_ENCODE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_PIXEL_REPLI),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_PIXEL_REPLI),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_COLORIMETRY_CAP),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_COLORIMETRY),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_COLORIMETRY),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_AUDIO_STAT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_AUDIO_STAT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_INDEX),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_INDEX),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_INFO),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_AV_SPLIT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_AV_SPLIT),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_TXRATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_TXRATE),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_SET_HBUF_DATA),
+    SDVO_CMD_NAME_ENTRY(SDVO_CMD_GET_HBUF_DATA),
 };
 
 #define SDVO_NAME(dev_priv) ((dev_priv)->output_device == SDVOB ? "SDVOB" : "SDVOC")
@@ -506,6 +579,50 @@ static bool intel_sdvo_set_output_timing(struct intel_output *intel_output,
                                      SDVO_CMD_SET_OUTPUT_TIMINGS_PART1, dtd);
 }
 
+static bool
+intel_sdvo_create_preferred_input_timing(struct intel_output *output,
+                                         uint16_t clock,
+                                         uint16_t width,
+                                         uint16_t height)
+{
+        struct intel_sdvo_preferred_input_timing_args args;
+        uint8_t status;
+
+        args.clock = clock;
+        args.width = width;
+        args.height = height;
+        intel_sdvo_write_cmd(output, SDVO_CMD_CREATE_PREFERRED_INPUT_TIMING,
+                             &args, sizeof(args));
+        status = intel_sdvo_read_response(output, NULL, 0);
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+
+        return true;
+}
+
+static bool intel_sdvo_get_preferred_input_timing(struct intel_output *output,
+                                                  struct intel_sdvo_dtd *dtd)
+{
+        bool status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART1,
+                             NULL, 0);
+
+        status = intel_sdvo_read_response(output, &dtd->part1,
+                                          sizeof(dtd->part1));
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_PREFERRED_INPUT_TIMING_PART2,
+                             NULL, 0);
+
+        status = intel_sdvo_read_response(output, &dtd->part2,
+                                          sizeof(dtd->part2));
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+
+        return false;
+}
 
 static int intel_sdvo_get_clock_rate_mult(struct intel_output *intel_output)
 {
@@ -536,36 +653,12 @@ static bool intel_sdvo_set_clock_rate_mult(struct intel_output *intel_output, u8
         return true;
 }
 
-static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
-                                  struct drm_display_mode *mode,
-                                  struct drm_display_mode *adjusted_mode)
-{
-        /* Make the CRTC code factor in the SDVO pixel multiplier.  The SDVO
-         * device will be told of the multiplier during mode_set.
-         */
-        adjusted_mode->clock *= intel_sdvo_get_pixel_multiplier(mode);
-        return true;
-}
-
-static void intel_sdvo_mode_set(struct drm_encoder *encoder,
-                                struct drm_display_mode *mode,
-                                struct drm_display_mode *adjusted_mode)
+static void intel_sdvo_get_dtd_from_mode(struct intel_sdvo_dtd *dtd,
+                                         struct drm_display_mode *mode)
 {
-        struct drm_device *dev = encoder->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
-        struct drm_crtc *crtc = encoder->crtc;
-        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
-        struct intel_output *intel_output = enc_to_intel_output(encoder);
-        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
-        u16 width, height;
-        u16 h_blank_len, h_sync_len, v_blank_len, v_sync_len;
-        u16 h_sync_offset, v_sync_offset;
-        u32 sdvox;
-        struct intel_sdvo_dtd output_dtd;
-        int sdvo_pixel_multiply;
-
-        if (!mode)
-                return;
+        uint16_t width, height;
+        uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
+        uint16_t h_sync_offset, v_sync_offset;
 
         width = mode->crtc_hdisplay;
         height = mode->crtc_vdisplay;
@@ -580,93 +673,423 @@ static void intel_sdvo_mode_set(struct drm_encoder *encoder,
         h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
         v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
 
-        output_dtd.part1.clock = mode->clock / 10;
-        output_dtd.part1.h_active = width & 0xff;
-        output_dtd.part1.h_blank = h_blank_len & 0xff;
-        output_dtd.part1.h_high = (((width >> 8) & 0xf) << 4) |
+        dtd->part1.clock = mode->clock / 10;
+        dtd->part1.h_active = width & 0xff;
+        dtd->part1.h_blank = h_blank_len & 0xff;
+        dtd->part1.h_high = (((width >> 8) & 0xf) << 4) |
                 ((h_blank_len >> 8) & 0xf);
-        output_dtd.part1.v_active = height & 0xff;
-        output_dtd.part1.v_blank = v_blank_len & 0xff;
-        output_dtd.part1.v_high = (((height >> 8) & 0xf) << 4) |
+        dtd->part1.v_active = height & 0xff;
+        dtd->part1.v_blank = v_blank_len & 0xff;
+        dtd->part1.v_high = (((height >> 8) & 0xf) << 4) |
                 ((v_blank_len >> 8) & 0xf);
 
-        output_dtd.part2.h_sync_off = h_sync_offset;
-        output_dtd.part2.h_sync_width = h_sync_len & 0xff;
-        output_dtd.part2.v_sync_off_width = (v_sync_offset & 0xf) << 4 |
+        dtd->part2.h_sync_off = h_sync_offset;
+        dtd->part2.h_sync_width = h_sync_len & 0xff;
+        dtd->part2.v_sync_off_width = (v_sync_offset & 0xf) << 4 |
                 (v_sync_len & 0xf);
-        output_dtd.part2.sync_off_width_high = ((h_sync_offset & 0x300) >> 2) |
+        dtd->part2.sync_off_width_high = ((h_sync_offset & 0x300) >> 2) |
                 ((h_sync_len & 0x300) >> 4) | ((v_sync_offset & 0x30) >> 2) |
                 ((v_sync_len & 0x30) >> 4);
 
-        output_dtd.part2.dtd_flags = 0x18;
+        dtd->part2.dtd_flags = 0x18;
         if (mode->flags & DRM_MODE_FLAG_PHSYNC)
-                output_dtd.part2.dtd_flags |= 0x2;
+                dtd->part2.dtd_flags |= 0x2;
         if (mode->flags & DRM_MODE_FLAG_PVSYNC)
-                output_dtd.part2.dtd_flags |= 0x4;
+                dtd->part2.dtd_flags |= 0x4;
+
+        dtd->part2.sdvo_flags = 0;
+        dtd->part2.v_sync_off_high = v_sync_offset & 0xc0;
+        dtd->part2.reserved = 0;
+}
+
+static void intel_sdvo_get_mode_from_dtd(struct drm_display_mode * mode,
+                                         struct intel_sdvo_dtd *dtd)
+{
+        uint16_t width, height;
+        uint16_t h_blank_len, h_sync_len, v_blank_len, v_sync_len;
+        uint16_t h_sync_offset, v_sync_offset;
+
+        width = mode->crtc_hdisplay;
+        height = mode->crtc_vdisplay;
+
+        /* do some mode translations */
+        h_blank_len = mode->crtc_hblank_end - mode->crtc_hblank_start;
+        h_sync_len = mode->crtc_hsync_end - mode->crtc_hsync_start;
+
+        v_blank_len = mode->crtc_vblank_end - mode->crtc_vblank_start;
+        v_sync_len = mode->crtc_vsync_end - mode->crtc_vsync_start;
+
+        h_sync_offset = mode->crtc_hsync_start - mode->crtc_hblank_start;
+        v_sync_offset = mode->crtc_vsync_start - mode->crtc_vblank_start;
+
+        mode->hdisplay = dtd->part1.h_active;
+        mode->hdisplay += ((dtd->part1.h_high >> 4) & 0x0f) << 8;
+        mode->hsync_start = mode->hdisplay + dtd->part2.h_sync_off;
+        mode->hsync_start += (dtd->part2.sync_off_width_high & 0xa0) << 2;
+        mode->hsync_end = mode->hsync_start + dtd->part2.h_sync_width;
+        mode->hsync_end += (dtd->part2.sync_off_width_high & 0x30) << 4;
+        mode->htotal = mode->hdisplay + dtd->part1.h_blank;
+        mode->htotal += (dtd->part1.h_high & 0xf) << 8;
+
+        mode->vdisplay = dtd->part1.v_active;
+        mode->vdisplay += ((dtd->part1.v_high >> 4) & 0x0f) << 8;
+        mode->vsync_start = mode->vdisplay;
+        mode->vsync_start += (dtd->part2.v_sync_off_width >> 4) & 0xf;
+        mode->vsync_start += (dtd->part2.sync_off_width_high & 0x0a) << 2;
+        mode->vsync_start += dtd->part2.v_sync_off_high & 0xc0;
+        mode->vsync_end = mode->vsync_start +
+                (dtd->part2.v_sync_off_width & 0xf);
+        mode->vsync_end += (dtd->part2.sync_off_width_high & 0x3) << 4;
+        mode->vtotal = mode->vdisplay + dtd->part1.v_blank;
+        mode->vtotal += (dtd->part1.v_high & 0xf) << 8;
+
+        mode->clock = dtd->part1.clock * 10;
+
+        mode->flags &= (DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC);
+        if (dtd->part2.dtd_flags & 0x2)
+                mode->flags |= DRM_MODE_FLAG_PHSYNC;
+        if (dtd->part2.dtd_flags & 0x4)
+                mode->flags |= DRM_MODE_FLAG_PVSYNC;
+}
+
+static bool intel_sdvo_get_supp_encode(struct intel_output *output,
+                                       struct intel_sdvo_encode *encode)
+{
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_SUPP_ENCODE, NULL, 0);
+        status = intel_sdvo_read_response(output, encode, sizeof(*encode));
+        if (status != SDVO_CMD_STATUS_SUCCESS) { /* non-support means DVI */
+                memset(encode, 0, sizeof(*encode));
+                return false;
+        }
+
+        return true;
+}
+
+static bool intel_sdvo_set_encode(struct intel_output *output, uint8_t mode)
+{
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_ENCODE, &mode, 1);
+        status = intel_sdvo_read_response(output, NULL, 0);
+
+        return (status == SDVO_CMD_STATUS_SUCCESS);
+}
+
+static bool intel_sdvo_set_colorimetry(struct intel_output *output,
+                                       uint8_t mode)
+{
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_COLORIMETRY, &mode, 1);
+        status = intel_sdvo_read_response(output, NULL, 0);
+
+        return (status == SDVO_CMD_STATUS_SUCCESS);
+}
+
+#if 0
+static void intel_sdvo_dump_hdmi_buf(struct intel_output *output)
+{
+        int i, j;
+        uint8_t set_buf_index[2];
+        uint8_t av_split;
+        uint8_t buf_size;
+        uint8_t buf[48];
+        uint8_t *pos;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_AV_SPLIT, NULL, 0);
+        intel_sdvo_read_response(output, &av_split, 1);
+
+        for (i = 0; i <= av_split; i++) {
+                set_buf_index[0] = i; set_buf_index[1] = 0;
+                intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_INDEX,
+                                     set_buf_index, 2);
+                intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_INFO, NULL, 0);
+                intel_sdvo_read_response(output, &buf_size, 1);
+
+                pos = buf;
+                for (j = 0; j <= buf_size; j += 8) {
+                        intel_sdvo_write_cmd(output, SDVO_CMD_GET_HBUF_DATA,
+                                             NULL, 0);
+                        intel_sdvo_read_response(output, pos, 8);
+                        pos += 8;
+                }
+        }
+}
+#endif
+
+static void intel_sdvo_set_hdmi_buf(struct intel_output *output, int index,
+                                uint8_t *data, int8_t size, uint8_t tx_rate)
+{
+    uint8_t set_buf_index[2];
+
+    set_buf_index[0] = index;
+    set_buf_index[1] = 0;
+
+    intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_INDEX, set_buf_index, 2);
+
+    for (; size > 0; size -= 8) {
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_DATA, data, 8);
+        data += 8;
+    }
+
+    intel_sdvo_write_cmd(output, SDVO_CMD_SET_HBUF_TXRATE, &tx_rate, 1);
+}
+
+static uint8_t intel_sdvo_calc_hbuf_csum(uint8_t *data, uint8_t size)
+{
+        uint8_t csum = 0;
+        int i;
+
+        for (i = 0; i < size; i++)
+                csum += data[i];
+
+        return 0x100 - csum;
+}
+
+#define DIP_TYPE_AVI    0x82
+#define DIP_VERSION_AVI 0x2
+#define DIP_LEN_AVI     13
+
+struct dip_infoframe {
+        uint8_t type;
+        uint8_t version;
+        uint8_t len;
+        uint8_t checksum;
+        union {
+                struct {
+                        /* Packet Byte #1 */
+                        uint8_t S:2;
+                        uint8_t B:2;
+                        uint8_t A:1;
+                        uint8_t Y:2;
+                        uint8_t rsvd1:1;
+                        /* Packet Byte #2 */
+                        uint8_t R:4;
+                        uint8_t M:2;
+                        uint8_t C:2;
+                        /* Packet Byte #3 */
+                        uint8_t SC:2;
+                        uint8_t Q:2;
+                        uint8_t EC:3;
+                        uint8_t ITC:1;
+                        /* Packet Byte #4 */
+                        uint8_t VIC:7;
+                        uint8_t rsvd2:1;
+                        /* Packet Byte #5 */
+                        uint8_t PR:4;
+                        uint8_t rsvd3:4;
+                        /* Packet Byte #6~13 */
+                        uint16_t top_bar_end;
+                        uint16_t bottom_bar_start;
+                        uint16_t left_bar_end;
+                        uint16_t right_bar_start;
+                } avi;
+                struct {
+                        /* Packet Byte #1 */
+                        uint8_t channel_count:3;
+                        uint8_t rsvd1:1;
+                        uint8_t coding_type:4;
+                        /* Packet Byte #2 */
+                        uint8_t sample_size:2; /* SS0, SS1 */
+                        uint8_t sample_frequency:3;
+                        uint8_t rsvd2:3;
+                        /* Packet Byte #3 */
+                        uint8_t coding_type_private:5;
+                        uint8_t rsvd3:3;
+                        /* Packet Byte #4 */
+                        uint8_t channel_allocation;
+                        /* Packet Byte #5 */
+                        uint8_t rsvd4:3;
+                        uint8_t level_shift:4;
+                        uint8_t downmix_inhibit:1;
+                } audio;
+                uint8_t payload[28];
+        } __attribute__ ((packed)) u;
+} __attribute__((packed));
+
+static void intel_sdvo_set_avi_infoframe(struct intel_output *output,
+                                         struct drm_display_mode * mode)
+{
+        struct dip_infoframe avi_if = {
+                .type = DIP_TYPE_AVI,
+                .version = DIP_VERSION_AVI,
+                .len = DIP_LEN_AVI,
+        };
+
+        avi_if.checksum = intel_sdvo_calc_hbuf_csum((uint8_t *)&avi_if,
+                                                    4 + avi_if.len);
+        intel_sdvo_set_hdmi_buf(output, 1, (uint8_t *)&avi_if, 4 + avi_if.len,
+                                SDVO_HBUF_TX_VSYNC);
+}
+
+static bool intel_sdvo_mode_fixup(struct drm_encoder *encoder,
+                                  struct drm_display_mode *mode,
+                                  struct drm_display_mode *adjusted_mode)
+{
+        struct intel_output *output = enc_to_intel_output(encoder);
+        struct intel_sdvo_priv *dev_priv = output->dev_priv;
 
-        output_dtd.part2.sdvo_flags = 0;
-        output_dtd.part2.v_sync_off_high = v_sync_offset & 0xc0;
-        output_dtd.part2.reserved = 0;
+        if (!dev_priv->is_tv) {
+                /* Make the CRTC code factor in the SDVO pixel multiplier.  The
+                 * SDVO device will be told of the multiplier during mode_set.
+                 */
+                adjusted_mode->clock *= intel_sdvo_get_pixel_multiplier(mode);
+        } else {
+                struct intel_sdvo_dtd output_dtd;
+                bool success;
+
+                /* We need to construct preferred input timings based on our
+                 * output timings.  To do that, we have to set the output
+                 * timings, even though this isn't really the right place in
+                 * the sequence to do it. Oh well.
+                 */
+
+
+                /* Set output timings */
+                intel_sdvo_get_dtd_from_mode(&output_dtd, mode);
+                intel_sdvo_set_target_output(output,
+                                             dev_priv->controlled_output);
+                intel_sdvo_set_output_timing(output, &output_dtd);
+
+                /* Set the input timing to the screen. Assume always input 0. */
+                intel_sdvo_set_target_input(output, true, false);
+
+
+                success = intel_sdvo_create_preferred_input_timing(output,
+                                                                   mode->clock / 10,
+                                                                   mode->hdisplay,
+                                                                   mode->vdisplay);
+                if (success) {
+                        struct intel_sdvo_dtd input_dtd;
 
-        /* Set the output timing to the screen */
-        intel_sdvo_set_target_output(intel_output, sdvo_priv->active_outputs);
-        intel_sdvo_set_output_timing(intel_output, &output_dtd);
+                        intel_sdvo_get_preferred_input_timing(output,
+                                                             &input_dtd);
+                        intel_sdvo_get_mode_from_dtd(adjusted_mode, &input_dtd);
+
+                } else {
+                        return false;
+                }
+        }
+        return true;
+}
+
+static void intel_sdvo_mode_set(struct drm_encoder *encoder,
+                                struct drm_display_mode *mode,
+                                struct drm_display_mode *adjusted_mode)
+{
+        struct drm_device *dev = encoder->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        struct drm_crtc *crtc = encoder->crtc;
+        struct intel_crtc *intel_crtc = to_intel_crtc(crtc);
+        struct intel_output *output = enc_to_intel_output(encoder);
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        u32 sdvox = 0;
+        int sdvo_pixel_multiply;
+        struct intel_sdvo_in_out_map in_out;
+        struct intel_sdvo_dtd input_dtd;
+        u8 status;
+
+        if (!mode)
+                return;
+
+        /* First, set the input mapping for the first input to our controlled
+         * output. This is only correct if we're a single-input device, in
+         * which case the first input is the output from the appropriate SDVO
+         * channel on the motherboard.  In a two-input device, the first input
+         * will be SDVOB and the second SDVOC.
+         */
+        in_out.in0 = sdvo_priv->controlled_output;
+        in_out.in1 = 0;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_SET_IN_OUT_MAP,
+                             &in_out, sizeof(in_out));
+        status = intel_sdvo_read_response(output, NULL, 0);
+
+        if (sdvo_priv->is_hdmi) {
+                intel_sdvo_set_avi_infoframe(output, mode);
+                sdvox |= SDVO_AUDIO_ENABLE;
+        }
+
+        intel_sdvo_get_dtd_from_mode(&input_dtd, mode);
+
+        /* If it's a TV, we already set the output timing in mode_fixup.
+         * Otherwise, the output timing is equal to the input timing.
+         */
+        if (!sdvo_priv->is_tv) {
+                /* Set the output timing to the screen */
+                intel_sdvo_set_target_output(output,
+                                             sdvo_priv->controlled_output);
+                intel_sdvo_set_output_timing(output, &input_dtd);
+        }
 
         /* Set the input timing to the screen. Assume always input 0. */
-        intel_sdvo_set_target_input(intel_output, true, false);
+        intel_sdvo_set_target_input(output, true, false);
 
-        /* We would like to use i830_sdvo_create_preferred_input_timing() to
+        /* We would like to use intel_sdvo_create_preferred_input_timing() to
          * provide the device with a timing it can support, if it supports that
          * feature.  However, presumably we would need to adjust the CRTC to
          * output the preferred timing, and we don't support that currently.
          */
-        intel_sdvo_set_input_timing(intel_output, &output_dtd);
+#if 0
+        success = intel_sdvo_create_preferred_input_timing(output, clock,
+                                                           width, height);
+        if (success) {
+                struct intel_sdvo_dtd *input_dtd;
+
+                intel_sdvo_get_preferred_input_timing(output, &input_dtd);
+                intel_sdvo_set_input_timing(output, &input_dtd);
+        }
+#else
+        intel_sdvo_set_input_timing(output, &input_dtd);
+#endif
 
         switch (intel_sdvo_get_pixel_multiplier(mode)) {
         case 1:
-                intel_sdvo_set_clock_rate_mult(intel_output,
+                intel_sdvo_set_clock_rate_mult(output,
                                                SDVO_CLOCK_RATE_MULT_1X);
                 break;
         case 2:
-                intel_sdvo_set_clock_rate_mult(intel_output,
+                intel_sdvo_set_clock_rate_mult(output,
                                                SDVO_CLOCK_RATE_MULT_2X);
                 break;
         case 4:
-                intel_sdvo_set_clock_rate_mult(intel_output,
+                intel_sdvo_set_clock_rate_mult(output,
                                                SDVO_CLOCK_RATE_MULT_4X);
                 break;
         }
 
         /* Set the SDVO control regs. */
-        if (0/*IS_I965GM(dev)*/) {
-                sdvox = SDVO_BORDER_ENABLE;
-        } else {
-                sdvox = I915_READ(sdvo_priv->output_device);
-                switch (sdvo_priv->output_device) {
-                case SDVOB:
-                        sdvox &= SDVOB_PRESERVE_MASK;
-                        break;
-                case SDVOC:
-                        sdvox &= SDVOC_PRESERVE_MASK;
-                        break;
-                }
-                sdvox |= (9 << 19) | SDVO_BORDER_ENABLE;
-        }
+        if (IS_I965G(dev)) {
+                sdvox |= SDVO_BORDER_ENABLE |
+                        SDVO_VSYNC_ACTIVE_HIGH |
+                        SDVO_HSYNC_ACTIVE_HIGH;
+        } else {
+                sdvox |= I915_READ(sdvo_priv->output_device);
+                switch (sdvo_priv->output_device) {
+                case SDVOB:
+                        sdvox &= SDVOB_PRESERVE_MASK;
+                        break;
+                case SDVOC:
+                        sdvox &= SDVOC_PRESERVE_MASK;
+                        break;
+                }
+                sdvox |= (9 << 19) | SDVO_BORDER_ENABLE;
+        }
         if (intel_crtc->pipe == 1)
                 sdvox |= SDVO_PIPE_B_SELECT;
 
         sdvo_pixel_multiply = intel_sdvo_get_pixel_multiplier(mode);
         if (IS_I965G(dev)) {
-                /* done in crtc_mode_set as the dpll_md reg must be written
-                   early */
-        } else if (IS_I945G(dev) || IS_I945GM(dev)) {
-                /* done in crtc_mode_set as it lives inside the
-                   dpll register */
+                /* done in crtc_mode_set as the dpll_md reg must be written early */
+        } else if (IS_I945G(dev) || IS_I945GM(dev) || IS_G33(dev)) {
+                /* done in crtc_mode_set as it lives inside the dpll register */
         } else {
                 sdvox |= (sdvo_pixel_multiply - 1) << SDVO_PORT_MULTIPLY_SHIFT;
         }
 
-        intel_sdvo_write_sdvox(intel_output, sdvox);
+        intel_sdvo_write_sdvox(output, sdvox);
 }
 
 static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
@@ -714,7 +1137,7 @@ static void intel_sdvo_dpms(struct drm_encoder *encoder, int mode)
 
                 if (0)
                         intel_sdvo_set_encoder_power_state(intel_output, mode);
-                intel_sdvo_set_active_outputs(intel_output, sdvo_priv->active_outputs);
+                intel_sdvo_set_active_outputs(intel_output, sdvo_priv->controlled_output);
         }
         return;
 }
@@ -752,6 +1175,9 @@ static void intel_sdvo_save(struct drm_connector *connector)
                                                      &sdvo_priv->save_output_dtd[o]);
                 }
         }
+        if (sdvo_priv->is_tv) {
+                /* XXX: Save TV format/enhancements. */
+        }
 
         sdvo_priv->save_SDVOX = I915_READ(sdvo_priv->output_device);
 }
@@ -759,7 +1185,6 @@ static void intel_sdvo_save(struct drm_connector *connector)
 static void intel_sdvo_restore(struct drm_connector *connector)
 {
         struct drm_device *dev = connector->dev;
-        struct drm_i915_private *dev_priv = dev->dev_private;
         struct intel_output *intel_output = to_intel_output(connector);
         struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
         int o;
@@ -790,7 +1215,11 @@ static void intel_sdvo_restore(struct drm_connector *connector)
 
         intel_sdvo_set_clock_rate_mult(intel_output, sdvo_priv->save_sdvo_mult);
 
-        I915_WRITE(sdvo_priv->output_device, sdvo_priv->save_SDVOX);
+        if (sdvo_priv->is_tv) {
+                /* XXX: Restore TV format/enhancements. */
+        }
+
+        intel_sdvo_write_sdvox(intel_output, sdvo_priv->save_SDVOX);
 
         if (sdvo_priv->save_SDVOX & SDVO_ENABLE)
         {
@@ -916,20 +1345,173 @@ static enum drm_connector_status intel_sdvo_detect(struct drm_connector *connect
         status = intel_sdvo_read_response(intel_output, &response, 2);
 
         DRM_DEBUG("SDVO response %d %d\n", response[0], response[1]);
+
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return connector_status_unknown;
+
         if ((response[0] != 0) || (response[1] != 0))
                 return connector_status_connected;
         else
                 return connector_status_disconnected;
 }
 
-static int intel_sdvo_get_modes(struct drm_connector *connector)
+static void intel_sdvo_get_ddc_modes(struct drm_connector *connector)
 {
         struct intel_output *intel_output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = intel_output->dev_priv;
 
         /* set the bus switch and get the modes */
-        intel_sdvo_set_control_bus_switch(intel_output, SDVO_CONTROL_BUS_DDC2);
+        intel_sdvo_set_control_bus_switch(intel_output, sdvo_priv->ddc_bus);
         intel_ddc_get_modes(intel_output);
 
+#if 0
+        struct drm_device *dev = encoder->dev;
+        struct drm_i915_private *dev_priv = dev->dev_private;
+        /* Mac mini hack.  On this device, I get DDC through the analog, which
+         * load-detects as disconnected.  I fail to DDC through the SDVO DDC,
+         * but it does load-detect as connected.  So, just steal the DDC bits
+         * from analog when we fail at finding it the right way.
+         */
+        crt = xf86_config->output[0];
+        intel_output = crt->driver_private;
+        if (intel_output->type == I830_OUTPUT_ANALOG &&
+            crt->funcs->detect(crt) == XF86OutputStatusDisconnected) {
+                I830I2CInit(pScrn, &intel_output->pDDCBus, GPIOA, "CRTDDC_A");
+                edid_mon = xf86OutputGetEDID(crt, intel_output->pDDCBus);
+                xf86DestroyI2CBusRec(intel_output->pDDCBus, true, true);
+        }
+        if (edid_mon) {
+                xf86OutputSetEDID(output, edid_mon);
+                modes = xf86OutputGetEDIDModes(output);
+        }
+#endif
+}
+
+/**
+ * This function checks the current TV format, and chooses a default if
+ * it hasn't been set.
+ */
+static void
+intel_sdvo_check_tv_format(struct intel_output *output)
+{
+        struct intel_sdvo_priv *dev_priv = output->dev_priv;
+        struct intel_sdvo_tv_format format, unset;
+        uint8_t status;
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_TV_FORMAT, NULL, 0);
+        status = intel_sdvo_read_response(output, &format, sizeof(format));
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return;
+
+        memset(&unset, 0, sizeof(unset));
+        if (memcmp(&format, &unset, sizeof(format))) {
+                DRM_DEBUG("%s: Choosing default TV format of NTSC-M\n",
+                          SDVO_NAME(dev_priv));
+
+                format.ntsc_m = true;
+                intel_sdvo_write_cmd(output, SDVO_CMD_SET_TV_FORMAT, NULL, 0);
+                status = intel_sdvo_read_response(output, NULL, 0);
+        }
+}
+
+/*
+ * Set of SDVO TV modes.
+ * Note!  This is in reply order (see loop in get_tv_modes).
+ * XXX: all 60Hz refresh?
+ */
+struct drm_display_mode sdvo_tv_modes[] = {
+        { DRM_MODE("320x200", DRM_MODE_TYPE_DRIVER, 5815680, 321, 384, 416,
+                   200, 0, 232, 201, 233, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("320x240", DRM_MODE_TYPE_DRIVER, 6814080, 321, 384, 416,
+                   240, 0, 272, 241, 273, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("400x300", DRM_MODE_TYPE_DRIVER, 9910080, 401, 464, 496,
+                   300, 0, 332, 301, 333, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("640x350", DRM_MODE_TYPE_DRIVER, 16913280, 641, 704, 736,
+                   350, 0, 382, 351, 383, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("640x400", DRM_MODE_TYPE_DRIVER, 19121280, 641, 704, 736,
+                   400, 0, 432, 401, 433, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("640x400", DRM_MODE_TYPE_DRIVER, 19121280, 641, 704, 736,
+                   400, 0, 432, 401, 433, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("704x480", DRM_MODE_TYPE_DRIVER, 24624000, 705, 768, 800,
+                   480, 0, 512, 481, 513, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("704x576", DRM_MODE_TYPE_DRIVER, 29232000, 705, 768, 800,
+                   576, 0, 608, 577, 609, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x350", DRM_MODE_TYPE_DRIVER, 18751680, 721, 784, 816,
+                   350, 0, 382, 351, 383, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x400", DRM_MODE_TYPE_DRIVER, 21199680, 721, 784, 816,
+                   400, 0, 432, 401, 433, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x480", DRM_MODE_TYPE_DRIVER, 25116480, 721, 784, 816,
+                   480, 0, 512, 481, 513, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x540", DRM_MODE_TYPE_DRIVER, 28054080, 721, 784, 816,
+                   540, 0, 572, 541, 573, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("720x576", DRM_MODE_TYPE_DRIVER, 29816640, 721, 784, 816,
+                   576, 0, 608, 577, 609, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("768x576", DRM_MODE_TYPE_DRIVER, 31570560, 769, 832, 864,
+                   576, 0, 608, 577, 609, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("800x600", DRM_MODE_TYPE_DRIVER, 34030080, 801, 864, 896,
+                   600, 0, 632, 601, 633, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("832x624", DRM_MODE_TYPE_DRIVER, 36581760, 833, 896, 928,
+                   624, 0, 656, 625, 657, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("920x766", DRM_MODE_TYPE_DRIVER, 48707040, 921, 984, 1016,
+                   766, 0, 798, 767, 799, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("1024x768", DRM_MODE_TYPE_DRIVER, 53827200, 1025, 1088, 1120,
+                   768, 0, 800, 769, 801, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+        { DRM_MODE("1280x1024", DRM_MODE_TYPE_DRIVER, 87265920, 1281, 1344, 1376,
+                   1024, 0, 1056, 1025, 1057, 4196112, 0,
+                   DRM_MODE_FLAG_PHSYNC | DRM_MODE_FLAG_PVSYNC) },
+};
+
+static void intel_sdvo_get_tv_modes(struct drm_connector *connector)
+{
+        struct intel_output *output = to_intel_output(connector);
+        uint32_t reply = 0;
+        uint8_t status;
+        int i = 0;
+
+        intel_sdvo_check_tv_format(output);
+
+        /* Read the list of supported input resolutions for the selected TV
+         * format.
+         */
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_SDTV_RESOLUTION_SUPPORT,
+                             NULL, 0);
+        status = intel_sdvo_read_response(output, &reply, 3);
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return;
+
+        for (i = 0; i < ARRAY_SIZE(sdvo_tv_modes); i++)
+                if (reply & (1 << i))
+                        drm_mode_probed_add(connector, &sdvo_tv_modes[i]);
+}
+
+static int intel_sdvo_get_modes(struct drm_connector *connector)
+{
+        struct intel_output *output = to_intel_output(connector);
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+
+        if (sdvo_priv->is_tv)
+                intel_sdvo_get_tv_modes(connector);
+        else
+                intel_sdvo_get_ddc_modes(connector);
+
         if (list_empty(&connector->probed_modes))
                 return 0;
         return 1;
@@ -978,6 +1560,65 @@ static const struct drm_encoder_funcs intel_sdvo_enc_funcs = {
 };
 
 
+/**
+ * Choose the appropriate DDC bus for control bus switch command for this
+ * SDVO output based on the controlled output.
+ *
+ * DDC bus number assignment is in a priority order of RGB outputs, then TMDS
+ * outputs, then LVDS outputs.
+ */
+static void
+intel_sdvo_select_ddc_bus(struct intel_sdvo_priv *dev_priv)
+{
+        uint16_t mask = 0;
+        unsigned int num_bits;
+
+        /* Make a mask of outputs less than or equal to our own priority in the
+         * list.
+         */
+        switch (dev_priv->controlled_output) {
+        case SDVO_OUTPUT_LVDS1:
+                mask |= SDVO_OUTPUT_LVDS1;
+        case SDVO_OUTPUT_LVDS0:
+                mask |= SDVO_OUTPUT_LVDS0;
+        case SDVO_OUTPUT_TMDS1:
+                mask |= SDVO_OUTPUT_TMDS1;
+        case SDVO_OUTPUT_TMDS0:
+                mask |= SDVO_OUTPUT_TMDS0;
+        case SDVO_OUTPUT_RGB1:
+                mask |= SDVO_OUTPUT_RGB1;
+        case SDVO_OUTPUT_RGB0:
+                mask |= SDVO_OUTPUT_RGB0;
+                break;
+        }
+
+        /* Count bits to find what number we are in the priority list. */
+        mask &= dev_priv->caps.output_flags;
+        num_bits = hweight16(mask);
+        if (num_bits > 3) {
+                /* if more than 3 outputs, default to DDC bus 3 for now */
+                num_bits = 3;
+        }
+
+        /* Corresponds to SDVO_CONTROL_BUS_DDCx */
+        dev_priv->ddc_bus = 1 << num_bits;
+}
+
+static bool
+intel_sdvo_get_digital_encoding_mode(struct intel_output *output)
+{
+        struct intel_sdvo_priv *sdvo_priv = output->dev_priv;
+        uint8_t status;
+
+        intel_sdvo_set_target_output(output, sdvo_priv->controlled_output);
+
+        intel_sdvo_write_cmd(output, SDVO_CMD_GET_ENCODE, NULL, 0);
+        status = intel_sdvo_read_response(output, &sdvo_priv->is_hdmi, 1);
+        if (status != SDVO_CMD_STATUS_SUCCESS)
+                return false;
+        return true;
+}
+
 bool intel_sdvo_init(struct drm_device *dev, int output_device)
 {
         struct drm_connector *connector;
@@ -1040,45 +1681,76 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
 
         intel_sdvo_get_capabilities(intel_output, &sdvo_priv->caps);
 
-        memset(&sdvo_priv->active_outputs, 0, sizeof(sdvo_priv->active_outputs));
+        if (sdvo_priv->caps.output_flags &
+            (SDVO_OUTPUT_TMDS0 | SDVO_OUTPUT_TMDS1)) {
+                if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS0)
+                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS0;
+                else
+                        sdvo_priv->controlled_output = SDVO_OUTPUT_TMDS1;
+
+                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
+                encoder_type = DRM_MODE_ENCODER_TMDS;
+                connector_type = DRM_MODE_CONNECTOR_DVID;
 
-        /* TODO, CVBS, SVID, YPRPB & SCART outputs. */
-        if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
+                if (intel_sdvo_get_supp_encode(intel_output,
+                                               &sdvo_priv->encode) &&
+                    intel_sdvo_get_digital_encoding_mode(intel_output) &&
+                    sdvo_priv->is_hdmi) {
+                        /* enable hdmi encoding mode if supported */
+                        intel_sdvo_set_encode(intel_output, SDVO_ENCODE_HDMI);
+                        intel_sdvo_set_colorimetry(intel_output,
+                                                   SDVO_COLORIMETRY_RGB256);
+                        connector_type = DRM_MODE_CONNECTOR_HDMIA;
+                }
+        }
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_SVID0)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_RGB0;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_SVID0;
+                connector->display_info.subpixel_order = SubPixelHorizontalRGB;
+                encoder_type = DRM_MODE_ENCODER_TVDAC;
+                connector_type = DRM_MODE_CONNECTOR_SVIDEO;
+                sdvo_priv->is_tv = true;
+                intel_output->needs_tv_clock = true;
+        }
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB0)
+        {
+                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB0;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_DAC;
                 connector_type = DRM_MODE_CONNECTOR_VGA;
         }
         else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_RGB1)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_RGB1;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_RGB1;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
                 encoder_type = DRM_MODE_ENCODER_DAC;
                 connector_type = DRM_MODE_CONNECTOR_VGA;
         }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS0)
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS0)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_TMDS0;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS0;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
-                encoder_type = DRM_MODE_ENCODER_TMDS;
-                connector_type = DRM_MODE_CONNECTOR_DVID;
+                encoder_type = DRM_MODE_ENCODER_LVDS;
+                connector_type = DRM_MODE_CONNECTOR_LVDS;
         }
-        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_TMDS1)
+        else if (sdvo_priv->caps.output_flags & SDVO_OUTPUT_LVDS1)
         {
-                sdvo_priv->active_outputs = SDVO_OUTPUT_TMDS1;
+                sdvo_priv->controlled_output = SDVO_OUTPUT_LVDS1;
                 connector->display_info.subpixel_order = SubPixelHorizontalRGB;
-                encoder_type = DRM_MODE_ENCODER_TMDS;
-                connector_type = DRM_MODE_CONNECTOR_DVID;
+                encoder_type = DRM_MODE_ENCODER_LVDS;
+                connector_type = DRM_MODE_CONNECTOR_LVDS;
         }
         else
         {
                 unsigned char bytes[2];
 
+                sdvo_priv->controlled_output = 0;
                 memcpy (bytes, &sdvo_priv->caps.output_flags, 2);
-                DRM_DEBUG("%s: No active RGB or TMDS outputs (0x%02x%02x)\n",
+                DRM_DEBUG("%s: Unknown SDVO output type (0x%02x%02x)\n",
                           SDVO_NAME(sdvo_priv),
                           bytes[0], bytes[1]);
+                encoder_type = DRM_MODE_ENCODER_NONE;
+                connector_type = DRM_MODE_CONNECTOR_Unknown;
                 goto err_i2c;
         }
 
@@ -1089,6 +1761,8 @@ bool intel_sdvo_init(struct drm_device *dev, int output_device)
         drm_mode_connector_attach_encoder(&intel_output->base, &intel_output->enc);
         drm_sysfs_connector_add(connector);
 
+        intel_sdvo_select_ddc_bus(sdvo_priv);
+
         /* Set the input timing to the screen. Assume always input 0. */
         intel_sdvo_set_target_input(intel_output, true, false);
 
diff --git a/drivers/gpu/drm/i915/intel_sdvo_regs.h b/drivers/gpu/drm/i915/intel_sdvo_regs.h
index 861a43f8693..1117b9c151a 100644
--- a/drivers/gpu/drm/i915/intel_sdvo_regs.h
+++ b/drivers/gpu/drm/i915/intel_sdvo_regs.h
@@ -173,6 +173,9 @@ struct intel_sdvo_get_trained_inputs_response {
  * Returns two struct intel_sdvo_output_flags structures.
  */
 #define SDVO_CMD_GET_IN_OUT_MAP                         0x06
+struct intel_sdvo_in_out_map {
+    u16 in0, in1;
+};
 
 /**
  * Sets the current mapping of SDVO inputs to outputs on the device.
@@ -206,7 +209,8 @@ struct intel_sdvo_get_trained_inputs_response {
 struct intel_sdvo_get_interrupt_event_source_response {
     u16 interrupt_status;
     unsigned int ambient_light_interrupt:1;
-    unsigned int pad:7;
+    unsigned int hdmi_audio_encrypt_change:1;
+    unsigned int pad:6;
 } __attribute__((packed));
 
 /**
@@ -305,23 +309,411 @@ struct intel_sdvo_set_target_input_args {
 # define SDVO_CLOCK_RATE_MULT_4X                                (1 << 3)
 
 #define SDVO_CMD_GET_SUPPORTED_TV_FORMATS               0x27
+/** 5 bytes of bit flags for TV formats shared by all TV format functions */
+struct intel_sdvo_tv_format {
+    unsigned int ntsc_m:1;
+    unsigned int ntsc_j:1;
+    unsigned int ntsc_443:1;
+    unsigned int pal_b:1;
+    unsigned int pal_d:1;
+    unsigned int pal_g:1;
+    unsigned int pal_h:1;
+    unsigned int pal_i:1;
+
+    unsigned int pal_m:1;
+    unsigned int pal_n:1;
+    unsigned int pal_nc:1;
+    unsigned int pal_60:1;
+    unsigned int secam_b:1;
+    unsigned int secam_d:1;
+    unsigned int secam_g:1;
+    unsigned int secam_k:1;
+
+    unsigned int secam_k1:1;
+    unsigned int secam_l:1;
+    unsigned int secam_60:1;
+    unsigned int hdtv_std_smpte_240m_1080i_59:1;
+    unsigned int hdtv_std_smpte_240m_1080i_60:1;
+    unsigned int hdtv_std_smpte_260m_1080i_59:1;
+    unsigned int hdtv_std_smpte_260m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080i_50:1;
+
+    unsigned int hdtv_std_smpte_274m_1080i_59:1;
+    unsigned int hdtv_std_smpte_274m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080p_23:1;
+    unsigned int hdtv_std_smpte_274m_1080p_24:1;
+    unsigned int hdtv_std_smpte_274m_1080p_25:1;
+    unsigned int hdtv_std_smpte_274m_1080p_29:1;
+    unsigned int hdtv_std_smpte_274m_1080p_30:1;
+    unsigned int hdtv_std_smpte_274m_1080p_50:1;
+
+    unsigned int hdtv_std_smpte_274m_1080p_59:1;
+    unsigned int hdtv_std_smpte_274m_1080p_60:1;
+    unsigned int hdtv_std_smpte_295m_1080i_50:1;
+    unsigned int hdtv_std_smpte_295m_1080p_50:1;
+    unsigned int hdtv_std_smpte_296m_720p_59:1;
+    unsigned int hdtv_std_smpte_296m_720p_60:1;
+    unsigned int hdtv_std_smpte_296m_720p_50:1;
+    unsigned int hdtv_std_smpte_293m_480p_59:1;
+
+    unsigned int hdtv_std_smpte_170m_480i_59:1;
+    unsigned int hdtv_std_iturbt601_576i_50:1;
+    unsigned int hdtv_std_iturbt601_576p_50:1;
+    unsigned int hdtv_std_eia_7702a_480i_60:1;
+    unsigned int hdtv_std_eia_7702a_480p_60:1;
+    unsigned int pad:3;
+} __attribute__((packed));
 
 #define SDVO_CMD_GET_TV_FORMAT                          0x28
 
 #define SDVO_CMD_SET_TV_FORMAT                          0x29
 
+/** Returns the resolutiosn that can be used with the given TV format */
+#define SDVO_CMD_GET_SDTV_RESOLUTION_SUPPORT            0x83
+struct intel_sdvo_sdtv_resolution_request {
+    unsigned int ntsc_m:1;
+    unsigned int ntsc_j:1;
+    unsigned int ntsc_443:1;
+    unsigned int pal_b:1;
+    unsigned int pal_d:1;
+    unsigned int pal_g:1;
+    unsigned int pal_h:1;
+    unsigned int pal_i:1;
+
+    unsigned int pal_m:1;
+    unsigned int pal_n:1;
+    unsigned int pal_nc:1;
+    unsigned int pal_60:1;
+    unsigned int secam_b:1;
+    unsigned int secam_d:1;
+    unsigned int secam_g:1;
+    unsigned int secam_k:1;
+
+    unsigned int secam_k1:1;
+    unsigned int secam_l:1;
+    unsigned int secam_60:1;
+    unsigned int pad:5;
+} __attribute__((packed));
+
+struct intel_sdvo_sdtv_resolution_reply {
+    unsigned int res_320x200:1;
+    unsigned int res_320x240:1;
+    unsigned int res_400x300:1;
+    unsigned int res_640x350:1;
+    unsigned int res_640x400:1;
+    unsigned int res_640x480:1;
+    unsigned int res_704x480:1;
+    unsigned int res_704x576:1;
+
+    unsigned int res_720x350:1;
+    unsigned int res_720x400:1;
+    unsigned int res_720x480:1;
+    unsigned int res_720x540:1;
+    unsigned int res_720x576:1;
+    unsigned int res_768x576:1;
+    unsigned int res_800x600:1;
+    unsigned int res_832x624:1;
+
+    unsigned int res_920x766:1;
+    unsigned int res_1024x768:1;
+    unsigned int res_1280x1024:1;
+    unsigned int pad:5;
+} __attribute__((packed));
+
+/* Get supported resolution with squire pixel aspect ratio that can be
+   scaled for the requested HDTV format */
+#define SDVO_CMD_GET_SCALED_HDTV_RESOLUTION_SUPPORT             0x85
+
+struct intel_sdvo_hdtv_resolution_request {
+    unsigned int hdtv_std_smpte_240m_1080i_59:1;
+    unsigned int hdtv_std_smpte_240m_1080i_60:1;
+    unsigned int hdtv_std_smpte_260m_1080i_59:1;
+    unsigned int hdtv_std_smpte_260m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080i_50:1;
+    unsigned int hdtv_std_smpte_274m_1080i_59:1;
+    unsigned int hdtv_std_smpte_274m_1080i_60:1;
+    unsigned int hdtv_std_smpte_274m_1080p_23:1;
+
+    unsigned int hdtv_std_smpte_274m_1080p_24:1;
+    unsigned int hdtv_std_smpte_274m_1080p_25:1;
+    unsigned int hdtv_std_smpte_274m_1080p_29:1;
+    unsigned int hdtv_std_smpte_274m_1080p_30:1;
+    unsigned int hdtv_std_smpte_274m_1080p_50:1;
+    unsigned int hdtv_std_smpte_274m_1080p_59:1;
+    unsigned int hdtv_std_smpte_274m_1080p_60:1;
+    unsigned int hdtv_std_smpte_295m_1080i_50:1;
+
+    unsigned int hdtv_std_smpte_295m_1080p_50:1;
+    unsigned int hdtv_std_smpte_296m_720p_59:1;
+    unsigned int hdtv_std_smpte_296m_720p_60:1;
+    unsigned int hdtv_std_smpte_296m_720p_50:1;
+    unsigned int hdtv_std_smpte_293m_480p_59:1;
+    unsigned int hdtv_std_smpte_170m_480i_59:1;
+    unsigned int hdtv_std_iturbt601_576i_50:1;
+    unsigned int hdtv_std_iturbt601_576p_50:1;
+
+    unsigned int hdtv_std_eia_7702a_480i_60:1;
+    unsigned int hdtv_std_eia_7702a_480p_60:1;
+    unsigned int pad:6;
+} __attribute__((packed));
+
+struct intel_sdvo_hdtv_resolution_reply {
+    unsigned int res_640x480:1;
+    unsigned int res_800x600:1;
+    unsigned int res_1024x768:1;
+    unsigned int res_1280x960:1;
+    unsigned int res_1400x1050:1;
+    unsigned int res_1600x1200:1;
+    unsigned int res_1920x1440:1;
+    unsigned int res_2048x1536:1;
+
+    unsigned int res_2560x1920:1;
+    unsigned int res_3200x2400:1;
+    unsigned int res_3840x2880:1;
+    unsigned int pad1:5;
+
+    unsigned int res_848x480:1;
+    unsigned int res_1064x600:1;
+    unsigned int res_1280x720:1;
+    unsigned int res_1360x768:1;
+    unsigned int res_1704x960:1;
+    unsigned int res_1864x1050:1;
+    unsigned int res_1920x1080:1;
+    unsigned int res_2128x1200:1;
+
+    unsigned int res_2560x1400:1;
+    unsigned int res_2728x1536:1;
+    unsigned int res_3408x1920:1;
+    unsigned int res_4264x2400:1;
+    unsigned int res_5120x2880:1;
+    unsigned int pad2:3;
+
+    unsigned int res_768x480:1;
+    unsigned int res_960x600:1;
+    unsigned int res_1152x720:1;
+    unsigned int res_1124x768:1;
+    unsigned int res_1536x960:1;
+    unsigned int res_1680x1050:1;
+    unsigned int res_1728x1080:1;
+    unsigned int res_1920x1200:1;
+
+    unsigned int res_2304x1440:1;
+    unsigned int res_2456x1536:1;
+    unsigned int res_3072x1920:1;
+    unsigned int res_3840x2400:1;
+    unsigned int res_4608x2880:1;
+    unsigned int pad3:3;
+
+    unsigned int res_1280x1024:1;
+    unsigned int pad4:7;
+
+    unsigned int res_1280x768:1;
+    unsigned int pad5:7;
+} __attribute__((packed));
+
+/* Get supported power state returns info for encoder and monitor, rely on
+   last SetTargetInput and SetTargetOutput calls */
 #define SDVO_CMD_GET_SUPPORTED_POWER_STATES             0x2a
+/* Get power state returns info for encoder and monitor, rely on last
+   SetTargetInput and SetTargetOutput calls */
+#define SDVO_CMD_GET_POWER_STATE                        0x2b
 #define SDVO_CMD_GET_ENCODER_POWER_STATE                0x2b
 #define SDVO_CMD_SET_ENCODER_POWER_STATE                0x2c
 # define SDVO_ENCODER_STATE_ON                                  (1 << 0)
 # define SDVO_ENCODER_STATE_STANDBY                             (1 << 1)
 # define SDVO_ENCODER_STATE_SUSPEND                             (1 << 2)
 # define SDVO_ENCODER_STATE_OFF                                 (1 << 3)
+# define SDVO_MONITOR_STATE_ON                                  (1 << 4)
+# define SDVO_MONITOR_STATE_STANDBY                             (1 << 5)
+# define SDVO_MONITOR_STATE_SUSPEND                             (1 << 6)
+# define SDVO_MONITOR_STATE_OFF                                 (1 << 7)
+
+#define SDVO_CMD_GET_MAX_PANEL_POWER_SEQUENCING         0x2d
+#define SDVO_CMD_GET_PANEL_POWER_SEQUENCING             0x2e
+#define SDVO_CMD_SET_PANEL_POWER_SEQUENCING             0x2f
+/**
+ * The panel power sequencing parameters are in units of milliseconds.
+ * The high fields are bits 8:9 of the 10-bit values.
+ */
+struct sdvo_panel_power_sequencing {
+    u8 t0;
+    u8 t1;
+    u8 t2;
+    u8 t3;
+    u8 t4;
+
+    unsigned int t0_high:2;
+    unsigned int t1_high:2;
+    unsigned int t2_high:2;
+    unsigned int t3_high:2;
+
+    unsigned int t4_high:2;
+    unsigned int pad:6;
+} __attribute__((packed));
+
+#define SDVO_CMD_GET_MAX_BACKLIGHT_LEVEL                0x30
+struct sdvo_max_backlight_reply {
+    u8 max_value;
+    u8 default_value;
+} __attribute__((packed));
+
+#define SDVO_CMD_GET_BACKLIGHT_LEVEL                    0x31
+#define SDVO_CMD_SET_BACKLIGHT_LEVEL                    0x32
+
+#define SDVO_CMD_GET_AMBIENT_LIGHT                      0x33
+struct sdvo_get_ambient_light_reply {
+    u16 trip_low;
+    u16 trip_high;
+    u16 value;
+} __attribute__((packed));
+#define SDVO_CMD_SET_AMBIENT_LIGHT                      0x34
+struct sdvo_set_ambient_light_reply {
+    u16 trip_low;
+    u16 trip_high;
+    unsigned int enable:1;
+    unsigned int pad:7;
+} __attribute__((packed));
+
+/* Set display power state */
+#define SDVO_CMD_SET_DISPLAY_POWER_STATE                0x7d
+# define SDVO_DISPLAY_STATE_ON                          (1 << 0)
+# define SDVO_DISPLAY_STATE_STANDBY                     (1 << 1)
+# define SDVO_DISPLAY_STATE_SUSPEND                     (1 << 2)
+# define SDVO_DISPLAY_STATE_OFF                         (1 << 3)
+
+#define SDVO_CMD_GET_SUPPORTED_ENHANCEMENTS             0x84
+struct intel_sdvo_enhancements_reply {
+    unsigned int flicker_filter:1;
+    unsigned int flicker_filter_adaptive:1;
+    unsigned int flicker_filter_2d:1;
+    unsigned int saturation:1;
+    unsigned int hue:1;
+    unsigned int brightness:1;
+    unsigned int contrast:1;
+    unsigned int overscan_h:1;
+
+    unsigned int overscan_v:1;
+    unsigned int position_h:1;
+    unsigned int position_v:1;
+    unsigned int sharpness:1;
+    unsigned int dot_crawl:1;
+    unsigned int dither:1;
+    unsigned int max_tv_chroma_filter:1;
+    unsigned int max_tv_luma_filter:1;
+} __attribute__((packed));
+
+/* Picture enhancement limits below are dependent on the current TV format,
+ * and thus need to be queried and set after it.
+ */
+#define SDVO_CMD_GET_MAX_FLICKER_FITER                  0x4d
+#define SDVO_CMD_GET_MAX_ADAPTIVE_FLICKER_FITER         0x7b
+#define SDVO_CMD_GET_MAX_2D_FLICKER_FITER               0x52
+#define SDVO_CMD_GET_MAX_SATURATION                     0x55
+#define SDVO_CMD_GET_MAX_HUE                            0x58
+#define SDVO_CMD_GET_MAX_BRIGHTNESS                     0x5b
+#define SDVO_CMD_GET_MAX_CONTRAST                       0x5e
+#define SDVO_CMD_GET_MAX_OVERSCAN_H                     0x61
+#define SDVO_CMD_GET_MAX_OVERSCAN_V                     0x64
+#define SDVO_CMD_GET_MAX_POSITION_H                     0x67
+#define SDVO_CMD_GET_MAX_POSITION_V                     0x6a
+#define SDVO_CMD_GET_MAX_SHARPNESS_V                    0x6d
+#define SDVO_CMD_GET_MAX_TV_CHROMA                      0x74
+#define SDVO_CMD_GET_MAX_TV_LUMA                        0x77
+struct intel_sdvo_enhancement_limits_reply {
+    u16 max_value;
+    u16 default_value;
+} __attribute__((packed));
 
-#define SDVO_CMD_SET_TV_RESOLUTION_SUPPORT              0x93
+#define SDVO_CMD_GET_LVDS_PANEL_INFORMATION             0x7f
+#define SDVO_CMD_SET_LVDS_PANEL_INFORMATION             0x80
+# define SDVO_LVDS_COLOR_DEPTH_18                       (0 << 0)
+# define SDVO_LVDS_COLOR_DEPTH_24                       (1 << 0)
+# define SDVO_LVDS_CONNECTOR_SPWG                       (0 << 2)
+# define SDVO_LVDS_CONNECTOR_OPENLDI                    (1 << 2)
+# define SDVO_LVDS_SINGLE_CHANNEL                       (0 << 4)
+# define SDVO_LVDS_DUAL_CHANNEL                         (1 << 4)
+
+#define SDVO_CMD_GET_FLICKER_FILTER                     0x4e
+#define SDVO_CMD_SET_FLICKER_FILTER                     0x4f
+#define SDVO_CMD_GET_ADAPTIVE_FLICKER_FITER             0x50
+#define SDVO_CMD_SET_ADAPTIVE_FLICKER_FITER             0x51
+#define SDVO_CMD_GET_2D_FLICKER_FITER                   0x53
+#define SDVO_CMD_SET_2D_FLICKER_FITER                   0x54
+#define SDVO_CMD_GET_SATURATION                         0x56
+#define SDVO_CMD_SET_SATURATION                         0x57
+#define SDVO_CMD_GET_HUE                                0x59
+#define SDVO_CMD_SET_HUE                                0x5a
+#define SDVO_CMD_GET_BRIGHTNESS                         0x5c
+#define SDVO_CMD_SET_BRIGHTNESS                         0x5d
+#define SDVO_CMD_GET_CONTRAST                           0x5f
+#define SDVO_CMD_SET_CONTRAST                           0x60
+#define SDVO_CMD_GET_OVERSCAN_H                         0x62
+#define SDVO_CMD_SET_OVERSCAN_H                         0x63
+#define SDVO_CMD_GET_OVERSCAN_V                         0x65
+#define SDVO_CMD_SET_OVERSCAN_V                         0x66
+#define SDVO_CMD_GET_POSITION_H                         0x68
+#define SDVO_CMD_SET_POSITION_H                         0x69
+#define SDVO_CMD_GET_POSITION_V                         0x6b
+#define SDVO_CMD_SET_POSITION_V                         0x6c
+#define SDVO_CMD_GET_SHARPNESS                          0x6e
+#define SDVO_CMD_SET_SHARPNESS                          0x6f
+#define SDVO_CMD_GET_TV_CHROMA                          0x75
+#define SDVO_CMD_SET_TV_CHROMA                          0x76
+#define SDVO_CMD_GET_TV_LUMA                            0x78
+#define SDVO_CMD_SET_TV_LUMA                            0x79
+struct intel_sdvo_enhancements_arg {
+    u16 value;
+}__attribute__((packed));
+
+#define SDVO_CMD_GET_DOT_CRAWL                          0x70
+#define SDVO_CMD_SET_DOT_CRAWL                          0x71
+# define SDVO_DOT_CRAWL_ON                                      (1 << 0)
+# define SDVO_DOT_CRAWL_DEFAULT_ON                              (1 << 1)
+
+#define SDVO_CMD_GET_DITHER                             0x72
+#define SDVO_CMD_SET_DITHER                             0x73
+# define SDVO_DITHER_ON                                         (1 << 0)
+# define SDVO_DITHER_DEFAULT_ON                                 (1 << 1)
 
 #define SDVO_CMD_SET_CONTROL_BUS_SWITCH                 0x7a
-# define SDVO_CONTROL_BUS_PROM                          0x0
-# define SDVO_CONTROL_BUS_DDC1                          0x1
-# define SDVO_CONTROL_BUS_DDC2                          0x2
-# define SDVO_CONTROL_BUS_DDC3                          0x3
+# define SDVO_CONTROL_BUS_PROM                          (1 << 0)
+# define SDVO_CONTROL_BUS_DDC1                          (1 << 1)
+# define SDVO_CONTROL_BUS_DDC2                          (1 << 2)
+# define SDVO_CONTROL_BUS_DDC3                          (1 << 3)
+
+/* HDMI op codes */
+#define SDVO_CMD_GET_SUPP_ENCODE        0x9d
+#define SDVO_CMD_GET_ENCODE             0x9e
+#define SDVO_CMD_SET_ENCODE             0x9f
+  #define SDVO_ENCODE_DVI       0x0
+  #define SDVO_ENCODE_HDMI      0x1
+#define SDVO_CMD_SET_PIXEL_REPLI        0x8b
+#define SDVO_CMD_GET_PIXEL_REPLI        0x8c
+#define SDVO_CMD_GET_COLORIMETRY_CAP    0x8d
+#define SDVO_CMD_SET_COLORIMETRY        0x8e
+  #define SDVO_COLORIMETRY_RGB256   0x0
+  #define SDVO_COLORIMETRY_RGB220   0x1
+  #define SDVO_COLORIMETRY_YCrCb422 0x3
+  #define SDVO_COLORIMETRY_YCrCb444 0x4
+#define SDVO_CMD_GET_COLORIMETRY        0x8f
+#define SDVO_CMD_GET_AUDIO_ENCRYPT_PREFER 0x90
+#define SDVO_CMD_SET_AUDIO_STAT         0x91
+#define SDVO_CMD_GET_AUDIO_STAT         0x92
+#define SDVO_CMD_SET_HBUF_INDEX         0x93
+#define SDVO_CMD_GET_HBUF_INDEX         0x94
+#define SDVO_CMD_GET_HBUF_INFO          0x95
+#define SDVO_CMD_SET_HBUF_AV_SPLIT      0x96
+#define SDVO_CMD_GET_HBUF_AV_SPLIT      0x97
+#define SDVO_CMD_SET_HBUF_DATA          0x98
+#define SDVO_CMD_GET_HBUF_DATA          0x99
+#define SDVO_CMD_SET_HBUF_TXRATE        0x9a
+#define SDVO_CMD_GET_HBUF_TXRATE        0x9b
+  #define SDVO_HBUF_TX_DISABLED (0 << 6)
+  #define SDVO_HBUF_TX_ONCE     (2 << 6)
+  #define SDVO_HBUF_TX_VSYNC    (3 << 6)
+#define SDVO_CMD_GET_AUDIO_TX_INFO      0x9c
+
+struct intel_sdvo_encode{
+    u8 dvi_rev;
+    u8 hdmi_rev;
+} __attribute__ ((packed));
diff --git a/drivers/gpu/drm/radeon/radeon_cp.c b/drivers/gpu/drm/radeon/radeon_cp.c
index 63212d7bbc2..df4cf97e5d9 100644
--- a/drivers/gpu/drm/radeon/radeon_cp.c
+++ b/drivers/gpu/drm/radeon/radeon_cp.c
@@ -1039,9 +1039,9 @@ static int radeon_do_init_cp(struct drm_device *dev, drm_radeon_init_t *init,
 
 #if __OS_HAS_AGP
         if (dev_priv->flags & RADEON_IS_AGP) {
-                drm_core_ioremap(dev_priv->cp_ring, dev);
-                drm_core_ioremap(dev_priv->ring_rptr, dev);
-                drm_core_ioremap(dev->agp_buffer_map, dev);
+                drm_core_ioremap_wc(dev_priv->cp_ring, dev);
+                drm_core_ioremap_wc(dev_priv->ring_rptr, dev);
+                drm_core_ioremap_wc(dev->agp_buffer_map, dev);
                 if (!dev_priv->cp_ring->handle ||
                     !dev_priv->ring_rptr->handle ||
                     !dev->agp_buffer_map->handle) {
diff --git a/drivers/hwmon/hp_accel.c b/drivers/hwmon/hp_accel.c
index 03705240000..abf4dfc8ec2 100644
--- a/drivers/hwmon/hp_accel.c
+++ b/drivers/hwmon/hp_accel.c
@@ -153,7 +153,10 @@ static struct axis_conversion lis3lv02d_axis_y_inverted = {1, -2, 3};
 static struct axis_conversion lis3lv02d_axis_x_inverted = {-1, 2, 3};
 static struct axis_conversion lis3lv02d_axis_z_inverted = {1, 2, -3};
 static struct axis_conversion lis3lv02d_axis_xy_rotated_left = {-2, 1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_rotated_left_usd = {-2, 1, -3};
 static struct axis_conversion lis3lv02d_axis_xy_swap_inverted = {-2, -1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_rotated_right = {2, -1, 3};
+static struct axis_conversion lis3lv02d_axis_xy_swap_yz_inverted = {2, -1, -3};
 
 #define AXIS_DMI_MATCH(_ident, _name, _axis) {          \
         .ident = _ident,                                \
@@ -172,10 +175,12 @@ static struct dmi_system_id lis3lv02d_dmi_ids[] = {
         AXIS_DMI_MATCH("NC2510", "HP Compaq 2510", y_inverted),
         AXIS_DMI_MATCH("NC8510", "HP Compaq 8510", xy_swap_inverted),
         AXIS_DMI_MATCH("HP2133", "HP 2133", xy_rotated_left),
+        AXIS_DMI_MATCH("NC653x", "HP Compaq 653", xy_rotated_left_usd),
+        AXIS_DMI_MATCH("NC673x", "HP Compaq 673", xy_rotated_left_usd),
+        AXIS_DMI_MATCH("NC651xx", "HP Compaq 651", xy_rotated_right),
+        AXIS_DMI_MATCH("NC671xx", "HP Compaq 671", xy_swap_yz_inverted),
         { NULL, }
 /* Laptop models without axis info (yet):
- * "NC651xx" "HP Compaq 651"
- * "NC671xx" "HP Compaq 671"
  * "NC6910" "HP Compaq 6910"
  * HP Compaq 8710x Notebook PC / Mobile Workstation
  * "NC2400" "HP Compaq nc2400"
diff --git a/drivers/ide/Kconfig b/drivers/ide/Kconfig
index b1c6f68d98c..3dad2299d9c 100644
--- a/drivers/ide/Kconfig
+++ b/drivers/ide/Kconfig
@@ -465,6 +465,16 @@ config BLK_DEV_CS5535
 
           It is safe to say Y to this question.
 
+config BLK_DEV_CS5536
+        tristate "CS5536 chipset support"
+        depends on X86_32
+        select BLK_DEV_IDEDMA_PCI
+        help
+          This option enables support for the AMD CS5536
+          companion chip used with the Geode LX processor family.
+
+          If unsure, say N.
+
 config BLK_DEV_HPT366
         tristate "HPT36X/37X chipset support"
         select BLK_DEV_IDEDMA_PCI
diff --git a/drivers/ide/Makefile b/drivers/ide/Makefile
index c2b9c93f009..d0e3d7d5b46 100644
--- a/drivers/ide/Makefile
+++ b/drivers/ide/Makefile
@@ -43,6 +43,7 @@ obj-$(CONFIG_BLK_DEV_CMD64X)		+= cmd64x.o
 obj-$(CONFIG_BLK_DEV_CS5520)            += cs5520.o
 obj-$(CONFIG_BLK_DEV_CS5530)            += cs5530.o
 obj-$(CONFIG_BLK_DEV_CS5535)            += cs5535.o
+obj-$(CONFIG_BLK_DEV_CS5536)            += cs5536.o
 obj-$(CONFIG_BLK_DEV_SC1200)            += sc1200.o
 obj-$(CONFIG_BLK_DEV_CY82C693)          += cy82c693.o
 obj-$(CONFIG_BLK_DEV_DELKIN)            += delkin_cb.o
diff --git a/drivers/ide/cs5536.c b/drivers/ide/cs5536.c
new file mode 100644
index 00000000000..7a62db719a4
--- /dev/null
+++ b/drivers/ide/cs5536.c
@@ -0,0 +1,308 @@
+/*
+ * CS5536 PATA support
+ * (C) 2007 Martin K. Petersen <mkp@mkp.net>
+ * (C) 2009 Bartlomiej Zolnierkiewicz
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 59 Temple Place, Suite 330, Boston, MA  02111-1307  USA
+ *
+ * Documentation:
+ *      Available from AMD web site.
+ *
+ * The IDE timing registers for the CS5536 live in the Geode Machine
+ * Specific Register file and not PCI config space.  Most BIOSes
+ * virtualize the PCI registers so the chip looks like a standard IDE
+ * controller.  Unfortunately not all implementations get this right.
+ * In particular some have problems with unaligned accesses to the
+ * virtualized PCI registers.  This driver always does full dword
+ * writes to work around the issue.  Also, in case of a bad BIOS this
+ * driver can be loaded with the "msr=1" parameter which forces using
+ * the Machine Specific Registers to configure the device.
+ */
+
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/pci.h>
+#include <linux/init.h>
+#include <linux/ide.h>
+#include <asm/msr.h>
+
+#define DRV_NAME        "cs5536"
+
+enum {
+        MSR_IDE_CFG             = 0x51300010,
+        PCI_IDE_CFG             = 0x40,
+
+        CFG                     = 0,
+        DTC                     = 2,
+        CAST                    = 3,
+        ETC                     = 4,
+
+        IDE_CFG_CHANEN          = (1 << 1),
+        IDE_CFG_CABLE           = (1 << 17) | (1 << 16),
+
+        IDE_D0_SHIFT            = 24,
+        IDE_D1_SHIFT            = 16,
+        IDE_DRV_MASK            = 0xff,
+
+        IDE_CAST_D0_SHIFT       = 6,
+        IDE_CAST_D1_SHIFT       = 4,
+        IDE_CAST_DRV_MASK       = 0x3,
+
+        IDE_CAST_CMD_SHIFT      = 24,
+        IDE_CAST_CMD_MASK       = 0xff,
+
+        IDE_ETC_UDMA_MASK       = 0xc0,
+};
+
+static int use_msr;
+
+static int cs5536_read(struct pci_dev *pdev, int reg, u32 *val)
+{
+        if (unlikely(use_msr)) {
+                u32 dummy;
+
+                rdmsr(MSR_IDE_CFG + reg, *val, dummy);
+                return 0;
+        }
+
+        return pci_read_config_dword(pdev, PCI_IDE_CFG + reg * 4, val);
+}
+
+static int cs5536_write(struct pci_dev *pdev, int reg, int val)
+{
+        if (unlikely(use_msr)) {
+                wrmsr(MSR_IDE_CFG + reg, val, 0);
+                return 0;
+        }
+
+        return pci_write_config_dword(pdev, PCI_IDE_CFG + reg * 4, val);
+}
+
+static void cs5536_program_dtc(ide_drive_t *drive, u8 tim)
+{
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        int dshift = (drive->dn & 1) ? IDE_D1_SHIFT : IDE_D0_SHIFT;
+        u32 dtc;
+
+        cs5536_read(pdev, DTC, &dtc);
+        dtc &= ~(IDE_DRV_MASK << dshift);
+        dtc |= tim << dshift;
+        cs5536_write(pdev, DTC, dtc);
+}
+
+/**
+ *      cs5536_cable_detect     -       detect cable type
+ *      @hwif: Port to detect on
+ *
+ *      Perform cable detection for ATA66 capable cable.
+ *
+ *      Returns a cable type.
+ */
+
+static u8 cs5536_cable_detect(ide_hwif_t *hwif)
+{
+        struct pci_dev *pdev = to_pci_dev(hwif->dev);
+        u32 cfg;
+
+        cs5536_read(pdev, CFG, &cfg);
+
+        if (cfg & IDE_CFG_CABLE)
+                return ATA_CBL_PATA80;
+        else
+                return ATA_CBL_PATA40;
+}
+
+/**
+ *      cs5536_set_pio_mode             -       PIO timing setup
+ *      @drive: ATA device
+ *      @pio: PIO mode number
+ */
+
+static void cs5536_set_pio_mode(ide_drive_t *drive, const u8 pio)
+{
+        static const u8 drv_timings[5] = {
+                0x98, 0x55, 0x32, 0x21, 0x20,
+        };
+
+        static const u8 addr_timings[5] = {
+                0x2, 0x1, 0x0, 0x0, 0x0,
+        };
+
+        static const u8 cmd_timings[5] = {
+                0x99, 0x92, 0x90, 0x22, 0x20,
+        };
+
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        ide_drive_t *pair = ide_get_pair_dev(drive);
+        int cshift = (drive->dn & 1) ? IDE_CAST_D1_SHIFT : IDE_CAST_D0_SHIFT;
+        u32 cast;
+        u8 cmd_pio = pio;
+
+        if (pair)
+                cmd_pio = min(pio, ide_get_best_pio_mode(pair, 255, 4));
+
+        drive->drive_data &= (IDE_DRV_MASK << 8);
+        drive->drive_data |= drv_timings[pio];
+
+        cs5536_program_dtc(drive, drv_timings[pio]);
+
+        cs5536_read(pdev, CAST, &cast);
+
+        cast &= ~(IDE_CAST_DRV_MASK << cshift);
+        cast |= addr_timings[pio] << cshift;
+
+        cast &= ~(IDE_CAST_CMD_MASK << IDE_CAST_CMD_SHIFT);
+        cast |= cmd_timings[cmd_pio] << IDE_CAST_CMD_SHIFT;
+
+        cs5536_write(pdev, CAST, cast);
+}
+
+/**
+ *      cs5536_set_dma_mode             -       DMA timing setup
+ *      @drive: ATA device
+ *      @mode: DMA mode
+ */
+
+static void cs5536_set_dma_mode(ide_drive_t *drive, const u8 mode)
+{
+        static const u8 udma_timings[6] = {
+                0xc2, 0xc1, 0xc0, 0xc4, 0xc5, 0xc6,
+        };
+
+        static const u8 mwdma_timings[3] = {
+                0x67, 0x21, 0x20,
+        };
+
+        struct pci_dev *pdev = to_pci_dev(drive->hwif->dev);
+        int dshift = (drive->dn & 1) ? IDE_D1_SHIFT : IDE_D0_SHIFT;
+        u32 etc;
+
+        cs5536_read(pdev, ETC, &etc);
+
+        if (mode >= XFER_UDMA_0) {
+                etc &= ~(IDE_DRV_MASK << dshift);
+                etc |= udma_timings[mode - XFER_UDMA_0] << dshift;
+        } else { /* MWDMA */
+                etc &= ~(IDE_ETC_UDMA_MASK << dshift);
+                drive->drive_data &= IDE_DRV_MASK;
+                drive->drive_data |= mwdma_timings[mode - XFER_MW_DMA_0] << 8;
+        }
+
+        cs5536_write(pdev, ETC, etc);
+}
+
+static void cs5536_dma_start(ide_drive_t *drive)
+{
+        if (drive->current_speed < XFER_UDMA_0 &&
+            (drive->drive_data >> 8) != (drive->drive_data & IDE_DRV_MASK))
+                cs5536_program_dtc(drive, drive->drive_data >> 8);
+
+        ide_dma_start(drive);
+}
+
+static int cs5536_dma_end(ide_drive_t *drive)
+{
+        int ret = ide_dma_end(drive);
+
+        if (drive->current_speed < XFER_UDMA_0 &&
+            (drive->drive_data >> 8) != (drive->drive_data & IDE_DRV_MASK))
+                cs5536_program_dtc(drive, drive->drive_data & IDE_DRV_MASK);
+
+        return ret;
+}
+
+static const struct ide_port_ops cs5536_port_ops = {
+        .set_pio_mode           = cs5536_set_pio_mode,
+        .set_dma_mode           = cs5536_set_dma_mode,
+        .cable_detect           = cs5536_cable_detect,
+};
+
+static const struct ide_dma_ops cs5536_dma_ops = {
+        .dma_host_set           = ide_dma_host_set,
+        .dma_setup              = ide_dma_setup,
+        .dma_exec_cmd           = ide_dma_exec_cmd,
+        .dma_start              = cs5536_dma_start,
+        .dma_end                = cs5536_dma_end,
+        .dma_test_irq           = ide_dma_test_irq,
+        .dma_lost_irq           = ide_dma_lost_irq,
+        .dma_timeout            = ide_dma_timeout,
+};
+
+static const struct ide_port_info cs5536_info = {
+        .name           = DRV_NAME,
+        .port_ops       = &cs5536_port_ops,
+        .dma_ops        = &cs5536_dma_ops,
+        .host_flags     = IDE_HFLAG_SINGLE,
+        .pio_mask       = ATA_PIO4,
+        .mwdma_mask     = ATA_MWDMA2,
+        .udma_mask      = ATA_UDMA5,
+};
+
+/**
+ *      cs5536_init_one
+ *      @dev: PCI device
+ *      @id: Entry in match table
+ */
+
+static int cs5536_init_one(struct pci_dev *dev, const struct pci_device_id *id)
+{
+        u32 cfg;
+
+        if (use_msr)
+                printk(KERN_INFO DRV_NAME ": Using MSR regs instead of PCI\n");
+
+        cs5536_read(dev, CFG, &cfg);
+
+        if ((cfg & IDE_CFG_CHANEN) == 0) {
+                printk(KERN_ERR DRV_NAME ": disabled by BIOS\n");
+                return -ENODEV;
+        }
+
+        return ide_pci_init_one(dev, &cs5536_info, NULL);
+}
+
+static const struct pci_device_id cs5536_pci_tbl[] = {
+        { PCI_VDEVICE(AMD, PCI_DEVICE_ID_AMD_CS5536_IDE), },
+        { },
+};
+
+static struct pci_driver cs5536_pci_driver = {
+        .name           = DRV_NAME,
+        .id_table       = cs5536_pci_tbl,
+        .probe          = cs5536_init_one,
+        .remove         = ide_pci_remove,
+        .suspend        = ide_pci_suspend,
+        .resume         = ide_pci_resume,
+};
+
+static int __init cs5536_init(void)
+{
+        return pci_register_driver(&cs5536_pci_driver);
+}
+
+static void __exit cs5536_exit(void)
+{
+        pci_unregister_driver(&cs5536_pci_driver);
+}
+
+MODULE_AUTHOR("Martin K. Petersen, Bartlomiej Zolnierkiewicz");
+MODULE_DESCRIPTION("low-level driver for the CS5536 IDE controller");
+MODULE_LICENSE("GPL");
+MODULE_DEVICE_TABLE(pci, cs5536_pci_tbl);
+
+module_param_named(msr, use_msr, int, 0644);
+MODULE_PARM_DESC(msr, "Force using MSR to configure IDE function (Default: 0)");
+
+module_init(cs5536_init);
+module_exit(cs5536_exit);
diff --git a/drivers/ide/icside.c b/drivers/ide/icside.c
index 97a35c667ae..415d7e24f2b 100644
--- a/drivers/ide/icside.c
+++ b/drivers/ide/icside.c
@@ -534,7 +534,7 @@ icside_register_v6(struct icside_state *state, struct expansion_card *ec)
                 d.dma_ops = NULL;
         }
 
-        ret = ide_host_register(host, NULL, hws);
+        ret = ide_host_register(host, &d, hws);
         if (ret)
                 goto err_free;
 
diff --git a/drivers/ide/ide-acpi.c b/drivers/ide/ide-acpi.c
index d8f295bdad7..ec7d07fa570 100644
--- a/drivers/ide/ide-acpi.c
+++ b/drivers/ide/ide-acpi.c
@@ -282,7 +282,7 @@ static int do_drive_get_GTF(ide_drive_t *drive,
         port = hwif->channel ? drive->dn - 2: drive->dn;
 
         DEBPRINT("ENTER: %s at %s, port#: %d, hard_port#: %d\n",
-                 hwif->name, dev->bus_id, port, hwif->channel);
+                 hwif->name, dev_name(dev), port, hwif->channel);
 
         if ((drive->dev_flags & IDE_DFLAG_PRESENT) == 0) {
                 DEBPRINT("%s drive %d:%d not present\n",
diff --git a/drivers/ide/ide-cd.c b/drivers/ide/ide-cd.c
index cae69372cf4..0bfeb0c79d6 100644
--- a/drivers/ide/ide-cd.c
+++ b/drivers/ide/ide-cd.c
@@ -787,6 +787,9 @@ static ide_startstop_t cdrom_newpc_intr(ide_drive_t *drive)
                 if (blk_fs_request(rq)) {
                         ide_end_request(drive, 1, rq->nr_sectors);
                         return ide_stopped;
+                } else if (rq->cmd_type == REQ_TYPE_ATA_PC && !rq->bio) {
+                        ide_end_request(drive, 1, 1);
+                        return ide_stopped;
                 }
                 goto end_request;
         }
diff --git a/drivers/ide/ide-io.c b/drivers/ide/ide-io.c
index cc163319dfb..9ee51adf567 100644
--- a/drivers/ide/ide-io.c
+++ b/drivers/ide/ide-io.c
@@ -418,11 +418,14 @@ void ide_map_sg(ide_drive_t *drive, struct request *rq)
         ide_hwif_t *hwif = drive->hwif;
         struct scatterlist *sg = hwif->sg_table;
 
-        if (rq->cmd_type != REQ_TYPE_ATA_TASKFILE) {
-                hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
-        } else {
+        if (rq->cmd_type == REQ_TYPE_ATA_TASKFILE) {
                 sg_init_one(sg, rq->buffer, rq->nr_sectors * SECTOR_SIZE);
                 hwif->sg_nents = 1;
+        } else if (!rq->bio) {
+                sg_init_one(sg, rq->data, rq->data_len);
+                hwif->sg_nents = 1;
+        } else {
+                hwif->sg_nents = blk_rq_map_sg(drive->queue, rq, sg);
         }
 }
 
diff --git a/drivers/ide/ide-probe.c b/drivers/ide/ide-probe.c
index 0db1ed9f5fc..ce0818a993f 100644
--- a/drivers/ide/ide-probe.c
+++ b/drivers/ide/ide-probe.c
@@ -1467,6 +1467,30 @@ struct ide_host *ide_host_alloc(const struct ide_port_info *d, hw_regs_t **hws)
 }
 EXPORT_SYMBOL_GPL(ide_host_alloc);
 
+static void ide_port_free(ide_hwif_t *hwif)
+{
+        ide_port_free_devices(hwif);
+        ide_free_port_slot(hwif->index);
+        kfree(hwif);
+}
+
+static void ide_disable_port(ide_hwif_t *hwif)
+{
+        struct ide_host *host = hwif->host;
+        int i;
+
+        printk(KERN_INFO "%s: disabling port\n", hwif->name);
+
+        for (i = 0; i < MAX_HOST_PORTS; i++) {
+                if (host->ports[i] == hwif) {
+                        host->ports[i] = NULL;
+                        host->n_ports--;
+                }
+        }
+
+        ide_port_free(hwif);
+}
+
 int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                       hw_regs_t **hws)
 {
@@ -1507,8 +1531,12 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                         hwif->present = 1;
 
                 if (hwif->chipset != ide_4drives || !hwif->mate ||
-                    !hwif->mate->present)
-                        ide_register_port(hwif);
+                    !hwif->mate->present) {
+                        if (ide_register_port(hwif)) {
+                                ide_disable_port(hwif);
+                                continue;
+                        }
+                }
 
                 if (hwif->present)
                         ide_port_tune_devices(hwif);
@@ -1521,7 +1549,8 @@ int ide_host_register(struct ide_host *host, const struct ide_port_info *d,
                 if (hwif_init(hwif) == 0) {
                         printk(KERN_INFO "%s: failed to initialize IDE "
                                          "interface\n", hwif->name);
-                        hwif->present = 0;
+                        device_unregister(&hwif->gendev);
+                        ide_disable_port(hwif);
                         continue;
                 }
 
@@ -1660,12 +1689,8 @@ void ide_host_free(struct ide_host *host)
         int i;
 
         ide_host_for_each_port(i, hwif, host) {
-                if (hwif == NULL)
-                        continue;
-
-                ide_port_free_devices(hwif);
-                ide_free_port_slot(hwif->index);
-                kfree(hwif);
+                if (hwif)
+                        ide_port_free(hwif);
         }
 
         kfree(host);
diff --git a/drivers/ide/qd65xx.c b/drivers/ide/qd65xx.c
index 5b2e3af43c4..08c4fa35e9b 100644
--- a/drivers/ide/qd65xx.c
+++ b/drivers/ide/qd65xx.c
@@ -16,7 +16,7 @@
 
 /*
  * Rewritten from the work of Colten Edwards <pje120@cs.usask.ca> by
- * Samuel Thibault <samuel.thibault@fnac.net>
+ * Samuel Thibault <samuel.thibault@ens-lyon.org>
  */
 
 #include <linux/module.h>
diff --git a/drivers/ide/qd65xx.h b/drivers/ide/qd65xx.h
index 6636f9665d1..d7e67a1a1dc 100644
--- a/drivers/ide/qd65xx.h
+++ b/drivers/ide/qd65xx.h
@@ -4,7 +4,7 @@
 
 /*
  * Authors:     Petr Soucek <petr@ryston.cz>
- *              Samuel Thibault <samuel.thibault@fnac.net>
+ *              Samuel Thibault <samuel.thibault@ens-lyon.org>
  */
 
 /* truncates a in [b,c] */
diff --git a/drivers/ide/tx4939ide.c b/drivers/ide/tx4939ide.c
index 882f6f07c47..40b0812a045 100644
--- a/drivers/ide/tx4939ide.c
+++ b/drivers/ide/tx4939ide.c
@@ -261,9 +261,9 @@ static int tx4939ide_build_dmatable(ide_drive_t *drive, struct request *rq)
                                 bcount = cur_len;
                         /*
                          * This workaround for zero count seems required.
-                         * (standard ide_build_dmatable do it too)
+                         * (standard ide_build_dmatable does it too)
                          */
-                        if ((bcount & 0xffff) == 0x0000)
+                        if (bcount == 0x10000)
                                 bcount = 0x8000;
                         *table++ = bcount & 0xffff;
                         *table++ = cur_addr;
diff --git a/drivers/ide/via82cxxx.c b/drivers/ide/via82cxxx.c
index 703c3eeb20a..6092fe3f409 100644
--- a/drivers/ide/via82cxxx.c
+++ b/drivers/ide/via82cxxx.c
@@ -448,6 +448,11 @@ static int __devinit via_init_one(struct pci_dev *dev, const struct pci_device_i
                 d.host_flags |= IDE_HFLAG_FORCE_LEGACY_IRQS;
 #endif
 
+#ifdef CONFIG_AMIGAONE
+        if (machine_is(amigaone))
+                d.host_flags |= IDE_HFLAG_FORCE_LEGACY_IRQS;
+#endif
+
         d.udma_mask = via_config->udma_mask;
 
         vdev = kzalloc(sizeof(*vdev), GFP_KERNEL);
diff --git a/drivers/ieee1394/dv1394.c b/drivers/ieee1394/dv1394.c
index a329e6bd5d2..3838bc4acab 100644
--- a/drivers/ieee1394/dv1394.c
+++ b/drivers/ieee1394/dv1394.c
@@ -1823,6 +1823,10 @@ static int dv1394_open(struct inode *inode, struct file *file)
 
 #endif
 
+        printk(KERN_INFO "%s: NOTE, the dv1394 interface is unsupported "
+               "and will not be available in the new firewire driver stack. "
+               "Try libraw1394 based programs instead.\n", current->comm);
+
         return 0;
 }
 
@@ -2567,10 +2571,6 @@ static int __init dv1394_init_module(void)
 {
         int ret;
 
-        printk(KERN_WARNING
-               "NOTE: The dv1394 driver is unsupported and may be removed in a "
-               "future Linux release. Use raw1394 instead.\n");
-
         cdev_init(&dv1394_cdev, &dv1394_fops);
         dv1394_cdev.owner = THIS_MODULE;
         ret = cdev_add(&dv1394_cdev, IEEE1394_DV1394_DEV, 16);
diff --git a/drivers/input/keyboard/Kconfig b/drivers/input/keyboard/Kconfig
index 35561689ff3..ea2638b4198 100644
--- a/drivers/input/keyboard/Kconfig
+++ b/drivers/input/keyboard/Kconfig
@@ -13,11 +13,11 @@ menuconfig INPUT_KEYBOARD
 if INPUT_KEYBOARD
 
 config KEYBOARD_ATKBD
-        tristate "AT keyboard" if EMBEDDED || !X86_PC
+        tristate "AT keyboard" if EMBEDDED || !X86
         default y
         select SERIO
         select SERIO_LIBPS2
-        select SERIO_I8042 if X86_PC
+        select SERIO_I8042 if X86
         select SERIO_GSCPS2 if GSC
         help
           Say Y here if you want to use a standard AT or PS/2 keyboard. Usually
diff --git a/drivers/input/mouse/Kconfig b/drivers/input/mouse/Kconfig
index 093c8c1bca7..9bef935ef19 100644
--- a/drivers/input/mouse/Kconfig
+++ b/drivers/input/mouse/Kconfig
@@ -17,7 +17,7 @@ config MOUSE_PS2
         default y
         select SERIO
         select SERIO_LIBPS2
-        select SERIO_I8042 if X86_PC
+        select SERIO_I8042 if X86
         select SERIO_GSCPS2 if GSC
         help
           Say Y here if you have a PS/2 mouse connected to your system. This
diff --git a/drivers/isdn/hardware/mISDN/hfcmulti.c b/drivers/isdn/hardware/mISDN/hfcmulti.c
index 595ba8eb4a0..0b28141e43b 100644
--- a/drivers/isdn/hardware/mISDN/hfcmulti.c
+++ b/drivers/isdn/hardware/mISDN/hfcmulti.c
@@ -4599,6 +4599,7 @@ init_e1_port(struct hfc_multi *hc, struct hm_map *m)
                         printk(KERN_ERR "%s: no memory for coeffs\n",
                             __func__);
                         ret = -ENOMEM;
+                        kfree(bch);
                         goto free_chan;
                 }
                 bch->nr = ch;
@@ -4767,6 +4768,7 @@ init_multi_port(struct hfc_multi *hc, int pt)
                         printk(KERN_ERR "%s: no memory for coeffs\n",
                             __func__);
                         ret = -ENOMEM;
+                        kfree(bch);
                         goto free_chan;
                 }
                 bch->nr = ch + 1;
diff --git a/drivers/md/linear.c b/drivers/md/linear.c
index 1e3aea9eecf..09658b21847 100644
--- a/drivers/md/linear.c
+++ b/drivers/md/linear.c
@@ -25,13 +25,13 @@ static inline dev_info_t *which_dev(mddev_t *mddev, sector_t sector)
 {
         dev_info_t *hash;
         linear_conf_t *conf = mddev_to_conf(mddev);
+        sector_t idx = sector >> conf->sector_shift;
 
         /*
          * sector_div(a,b) returns the remainer and sets a to a/b
          */
-        sector >>= conf->sector_shift;
-        (void)sector_div(sector, conf->spacing);
-        hash = conf->hash_table[sector];
+        (void)sector_div(idx, conf->spacing);
+        hash = conf->hash_table[idx];
 
         while (sector >= hash->num_sectors + hash->start_sector)
                 hash++;
diff --git a/drivers/md/md.c b/drivers/md/md.c
index 41e2509bf89..4495104f6c9 100644
--- a/drivers/md/md.c
+++ b/drivers/md/md.c
@@ -1481,6 +1481,11 @@ static int bind_rdev_to_array(mdk_rdev_t * rdev, mddev_t * mddev)
                 if (find_rdev_nr(mddev, rdev->desc_nr))
                         return -EBUSY;
         }
+        if (mddev->max_disks && rdev->desc_nr >= mddev->max_disks) {
+                printk(KERN_WARNING "md: %s: array is limited to %d devices\n",
+                       mdname(mddev), mddev->max_disks);
+                return -EBUSY;
+        }
         bdevname(rdev->bdev,b);
         while ( (s=strchr(b, '/')) != NULL)
                 *s = '!';
@@ -2441,6 +2446,15 @@ static void analyze_sbs(mddev_t * mddev)
 
         i = 0;
         rdev_for_each(rdev, tmp, mddev) {
+                if (rdev->desc_nr >= mddev->max_disks ||
+                    i > mddev->max_disks) {
+                        printk(KERN_WARNING
+                               "md: %s: %s: only %d devices permitted\n",
+                               mdname(mddev), bdevname(rdev->bdev, b),
+                               mddev->max_disks);
+                        kick_rdev_from_array(rdev);
+                        continue;
+                }
                 if (rdev != freshest)
                         if (super_types[mddev->major_version].
                             validate_super(mddev, rdev)) {
@@ -4614,13 +4628,6 @@ static int hot_add_disk(mddev_t * mddev, dev_t dev)
          * noticed in interrupt contexts ...
          */
 
-        if (rdev->desc_nr == mddev->max_disks) {
-                printk(KERN_WARNING "%s: can not hot-add to full array!\n",
-                        mdname(mddev));
-                err = -EBUSY;
-                goto abort_unbind_export;
-        }
-
         rdev->raid_disk = -1;
 
         md_update_sb(mddev, 1);
@@ -4634,9 +4641,6 @@ static int hot_add_disk(mddev_t * mddev, dev_t dev)
         md_new_event(mddev);
         return 0;
 
-abort_unbind_export:
-        unbind_rdev_from_array(rdev);
-
 abort_export:
         export_rdev(rdev);
         return err;
diff --git a/drivers/md/raid1.c b/drivers/md/raid1.c
index 7b4f5f7155d..01e3cffd03b 100644
--- a/drivers/md/raid1.c
+++ b/drivers/md/raid1.c
@@ -1640,7 +1640,8 @@ static void raid1d(mddev_t *mddev)
                         }
 
                         bio = r1_bio->bios[r1_bio->read_disk];
-                        if ((disk=read_balance(conf, r1_bio)) == -1) {
+                        if ((disk=read_balance(conf, r1_bio)) == -1 ||
+                            disk == r1_bio->read_disk) {
                                 printk(KERN_ALERT "raid1: %s: unrecoverable I/O"
                                        " read error for block %llu\n",
                                        bdevname(bio->bi_bdev,b),
diff --git a/drivers/media/common/saa7146_video.c b/drivers/media/common/saa7146_video.c
index 6098b626811..47fee05eaef 100644
--- a/drivers/media/common/saa7146_video.c
+++ b/drivers/media/common/saa7146_video.c
@@ -576,6 +576,7 @@ static int set_control(struct saa7146_fh *fh, struct v4l2_control *c)
                 vv->vflip = c->value;
                 break;
         default: {
+                mutex_unlock(&dev->lock);
                 return -EINVAL;
         }
         }
diff --git a/drivers/media/common/tuners/mxl5007t.c b/drivers/media/common/tuners/mxl5007t.c
index 64379f2bf23..3ec28945c26 100644
--- a/drivers/media/common/tuners/mxl5007t.c
+++ b/drivers/media/common/tuners/mxl5007t.c
@@ -657,7 +657,7 @@ static int mxl5007t_get_status(struct dvb_frontend *fe, u32 *status)
 {
         struct mxl5007t_state *state = fe->tuner_priv;
         int rf_locked, ref_locked;
-        s32 rf_input_level;
+        s32 rf_input_level = 0;
         int ret;
 
         if (fe->ops.i2c_gate_ctrl)
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
index 98ee16773ff..7e3aeaa7370 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
@@ -93,6 +93,9 @@ struct dvb_ca_slot {
         /* current state of the CAM */
         int slot_state;
 
+        /* mutex used for serializing access to one CI slot */
+        struct mutex slot_lock;
+
         /* Number of CAMCHANGES that have occurred since last processing */
         atomic_t camchange_count;
 
@@ -711,14 +714,20 @@ static int dvb_ca_en50221_write_data(struct dvb_ca_private *ca, int slot, u8 * b
         dprintk("%s\n", __func__);
 
 
-        // sanity check
+        /* sanity check */
         if (bytes_write > ca->slot_info[slot].link_buf_size)
                 return -EINVAL;
 
-        /* check if interface is actually waiting for us to read from it, or if a read is in progress */
+        /* it is possible we are dealing with a single buffer implementation,
+           thus if there is data available for read or if there is even a read
+           already in progress, we do nothing but awake the kernel thread to
+           process the data if necessary. */
         if ((status = ca->pub->read_cam_control(ca->pub, slot, CTRLIF_STATUS)) < 0)
                 goto exitnowrite;
         if (status & (STATUSREG_DA | STATUSREG_RE)) {
+                if (status & STATUSREG_DA)
+                        dvb_ca_en50221_thread_wakeup(ca);
+
                 status = -EAGAIN;
                 goto exitnowrite;
         }
@@ -987,6 +996,8 @@ static int dvb_ca_en50221_thread(void *data)
                 /* go through all the slots processing them */
                 for (slot = 0; slot < ca->slot_count; slot++) {
 
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
+
                         // check the cam status + deal with CAMCHANGEs
                         while (dvb_ca_en50221_check_camstatus(ca, slot)) {
                                 /* clear down an old CI slot if necessary */
@@ -1122,7 +1133,7 @@ static int dvb_ca_en50221_thread(void *data)
 
                         case DVB_CA_SLOTSTATE_RUNNING:
                                 if (!ca->open)
-                                        continue;
+                                        break;
 
                                 // poll slots for data
                                 pktcount = 0;
@@ -1146,6 +1157,8 @@ static int dvb_ca_en50221_thread(void *data)
                                 }
                                 break;
                         }
+
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                 }
         }
 
@@ -1181,6 +1194,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
         switch (cmd) {
         case CA_RESET:
                 for (slot = 0; slot < ca->slot_count; slot++) {
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                         if (ca->slot_info[slot].slot_state != DVB_CA_SLOTSTATE_NONE) {
                                 dvb_ca_en50221_slot_shutdown(ca, slot);
                                 if (ca->flags & DVB_CA_EN50221_FLAG_IRQ_CAMCHANGE)
@@ -1188,6 +1202,7 @@ static int dvb_ca_en50221_io_do_ioctl(struct inode *inode, struct file *file,
                                                                      slot,
                                                                      DVB_CA_EN50221_CAMCHANGE_INSERTED);
                         }
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                 }
                 ca->next_read_slot = 0;
                 dvb_ca_en50221_thread_wakeup(ca);
@@ -1308,7 +1323,9 @@ static ssize_t dvb_ca_en50221_io_write(struct file *file,
                                 goto exit;
                         }
 
+                        mutex_lock(&ca->slot_info[slot].slot_lock);
                         status = dvb_ca_en50221_write_data(ca, slot, fragbuf, fraglen + 2);
+                        mutex_unlock(&ca->slot_info[slot].slot_lock);
                         if (status == (fraglen + 2)) {
                                 written = 1;
                                 break;
@@ -1664,6 +1681,7 @@ int dvb_ca_en50221_init(struct dvb_adapter *dvb_adapter,
                 ca->slot_info[i].slot_state = DVB_CA_SLOTSTATE_NONE;
                 atomic_set(&ca->slot_info[i].camchange_count, 0);
                 ca->slot_info[i].camchange_type = DVB_CA_EN50221_CAMCHANGE_REMOVED;
+                mutex_init(&ca->slot_info[i].slot_lock);
         }
 
         if (signal_pending(current)) {
diff --git a/drivers/media/dvb/dvb-core/dvb_ca_en50221.h b/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
index 8467e63ddc0..7df2e141187 100644
--- a/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
+++ b/drivers/media/dvb/dvb-core/dvb_ca_en50221.h
@@ -45,8 +45,10 @@ struct dvb_ca_en50221 {
         /* the module owning this structure */
         struct module* owner;
 
-        /* NOTE: the read_*, write_* and poll_slot_status functions must use locks as
-         * they may be called from several threads at once */
+        /* NOTE: the read_*, write_* and poll_slot_status functions will be
+         * called for different slots concurrently and need to use locks where
+         * and if appropriate. There will be no concurrent access to one slot.
+         */
 
         /* functions for accessing attribute memory on the CAM */
         int (*read_attribute_mem)(struct dvb_ca_en50221* ca, int slot, int address);
diff --git a/drivers/media/dvb/dvb-usb/af9005-fe.c b/drivers/media/dvb/dvb-usb/af9005-fe.c
index b1a9c4cdec9..199ece0d488 100644
--- a/drivers/media/dvb/dvb-usb/af9005-fe.c
+++ b/drivers/media/dvb/dvb-usb/af9005-fe.c
@@ -220,7 +220,7 @@ static int af9005_get_post_vit_ber(struct dvb_frontend *fe,
                                    u16 * abort_count)
 {
         u32 loc_cw_count = 0, loc_err_count;
-        u16 loc_abort_count;
+        u16 loc_abort_count = 0;
         int ret;
 
         ret =
diff --git a/drivers/media/dvb/dvb-usb/af9015.c b/drivers/media/dvb/dvb-usb/af9015.c
index e1e9aa5c6b8..6a97a40d3df 100644
--- a/drivers/media/dvb/dvb-usb/af9015.c
+++ b/drivers/media/dvb/dvb-usb/af9015.c
@@ -694,7 +694,12 @@ static int af9015_read_config(struct usb_device *udev)
 
         /* IR remote controller */
         req.addr = AF9015_EEPROM_IR_MODE;
-        ret = af9015_rw_udev(udev, &req);
+        /* first message will timeout often due to possible hw bug */
+        for (i = 0; i < 4; i++) {
+                ret = af9015_rw_udev(udev, &req);
+                if (!ret)
+                        break;
+        }
         if (ret)
                 goto error;
         deb_info("%s: IR mode:%d\n", __func__, val);
@@ -835,18 +840,19 @@ static int af9015_read_config(struct usb_device *udev)
         if (!dvb_usb_af9015_dual_mode)
                 af9015_config.dual_mode = 0;
 
-        /* set buffer size according to USB port speed */
+        /* Set adapter0 buffer size according to USB port speed, adapter1 buffer
+           size can be static because it is enabled only USB2.0 */
         for (i = 0; i < af9015_properties_count; i++) {
                 /* USB1.1 set smaller buffersize and disable 2nd adapter */
                 if (udev->speed == USB_SPEED_FULL) {
-                        af9015_properties[i].adapter->stream.u.bulk.buffersize =
-                                TS_USB11_MAX_PACKET_SIZE;
+                        af9015_properties[i].adapter[0].stream.u.bulk.buffersize
+                                = TS_USB11_MAX_PACKET_SIZE;
                         /* disable 2nd adapter because we don't have
                            PID-filters */
                         af9015_config.dual_mode = 0;
                 } else {
-                        af9015_properties[i].adapter->stream.u.bulk.buffersize =
-                                TS_USB20_MAX_PACKET_SIZE;
+                        af9015_properties[i].adapter[0].stream.u.bulk.buffersize
+                                = TS_USB20_MAX_PACKET_SIZE;
                 }
         }
 
@@ -1254,6 +1260,12 @@ static struct dvb_usb_device_properties af9015_properties[] = {
                                         .type = USB_BULK,
                                         .count = 6,
                                         .endpoint = 0x85,
+                                        .u = {
+                                                .bulk = {
+                                                        .buffersize =
+                                                TS_USB20_MAX_PACKET_SIZE,
+                                                }
+                                        }
                                 },
                         }
                 },
@@ -1353,6 +1365,12 @@ static struct dvb_usb_device_properties af9015_properties[] = {
                                         .type = USB_BULK,
                                         .count = 6,
                                         .endpoint = 0x85,
+                                        .u = {
+                                                .bulk = {
+                                                        .buffersize =
+                                                TS_USB20_MAX_PACKET_SIZE,
+                                                }
+                                        }
                                 },
                         }
                 },
diff --git a/drivers/media/dvb/dvb-usb/dib0700_devices.c b/drivers/media/dvb/dvb-usb/dib0700_devices.c
index 39173278891..635d30a5507 100644
--- a/drivers/media/dvb/dvb-usb/dib0700_devices.c
+++ b/drivers/media/dvb/dvb-usb/dib0700_devices.c
@@ -1393,6 +1393,9 @@ struct usb_device_id dib0700_usb_id_table[] = {
         { USB_DEVICE(USB_VID_ASUS,      USB_PID_ASUS_U3000H) },
 /* 40 */{ USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV801E) },
         { USB_DEVICE(USB_VID_PINNACLE,  USB_PID_PINNACLE_PCTV801E_SE) },
+        { USB_DEVICE(USB_VID_TERRATEC,  USB_PID_TERRATEC_CINERGY_T_EXPRESS) },
+        { USB_DEVICE(USB_VID_TERRATEC,
+                        USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY_2) },
         { 0 }           /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, dib0700_usb_id_table);
@@ -1537,7 +1540,8 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                         {   "DiBcom STK7700D reference design",
                                 { &dib0700_usb_id_table[14], NULL },
                                 { NULL },
-                        }
+                        },
+
                 },
 
                 .rc_interval      = DEFAULT_RC_INTERVAL,
@@ -1557,7 +1561,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                         },
                 },
 
-                .num_device_descs = 2,
+                .num_device_descs = 3,
                 .devices = {
                         {   "ASUS My Cinema U3000 Mini DVBT Tuner",
                                 { &dib0700_usb_id_table[23], NULL },
@@ -1566,6 +1570,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                         {   "Yuan EC372S",
                                 { &dib0700_usb_id_table[31], NULL },
                                 { NULL },
+                        },
+                        {   "Terratec Cinergy T Express",
+                                { &dib0700_usb_id_table[42], NULL },
+                                { NULL },
                         }
                 },
 
@@ -1653,7 +1661,7 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                         }
                 },
 
-                .num_device_descs = 4,
+                .num_device_descs = 5,
                 .devices = {
                         {   "DiBcom STK7070PD reference design",
                                 { &dib0700_usb_id_table[17], NULL },
@@ -1670,6 +1678,10 @@ struct dvb_usb_device_properties dib0700_devices[] = {
                         {   "Hauppauge Nova-TD-500 (84xxx)",
                                 { &dib0700_usb_id_table[36], NULL },
                                 { NULL },
+                        },
+                        {  "Terratec Cinergy DT USB XS Diversity",
+                                { &dib0700_usb_id_table[43], NULL },
+                                { NULL },
                         }
                 }
         }, { DIB0700_DEFAULT_DEVICE_PROPERTIES,
diff --git a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
index a4fca3fca5e..0db0c06ee6f 100644
--- a/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
+++ b/drivers/media/dvb/dvb-usb/dvb-usb-ids.h
@@ -162,8 +162,10 @@
 #define USB_PID_AVERMEDIA_A309                          0xa309
 #define USB_PID_TECHNOTREND_CONNECT_S2400               0x3006
 #define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY        0x005a
+#define USB_PID_TERRATEC_CINERGY_DT_XS_DIVERSITY_2      0x0081
 #define USB_PID_TERRATEC_CINERGY_HT_USB_XE              0x0058
 #define USB_PID_TERRATEC_CINERGY_HT_EXPRESS             0x0060
+#define USB_PID_TERRATEC_CINERGY_T_EXPRESS              0x0062
 #define USB_PID_TERRATEC_CINERGY_T_XXS                  0x0078
 #define USB_PID_PINNACLE_EXPRESSCARD_320CX              0x022e
 #define USB_PID_PINNACLE_PCTV2000E                      0x022c
diff --git a/drivers/media/dvb/frontends/drx397xD.c b/drivers/media/dvb/frontends/drx397xD.c
index ec4e08dbc69..1e81e713df6 100644
--- a/drivers/media/dvb/frontends/drx397xD.c
+++ b/drivers/media/dvb/frontends/drx397xD.c
@@ -646,7 +646,7 @@ static int drx_tune(struct drx397xD_state *s,
         u32 edi = 0, ebx = 0, ebp = 0, edx = 0;
         u16 v20 = 0, v1E = 0, v16 = 0, v14 = 0, v12 = 0, v10 = 0, v0E = 0;
 
-        int rc, df_tuner;
+        int rc, df_tuner = 0;
         int a, b, c, d;
         pr_debug("%s %d\n", __func__, s->config.d60);
 
diff --git a/drivers/media/dvb/frontends/s5h1409.c b/drivers/media/dvb/frontends/s5h1409.c
index cf4d8936bb8..3e08d985d6e 100644
--- a/drivers/media/dvb/frontends/s5h1409.c
+++ b/drivers/media/dvb/frontends/s5h1409.c
@@ -545,9 +545,6 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
 
         s5h1409_enable_modulation(fe, p->u.vsb.modulation);
 
-        /* Allow the demod to settle */
-        msleep(100);
-
         if (fe->ops.tuner_ops.set_params) {
                 if (fe->ops.i2c_gate_ctrl)
                         fe->ops.i2c_gate_ctrl(fe, 1);
@@ -562,6 +559,10 @@ static int s5h1409_set_frontend(struct dvb_frontend *fe,
                 s5h1409_set_qam_interleave_mode(fe);
         }
 
+        /* Issue a reset to the demod so it knows to resync against the
+           newly tuned frequency */
+        s5h1409_softreset(fe);
+
         return 0;
 }
 
diff --git a/drivers/media/dvb/frontends/stb0899_algo.c b/drivers/media/dvb/frontends/stb0899_algo.c
index 83dc7e12d5f..a67d1775a43 100644
--- a/drivers/media/dvb/frontends/stb0899_algo.c
+++ b/drivers/media/dvb/frontends/stb0899_algo.c
@@ -31,6 +31,8 @@ inline u32 stb0899_do_div(u64 n, u32 d)
         return n;
 }
 
+#if 0
+/* These functions are currently unused */
 /*
  * stb0899_calc_srate
  * Compute symbol rate
@@ -63,6 +65,7 @@ static u32 stb0899_get_srate(struct stb0899_state *state)
 
         return stb0899_calc_srate(internal->master_clk, sfr);
 }
+#endif
 
 /*
  * stb0899_set_srate
diff --git a/drivers/media/dvb/ttpci/budget.c b/drivers/media/dvb/ttpci/budget.c
index 1638e1d9f53..83e9e7750c8 100644
--- a/drivers/media/dvb/ttpci/budget.c
+++ b/drivers/media/dvb/ttpci/budget.c
@@ -470,6 +470,7 @@ static void frontend_init(struct budget *budget)
                 budget->dvb_frontend = dvb_attach(l64781_attach, &grundig_29504_401_config, &budget->i2c_adap);
                 if (budget->dvb_frontend) {
                         budget->dvb_frontend->ops.tuner_ops.set_params = grundig_29504_401_tuner_set_params;
+                        budget->dvb_frontend->tuner_priv = NULL;
                         break;
                 }
                 break;
diff --git a/drivers/media/dvb/ttusb-dec/ttusb_dec.c b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
index 0aa96df80fc..d91e0638448 100644
--- a/drivers/media/dvb/ttusb-dec/ttusb_dec.c
+++ b/drivers/media/dvb/ttusb-dec/ttusb_dec.c
@@ -1384,7 +1384,7 @@ static int ttusb_dec_boot_dsp(struct ttusb_dec *dec)
 static int ttusb_dec_init_stb(struct ttusb_dec *dec)
 {
         int result;
-        unsigned int mode, model, version;
+        unsigned int mode = 0, model = 0, version = 0;
 
         dprintk("%s\n", __func__);
 
diff --git a/drivers/media/radio/radio-mr800.c b/drivers/media/radio/radio-mr800.c
index 0747dc8862b..fdfc7bf86b9 100644
--- a/drivers/media/radio/radio-mr800.c
+++ b/drivers/media/radio/radio-mr800.c
@@ -194,10 +194,10 @@ static int amradio_start(struct amradio_device *radio)
                 return retval;
         }
 
-        mutex_unlock(&radio->lock);
-
         radio->muted = 0;
 
+        mutex_unlock(&radio->lock);
+
         return retval;
 }
 
@@ -230,10 +230,10 @@ static int amradio_stop(struct amradio_device *radio)
                 return retval;
         }
 
-        mutex_unlock(&radio->lock);
-
         radio->muted = 1;
 
+        mutex_unlock(&radio->lock);
+
         return retval;
 }
 
@@ -284,10 +284,10 @@ static int amradio_setfreq(struct amradio_device *radio, int freq)
                 return retval;
         }
 
-        mutex_unlock(&radio->lock);
-
         radio->stereo = 0;
 
+        mutex_unlock(&radio->lock);
+
         return retval;
 }
 
diff --git a/drivers/media/video/cs5345.c b/drivers/media/video/cs5345.c
index 14bebf8a116..87e91072627 100644
--- a/drivers/media/video/cs5345.c
+++ b/drivers/media/video/cs5345.c
@@ -18,7 +18,6 @@
  */
 
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/cx23885/cx23885-417.c b/drivers/media/video/cx23885/cx23885-417.c
index 8f1db57bd1d..bfe25841dbf 100644
--- a/drivers/media/video/cx23885/cx23885-417.c
+++ b/drivers/media/video/cx23885/cx23885-417.c
@@ -1586,7 +1586,8 @@ static int mpeg_open(struct file *file)
         lock_kernel();
         list_for_each(list, &cx23885_devlist) {
                 h = list_entry(list, struct cx23885_dev, devlist);
-                if (h->v4l_device->minor == minor) {
+                if (h->v4l_device &&
+                    h->v4l_device->minor == minor) {
                         dev = h;
                         break;
                 }
diff --git a/drivers/media/video/cx23885/cx23885-video.c b/drivers/media/video/cx23885/cx23885-video.c
index 2d81c4d0434..eaa11893bfe 100644
--- a/drivers/media/video/cx23885/cx23885-video.c
+++ b/drivers/media/video/cx23885/cx23885-video.c
@@ -730,12 +730,13 @@ static int video_open(struct file *file)
         lock_kernel();
         list_for_each(list, &cx23885_devlist) {
                 h = list_entry(list, struct cx23885_dev, devlist);
-                if (h->video_dev->minor == minor) {
+                if (h->video_dev &&
+                    h->video_dev->minor == minor) {
                         dev  = h;
                         type = V4L2_BUF_TYPE_VIDEO_CAPTURE;
                 }
                 if (h->vbi_dev &&
-                   h->vbi_dev->minor == minor) {
+                    h->vbi_dev->minor == minor) {
                         dev  = h;
                         type = V4L2_BUF_TYPE_VBI_CAPTURE;
                 }
diff --git a/drivers/media/video/cx25840/cx25840-core.c b/drivers/media/video/cx25840/cx25840-core.c
index 88f2fd32bfe..25eb3bec9e5 100644
--- a/drivers/media/video/cx25840/cx25840-core.c
+++ b/drivers/media/video/cx25840/cx25840-core.c
@@ -1382,6 +1382,14 @@ static int cx25840_log_status(struct v4l2_subdev *sd)
 
 static int cx25840_command(struct i2c_client *client, unsigned cmd, void *arg)
 {
+        /* ignore this command */
+        if (cmd == TUNER_SET_TYPE_ADDR || cmd == TUNER_SET_CONFIG)
+                return 0;
+
+        /* Old-style drivers rely on initialization on first use, so
+           call the init whenever a command is issued to this driver.
+           New-style drivers using v4l2_subdev should call init explicitly. */
+        cx25840_init(i2c_get_clientdata(client), 0);
         return v4l2_subdev_command(i2c_get_clientdata(client), cmd, arg);
 }
 
diff --git a/drivers/media/video/cx88/cx88-dvb.c b/drivers/media/video/cx88/cx88-dvb.c
index 613dfea4ff3..aef5297534a 100644
--- a/drivers/media/video/cx88/cx88-dvb.c
+++ b/drivers/media/video/cx88/cx88-dvb.c
@@ -614,34 +614,41 @@ static struct stv0288_config tevii_tuner_earda_config = {
         .set_ts_params = cx24116_set_ts_param,
 };
 
-static int dvb_register(struct cx8802_dev *dev)
+static int cx8802_alloc_frontends(struct cx8802_dev *dev)
 {
         struct cx88_core *core = dev->core;
-        struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
-        int mfe_shared = 0; /* bus not shared by default */
+        struct videobuf_dvb_frontend *fe = NULL;
         int i;
 
-        if (0 != core->i2c_rc) {
-                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
-                goto frontend_detach;
-        }
-
-        if (!core->board.num_frontends)
-                return -EINVAL;
-
         mutex_init(&dev->frontends.lock);
         INIT_LIST_HEAD(&dev->frontends.felist);
 
+        if (!core->board.num_frontends)
+                return -ENODEV;
+
         printk(KERN_INFO "%s() allocating %d frontend(s)\n", __func__,
                          core->board.num_frontends);
         for (i = 1; i <= core->board.num_frontends; i++) {
-                fe0 = videobuf_dvb_alloc_frontend(&dev->frontends, i);
-                if (!fe0) {
+                fe = videobuf_dvb_alloc_frontend(&dev->frontends, i);
+                if (!fe) {
                         printk(KERN_ERR "%s() failed to alloc\n", __func__);
                         videobuf_dvb_dealloc_frontends(&dev->frontends);
-                        goto frontend_detach;
+                        return -ENOMEM;
                 }
         }
+        return 0;
+}
+
+static int dvb_register(struct cx8802_dev *dev)
+{
+        struct cx88_core *core = dev->core;
+        struct videobuf_dvb_frontend *fe0, *fe1 = NULL;
+        int mfe_shared = 0; /* bus not shared by default */
+
+        if (0 != core->i2c_rc) {
+                printk(KERN_ERR "%s/2: no i2c-bus available, cannot attach dvb drivers\n", core->name);
+                goto frontend_detach;
+        }
 
         /* Get the first frontend */
         fe0 = videobuf_dvb_get_frontend(&dev->frontends, 1);
@@ -1243,6 +1250,8 @@ static int cx8802_dvb_probe(struct cx8802_driver *drv)
         struct cx88_core *core = drv->core;
         struct cx8802_dev *dev = drv->core->dvbdev;
         int err;
+        struct videobuf_dvb_frontend *fe;
+        int i;
 
         dprintk( 1, "%s\n", __func__);
         dprintk( 1, " ->being probed by Card=%d Name=%s, PCI %02x:%02x\n",
@@ -1258,39 +1267,34 @@ static int cx8802_dvb_probe(struct cx8802_driver *drv)
         /* If vp3054 isn't enabled, a stub will just return 0 */
         err = vp3054_i2c_probe(dev);
         if (0 != err)
-                goto fail_probe;
+                goto fail_core;
 
         /* dvb stuff */
         printk(KERN_INFO "%s/2: cx2388x based DVB/ATSC card\n", core->name);
         dev->ts_gen_cntrl = 0x0c;
 
+        err = cx8802_alloc_frontends(dev);
+        if (err)
+                goto fail_core;
+
         err = -ENODEV;
-        if (core->board.num_frontends) {
-                struct videobuf_dvb_frontend *fe;
-                int i;
-
-                for (i = 1; i <= core->board.num_frontends; i++) {
-                        fe = videobuf_dvb_get_frontend(&core->dvbdev->frontends, i);
-                        if (fe == NULL) {
-                                printk(KERN_ERR "%s() failed to get frontend(%d)\n",
+        for (i = 1; i <= core->board.num_frontends; i++) {
+                fe = videobuf_dvb_get_frontend(&core->dvbdev->frontends, i);
+                if (fe == NULL) {
+                        printk(KERN_ERR "%s() failed to get frontend(%d)\n",
                                         __func__, i);
-                                goto fail_probe;
-                        }
-                        videobuf_queue_sg_init(&fe->dvb.dvbq, &dvb_qops,
+                        goto fail_probe;
+                }
+                videobuf_queue_sg_init(&fe->dvb.dvbq, &dvb_qops,
                                     &dev->pci->dev, &dev->slock,
                                     V4L2_BUF_TYPE_VIDEO_CAPTURE,
                                     V4L2_FIELD_TOP,
                                     sizeof(struct cx88_buffer),
                                     dev);
-                        /* init struct videobuf_dvb */
-                        fe->dvb.name = dev->core->name;
-                }
-        } else {
-                /* no frontends allocated */
-                printk(KERN_ERR "%s/2 .num_frontends should be non-zero\n",
-                        core->name);
-                goto fail_core;
+                /* init struct videobuf_dvb */
+                fe->dvb.name = dev->core->name;
         }
+
         err = dvb_register(dev);
         if (err)
                 /* frontends/adapter de-allocated in dvb_register */
diff --git a/drivers/media/video/cx88/cx88.h b/drivers/media/video/cx88/cx88.h
index 60a8b3187f1..6025fdd2334 100644
--- a/drivers/media/video/cx88/cx88.h
+++ b/drivers/media/video/cx88/cx88.h
@@ -336,8 +336,8 @@ struct cx88_core {
         /* config info -- dvb */
 #if defined(CONFIG_VIDEO_CX88_DVB) || defined(CONFIG_VIDEO_CX88_DVB_MODULE)
         int                        (*prev_set_voltage)(struct dvb_frontend *fe, fe_sec_voltage_t voltage);
-        void                       (*gate_ctrl)(struct cx88_core  *core, int open);
 #endif
+        void                       (*gate_ctrl)(struct cx88_core  *core, int open);
 
         /* state info */
         struct task_struct         *kthread;
diff --git a/drivers/media/video/em28xx/em28xx-audio.c b/drivers/media/video/em28xx/em28xx-audio.c
index 94378ccb750..5d882a44e3e 100644
--- a/drivers/media/video/em28xx/em28xx-audio.c
+++ b/drivers/media/video/em28xx/em28xx-audio.c
@@ -62,9 +62,15 @@ static int em28xx_isoc_audio_deinit(struct em28xx *dev)
 
         dprintk("Stopping isoc\n");
         for (i = 0; i < EM28XX_AUDIO_BUFS; i++) {
-                usb_unlink_urb(dev->adev.urb[i]);
+                if (!irqs_disabled())
+                        usb_kill_urb(dev->adev.urb[i]);
+                else
+                        usb_unlink_urb(dev->adev.urb[i]);
                 usb_free_urb(dev->adev.urb[i]);
                 dev->adev.urb[i] = NULL;
+
+                kfree(dev->adev.transfer_buffer[i]);
+                dev->adev.transfer_buffer[i] = NULL;
         }
 
         return 0;
@@ -389,11 +395,15 @@ static int snd_em28xx_capture_trigger(struct snd_pcm_substream *substream,
 static snd_pcm_uframes_t snd_em28xx_capture_pointer(struct snd_pcm_substream
                                                     *substream)
 {
-        struct em28xx *dev;
+       unsigned long flags;
 
+        struct em28xx *dev;
         snd_pcm_uframes_t hwptr_done;
+
         dev = snd_pcm_substream_chip(substream);
+       spin_lock_irqsave(&dev->adev.slock, flags);
         hwptr_done = dev->adev.hwptr_done_capture;
+       spin_unlock_irqrestore(&dev->adev.slock, flags);
 
         return hwptr_done;
 }
diff --git a/drivers/media/video/em28xx/em28xx-cards.c b/drivers/media/video/em28xx/em28xx-cards.c
index ef9bf008a92..3b3ca3f46d5 100644
--- a/drivers/media/video/em28xx/em28xx-cards.c
+++ b/drivers/media/video/em28xx/em28xx-cards.c
@@ -102,6 +102,18 @@ static struct em28xx_reg_seq em2880_msi_digivox_ad_analog[] = {
 /* Board  - EM2870 Kworld 355u
    Analog - No input analog */
 
+static struct em28xx_reg_seq kworld_330u_analog[] = {
+        {EM28XX_R08_GPIO,       0x6d,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x00,   0xff,           10},
+        { -1,                   -1,     -1,             -1},
+};
+
+static struct em28xx_reg_seq kworld_330u_digital[] = {
+        {EM28XX_R08_GPIO,       0x6e,   ~EM_GPIO_4,     10},
+        {EM2880_R04_GPO,        0x08,   0xff,           10},
+        { -1,                   -1,     -1,             -1},
+};
+
 /* Callback for the most boards */
 static struct em28xx_reg_seq default_tuner_gpio[] = {
         {EM28XX_R08_GPIO,       EM_GPIO_4,      EM_GPIO_4,      10},
@@ -1177,29 +1189,33 @@ struct em28xx_board em28xx_boards[] = {
                         .gpio     = hauppauge_wintv_hvr_900_analog,
                 } },
         },
-        [EM2883_BOARD_KWORLD_HYBRID_A316] = {
+        [EM2883_BOARD_KWORLD_HYBRID_330U] = {
                 .name         = "Kworld PlusTV HD Hybrid 330",
                 .tuner_type   = TUNER_XC2028,
                 .tuner_gpio   = default_tuner_gpio,
                 .decoder      = EM28XX_TVP5150,
                 .mts_firmware = 1,
                 .has_dvb      = 1,
-                .dvb_gpio     = default_digital,
+                .dvb_gpio     = kworld_330u_digital,
+                .xclk             = EM28XX_XCLK_FREQUENCY_12MHZ,
+                .i2c_speed        = EM28XX_I2C_CLK_WAIT_ENABLE | EM28XX_I2C_EEPROM_ON_BOARD | EM28XX_I2C_EEPROM_KEY_VALID,
                 .input        = { {
                         .type     = EM28XX_VMUX_TELEVISION,
                         .vmux     = TVP5150_COMPOSITE0,
                         .amux     = EM28XX_AMUX_VIDEO,
-                        .gpio     = default_analog,
+                        .gpio     = kworld_330u_analog,
+                        .aout     = EM28XX_AOUT_PCM_IN | EM28XX_AOUT_PCM_STEREO,
                 }, {
                         .type     = EM28XX_VMUX_COMPOSITE1,
                         .vmux     = TVP5150_COMPOSITE1,
                         .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = hauppauge_wintv_hvr_900_analog,
+                        .gpio     = kworld_330u_analog,
+                        .aout     = EM28XX_AOUT_PCM_IN | EM28XX_AOUT_PCM_STEREO,
                 }, {
                         .type     = EM28XX_VMUX_SVIDEO,
                         .vmux     = TVP5150_SVIDEO,
                         .amux     = EM28XX_AMUX_LINE_IN,
-                        .gpio     = hauppauge_wintv_hvr_900_analog,
+                        .gpio     = kworld_330u_analog,
                 } },
         },
         [EM2820_BOARD_COMPRO_VIDEOMATE_FORYOU] = {
@@ -1249,7 +1265,7 @@ struct usb_device_id em28xx_id_table [] = {
         { USB_DEVICE(0xeb1a, 0xe310),
                         .driver_info = EM2880_BOARD_MSI_DIGIVOX_AD },
         { USB_DEVICE(0xeb1a, 0xa316),
-                        .driver_info = EM2883_BOARD_KWORLD_HYBRID_A316 },
+                        .driver_info = EM2883_BOARD_KWORLD_HYBRID_330U },
         { USB_DEVICE(0xeb1a, 0xe320),
                         .driver_info = EM2880_BOARD_MSI_DIGIVOX_AD_II },
         { USB_DEVICE(0xeb1a, 0xe323),
@@ -1526,6 +1542,10 @@ static void em28xx_setup_xc3028(struct em28xx *dev, struct xc2028_ctrl *ctl)
                 /* FIXME: Better to specify the needed IF */
                 ctl->demod = XC3028_FE_DEFAULT;
                 break;
+        case EM2883_BOARD_KWORLD_HYBRID_330U:
+                ctl->demod = XC3028_FE_CHINA;
+                ctl->fname = XC2028_DEFAULT_FIRMWARE;
+                break;
         default:
                 ctl->demod = XC3028_FE_OREN538;
         }
diff --git a/drivers/media/video/em28xx/em28xx-core.c b/drivers/media/video/em28xx/em28xx-core.c
index eb5fb05fab2..94fb1b639a2 100644
--- a/drivers/media/video/em28xx/em28xx-core.c
+++ b/drivers/media/video/em28xx/em28xx-core.c
@@ -438,6 +438,10 @@ int em28xx_audio_analog_set(struct em28xx *dev)
         if (dev->audio_mode.ac97 != EM28XX_NO_AC97) {
                 int vol;
 
+                em28xx_write_ac97(dev, AC97_POWER_DOWN_CTRL, 0x4200);
+                em28xx_write_ac97(dev, AC97_EXT_AUD_CTRL, 0x0031);
+                em28xx_write_ac97(dev, AC97_PCM_IN_SRATE, 0xbb80);
+
                 /* LSB: left channel - both channels with the same level */
                 vol = (0x1f - dev->volume) | ((0x1f - dev->volume) << 8);
 
@@ -454,6 +458,15 @@ int em28xx_audio_analog_set(struct em28xx *dev)
                                 em28xx_warn("couldn't setup AC97 register %d\n",
                                      outputs[i].reg);
                 }
+
+                if (dev->ctl_aoutput & EM28XX_AOUT_PCM_IN) {
+                        int sel = ac97_return_record_select(dev->ctl_aoutput);
+
+                        /* Use the same input for both left and right channels */
+                        sel |= (sel << 8);
+
+                        em28xx_write_ac97(dev, AC97_RECORD_SELECT, sel);
+                }
         }
 
         return ret;
@@ -847,8 +860,11 @@ void em28xx_uninit_isoc(struct em28xx *dev)
         for (i = 0; i < dev->isoc_ctl.num_bufs; i++) {
                 urb = dev->isoc_ctl.urb[i];
                 if (urb) {
-                        usb_kill_urb(urb);
-                        usb_unlink_urb(urb);
+                        if (!irqs_disabled())
+                                usb_kill_urb(urb);
+                        else
+                                usb_unlink_urb(urb);
+
                         if (dev->isoc_ctl.transfer_buffer[i]) {
                                 usb_buffer_free(dev->udev,
                                         urb->transfer_buffer_length,
diff --git a/drivers/media/video/em28xx/em28xx-dvb.c b/drivers/media/video/em28xx/em28xx-dvb.c
index d38cb21834d..9ad8527b3fd 100644
--- a/drivers/media/video/em28xx/em28xx-dvb.c
+++ b/drivers/media/video/em28xx/em28xx-dvb.c
@@ -28,6 +28,7 @@
 
 #include "lgdt330x.h"
 #include "zl10353.h"
+#include "s5h1409.h"
 #ifdef EM28XX_DRX397XD_SUPPORT
 #include "drx397xD.h"
 #endif
@@ -232,6 +233,15 @@ static struct zl10353_config em28xx_zl10353_with_xc3028 = {
         .if2 = 45600,
 };
 
+static struct s5h1409_config em28xx_s5h1409_with_xc3028 = {
+        .demod_address = 0x32 >> 1,
+        .output_mode   = S5H1409_PARALLEL_OUTPUT,
+        .gpio          = S5H1409_GPIO_OFF,
+        .inversion     = S5H1409_INVERSION_OFF,
+        .status_mode   = S5H1409_DEMODLOCKING,
+        .mpeg_timing   = S5H1409_MPEGTIMING_CONTINOUS_NONINVERTING_CLOCK
+};
+
 #ifdef EM28XX_DRX397XD_SUPPORT
 /* [TODO] djh - not sure yet what the device config needs to contain */
 static struct drx397xD_config em28xx_drx397xD_with_xc3028 = {
@@ -412,7 +422,6 @@ static int dvb_init(struct em28xx *dev)
         case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850:
         case EM2883_BOARD_HAUPPAUGE_WINTV_HVR_950:
         case EM2880_BOARD_PINNACLE_PCTV_HD_PRO:
-        case EM2883_BOARD_KWORLD_HYBRID_A316:
         case EM2880_BOARD_AMD_ATI_TV_WONDER_HD_600:
                 dvb->frontend = dvb_attach(lgdt330x_attach,
                                            &em2880_lgdt3303_dev,
@@ -433,6 +442,15 @@ static int dvb_init(struct em28xx *dev)
                         goto out_free;
                 }
                 break;
+        case EM2883_BOARD_KWORLD_HYBRID_330U:
+                dvb->frontend = dvb_attach(s5h1409_attach,
+                                           &em28xx_s5h1409_with_xc3028,
+                                           &dev->i2c_adap);
+                if (attach_xc3028(0x61, dev) < 0) {
+                        result = -EINVAL;
+                        goto out_free;
+                }
+                break;
         case EM2880_BOARD_HAUPPAUGE_WINTV_HVR_900_R2:
 #ifdef EM28XX_DRX397XD_SUPPORT
                 /* We don't have the config structure properly populated, so
diff --git a/drivers/media/video/em28xx/em28xx-video.c b/drivers/media/video/em28xx/em28xx-video.c
index 416b691c33c..8e61b2ca916 100644
--- a/drivers/media/video/em28xx/em28xx-video.c
+++ b/drivers/media/video/em28xx/em28xx-video.c
@@ -886,10 +886,10 @@ static int vidioc_s_input(struct file *file, void *priv, unsigned int i)
         if (0 == INPUT(i)->type)
                 return -EINVAL;
 
-        mutex_lock(&dev->lock);
-
-        video_mux(dev, i);
+        dev->ctl_input = i;
 
+        mutex_lock(&dev->lock);
+        video_mux(dev, dev->ctl_input);
         mutex_unlock(&dev->lock);
         return 0;
 }
@@ -939,6 +939,12 @@ static int vidioc_s_audio(struct file *file, void *priv, struct v4l2_audio *a)
         struct em28xx_fh   *fh  = priv;
         struct em28xx      *dev = fh->dev;
 
+
+        if (a->index >= MAX_EM28XX_INPUT)
+                return -EINVAL;
+        if (0 == INPUT(a->index)->type)
+                return -EINVAL;
+
         mutex_lock(&dev->lock);
 
         dev->ctl_ainput = INPUT(a->index)->amux;
@@ -1950,6 +1956,7 @@ static struct video_device *em28xx_vdev_init(struct em28xx *dev,
 
 int em28xx_register_analog_devices(struct em28xx *dev)
 {
+      u8 val;
         int ret;
 
         printk(KERN_INFO "%s: v4l2 driver version %d.%d.%d\n",
@@ -1957,34 +1964,34 @@ int em28xx_register_analog_devices(struct em28xx *dev)
                 (EM28XX_VERSION_CODE >> 16) & 0xff,
                 (EM28XX_VERSION_CODE >> 8) & 0xff, EM28XX_VERSION_CODE & 0xff);
 
+        /* set default norm */
+        dev->norm = em28xx_video_template.current_norm;
+        dev->width = norm_maxw(dev);
+        dev->height = norm_maxh(dev);
+        dev->interlaced = EM28XX_INTERLACED_DEFAULT;
+        dev->hscale = 0;
+        dev->vscale = 0;
+        dev->ctl_input = 0;
+
         /* Analog specific initialization */
         dev->format = &format[0];
-        video_mux(dev, 0);
+        video_mux(dev, dev->ctl_input);
+
+        /* Audio defaults */
+        dev->mute = 1;
+        dev->volume = 0x1f;
 
         /* enable vbi capturing */
 
 /*      em28xx_write_reg(dev, EM28XX_R0E_AUDIOSRC, 0xc0); audio register */
-/*      em28xx_write_reg(dev, EM28XX_R0F_XCLK, 0x80); clk register */
+       val = (u8)em28xx_read_reg(dev, EM28XX_R0F_XCLK);
+       em28xx_write_reg(dev, EM28XX_R0F_XCLK, (EM28XX_XCLK_AUDIO_UNMUTE | val));
         em28xx_write_reg(dev, EM28XX_R11_VINCTRL, 0x51);
 
-        dev->mute = 1;          /* maybe not the right place... */
-        dev->volume = 0x1f;
-
         em28xx_set_outfmt(dev);
         em28xx_colorlevels_set_default(dev);
         em28xx_compression_disable(dev);
 
-        /* set default norm */
-        dev->norm = em28xx_video_template.current_norm;
-        dev->width = norm_maxw(dev);
-        dev->height = norm_maxh(dev);
-        dev->interlaced = EM28XX_INTERLACED_DEFAULT;
-        dev->hscale = 0;
-        dev->vscale = 0;
-
-        /* FIXME: This is a very bad hack! Not all devices have TV on input 2 */
-        dev->ctl_input = 2;
-
         /* allocate and fill video video_device struct */
         dev->vdev = em28xx_vdev_init(dev, &em28xx_video_template, "video");
         if (!dev->vdev) {
diff --git a/drivers/media/video/em28xx/em28xx.h b/drivers/media/video/em28xx/em28xx.h
index 6c6b94aa05b..dd2cd36fb1b 100644
--- a/drivers/media/video/em28xx/em28xx.h
+++ b/drivers/media/video/em28xx/em28xx.h
@@ -94,7 +94,7 @@
 #define EM2882_BOARD_KWORLD_VS_DVBT               54
 #define EM2882_BOARD_TERRATEC_HYBRID_XS           55
 #define EM2882_BOARD_PINNACLE_HYBRID_PRO          56
-#define EM2883_BOARD_KWORLD_HYBRID_A316           57
+#define EM2883_BOARD_KWORLD_HYBRID_330U                  57
 #define EM2820_BOARD_COMPRO_VIDEOMATE_FORYOU      58
 #define EM2883_BOARD_HAUPPAUGE_WINTV_HVR_850      60
 #define EM2820_BOARD_PROLINK_PLAYTV_BOX4_USB2     61
@@ -300,13 +300,32 @@ enum em28xx_amux {
 };
 
 enum em28xx_aout {
+        /* AC97 outputs */
         EM28XX_AOUT_MASTER = 1 << 0,
         EM28XX_AOUT_LINE   = 1 << 1,
         EM28XX_AOUT_MONO   = 1 << 2,
         EM28XX_AOUT_LFE    = 1 << 3,
         EM28XX_AOUT_SURR   = 1 << 4,
+
+        /* PCM IN Mixer - used by AC97_RECORD_SELECT register */
+        EM28XX_AOUT_PCM_IN = 1 << 7,
+
+        /* Bits 10-8 are used to indicate the PCM IN record select */
+        EM28XX_AOUT_PCM_MIC_PCM = 0 << 8,
+        EM28XX_AOUT_PCM_CD      = 1 << 8,
+        EM28XX_AOUT_PCM_VIDEO   = 2 << 8,
+        EM28XX_AOUT_PCM_AUX     = 3 << 8,
+        EM28XX_AOUT_PCM_LINE    = 4 << 8,
+        EM28XX_AOUT_PCM_STEREO  = 5 << 8,
+        EM28XX_AOUT_PCM_MONO    = 6 << 8,
+        EM28XX_AOUT_PCM_PHONE   = 7 << 8,
 };
 
+static inline int ac97_return_record_select(int a_out)
+{
+        return (a_out & 0x700) >> 8;
+}
+
 struct em28xx_reg_seq {
         int reg;
         unsigned char val, mask;
diff --git a/drivers/media/video/gspca/gspca.c b/drivers/media/video/gspca/gspca.c
index 5e36b9a4ae3..2ed24527ecd 100644
--- a/drivers/media/video/gspca/gspca.c
+++ b/drivers/media/video/gspca/gspca.c
@@ -423,7 +423,8 @@ static void destroy_urbs(struct gspca_dev *gspca_dev)
                         break;
 
                 gspca_dev->urb[i] = NULL;
-                usb_kill_urb(urb);
+                if (!gspca_dev->present)
+                        usb_kill_urb(urb);
                 if (urb->transfer_buffer != NULL)
                         usb_buffer_free(gspca_dev->dev,
                                         urb->transfer_buffer_length,
@@ -1950,7 +1951,6 @@ void gspca_disconnect(struct usb_interface *intf)
         struct gspca_dev *gspca_dev = usb_get_intfdata(intf);
 
         gspca_dev->present = 0;
-        gspca_dev->streaming = 0;
 
         usb_set_intfdata(intf, NULL);
 
diff --git a/drivers/media/video/ivtv/ivtv-driver.c b/drivers/media/video/ivtv/ivtv-driver.c
index e8e5921cdc3..c46c990987f 100644
--- a/drivers/media/video/ivtv/ivtv-driver.c
+++ b/drivers/media/video/ivtv/ivtv-driver.c
@@ -949,8 +949,10 @@ static int __devinit ivtv_probe(struct pci_dev *dev,
         itv->instance = atomic_inc_return(&ivtv_instance) - 1;
 
         retval = v4l2_device_register(&dev->dev, &itv->device);
-        if (retval)
+        if (retval) {
+                kfree(itv);
                 return retval;
+        }
         /* "ivtv + PCI ID" is a bit of a mouthful, so use
            "ivtv + instance" instead. */
         snprintf(itv->device.name, sizeof(itv->device.name),
diff --git a/drivers/media/video/pwc/pwc-if.c b/drivers/media/video/pwc/pwc-if.c
index 39fbc970f43..0d810189dd8 100644
--- a/drivers/media/video/pwc/pwc-if.c
+++ b/drivers/media/video/pwc/pwc-if.c
@@ -62,7 +62,6 @@
 #include <linux/poll.h>
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
-#include <linux/version.h>
 #include <asm/io.h>
 
 #include "pwc.h"
diff --git a/drivers/media/video/saa7127.c b/drivers/media/video/saa7127.c
index d6848f7a503..05221d47dd4 100644
--- a/drivers/media/video/saa7127.c
+++ b/drivers/media/video/saa7127.c
@@ -149,7 +149,7 @@ static const struct i2c_reg_value saa7127_init_config_common[] = {
         { SAA7127_REG_COPYGEN_0,                        0x77 },
         { SAA7127_REG_COPYGEN_1,                        0x41 },
         { SAA7127_REG_COPYGEN_2,                        0x00 }, /* Macrovision enable/disable */
-        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0x9e },
+        { SAA7127_REG_OUTPUT_PORT_CONTROL,              0xbf },
         { SAA7127_REG_GAIN_LUMINANCE_RGB,               0x00 },
         { SAA7127_REG_GAIN_COLORDIFF_RGB,               0x00 },
         { SAA7127_REG_INPUT_PORT_CONTROL_1,             0x80 }, /* for color bars */
@@ -488,12 +488,18 @@ static int saa7127_set_output_type(struct v4l2_subdev *sd, int output)
                 break;
 
         case SAA7127_OUTPUT_TYPE_COMPOSITE:
-                state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x20;   /* CVBS only */
+                else
+                        state->reg_2d = 0x08;   /* 00001000 CVBS only, RGB DAC's off (high impedance mode) */
                 state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                 break;
 
         case SAA7127_OUTPUT_TYPE_SVIDEO:
-                state->reg_2d = 0xff;   /* 11111111  croma -> R, luma -> CVBS + G + B */
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x18;   /* Y + C */
+                else
+                        state->reg_2d = 0xff;   /*11111111  croma -> R, luma -> CVBS + G + B */
                 state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                 break;
 
@@ -508,7 +514,10 @@ static int saa7127_set_output_type(struct v4l2_subdev *sd, int output)
                 break;
 
         case SAA7127_OUTPUT_TYPE_BOTH:
-                state->reg_2d = 0xbf;
+                if (state->ident == V4L2_IDENT_SAA7129)
+                        state->reg_2d = 0x38;
+                else
+                        state->reg_2d = 0xbf;
                 state->reg_3a = 0x13;   /* by default switch YUV to RGB-matrix on */
                 break;
 
@@ -731,24 +740,6 @@ static int saa7127_probe(struct i2c_client *client,
                 return -ENODEV;
         }
 
-        /* Configure Encoder */
-
-        v4l2_dbg(1, debug, sd, "Configuring encoder\n");
-        saa7127_write_inittab(sd, saa7127_init_config_common);
-        saa7127_set_std(sd, V4L2_STD_NTSC);
-        saa7127_set_output_type(sd, SAA7127_OUTPUT_TYPE_BOTH);
-        saa7127_set_vps(sd, &vbi);
-        saa7127_set_wss(sd, &vbi);
-        saa7127_set_cc(sd, &vbi);
-        saa7127_set_xds(sd, &vbi);
-        if (test_image == 1)
-                /* The Encoder has an internal Colorbar generator */
-                /* This can be used for debugging */
-                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_TEST_IMAGE);
-        else
-                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_NORMAL);
-        saa7127_set_video_enable(sd, 1);
-
         if (id->driver_data) {  /* Chip type is already known */
                 state->ident = id->driver_data;
         } else {                /* Needs detection */
@@ -770,6 +761,23 @@ static int saa7127_probe(struct i2c_client *client,
 
         v4l2_info(sd, "%s found @ 0x%x (%s)\n", client->name,
                         client->addr << 1, client->adapter->name);
+
+        v4l2_dbg(1, debug, sd, "Configuring encoder\n");
+        saa7127_write_inittab(sd, saa7127_init_config_common);
+        saa7127_set_std(sd, V4L2_STD_NTSC);
+        saa7127_set_output_type(sd, SAA7127_OUTPUT_TYPE_BOTH);
+        saa7127_set_vps(sd, &vbi);
+        saa7127_set_wss(sd, &vbi);
+        saa7127_set_cc(sd, &vbi);
+        saa7127_set_xds(sd, &vbi);
+        if (test_image == 1)
+                /* The Encoder has an internal Colorbar generator */
+                /* This can be used for debugging */
+                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_TEST_IMAGE);
+        else
+                saa7127_set_input_type(sd, SAA7127_INPUT_TYPE_NORMAL);
+        saa7127_set_video_enable(sd, 1);
+
         if (state->ident == V4L2_IDENT_SAA7129)
                 saa7127_write_inittab(sd, saa7129_init_config_extra);
         return 0;
diff --git a/drivers/media/video/saa7134/saa7134-alsa.c b/drivers/media/video/saa7134/saa7134-alsa.c
index 26194a0ce92..c750d3dd57d 100644
--- a/drivers/media/video/saa7134/saa7134-alsa.c
+++ b/drivers/media/video/saa7134/saa7134-alsa.c
@@ -1089,7 +1089,11 @@ static int saa7134_alsa_init(void)
 
         list_for_each(list,&saa7134_devlist) {
                 dev = list_entry(list, struct saa7134_dev, devlist);
-                alsa_device_init(dev);
+                if (dev->pci->device == PCI_DEVICE_ID_PHILIPS_SAA7130)
+                        printk(KERN_INFO "%s/alsa: %s doesn't support digital audio\n",
+                                dev->name, saa7134_boards[dev->board].name);
+                else
+                        alsa_device_init(dev);
         }
 
         if (dev == NULL)
diff --git a/drivers/media/video/saa7134/saa7134-core.c b/drivers/media/video/saa7134/saa7134-core.c
index dfbe08a9ad9..99221d726ed 100644
--- a/drivers/media/video/saa7134/saa7134-core.c
+++ b/drivers/media/video/saa7134/saa7134-core.c
@@ -660,6 +660,10 @@ static int saa7134_hwinit1(struct saa7134_dev *dev)
 
         saa_writel(SAA7134_IRQ1, 0);
         saa_writel(SAA7134_IRQ2, 0);
+
+        /* Clear any stale IRQ reports */
+        saa_writel(SAA7134_IRQ_REPORT, saa_readl(SAA7134_IRQ_REPORT));
+
         mutex_init(&dev->lock);
         spin_lock_init(&dev->slock);
 
diff --git a/drivers/media/video/saa717x.c b/drivers/media/video/saa717x.c
index 454ad1dd750..88c5e942f75 100644
--- a/drivers/media/video/saa717x.c
+++ b/drivers/media/video/saa717x.c
@@ -30,7 +30,6 @@
  * Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/sched.h>
diff --git a/drivers/media/video/tda9875.c b/drivers/media/video/tda9875.c
index 56f0c0eb500..00c6cbe06ab 100644
--- a/drivers/media/video/tda9875.c
+++ b/drivers/media/video/tda9875.c
@@ -242,7 +242,7 @@ static int tda9875_g_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 static int tda9875_s_ctrl(struct v4l2_subdev *sd, struct v4l2_control *ctrl)
 {
         struct tda9875 *t = to_state(sd);
-        int chvol=0, volume, balance, left, right;
+        int chvol = 0, volume = 0, balance = 0, left, right;
 
         switch (ctrl->id) {
         case V4L2_CID_AUDIO_VOLUME:
diff --git a/drivers/media/video/tveeprom.c b/drivers/media/video/tveeprom.c
index 3b0b84c2e45..78277abb733 100644
--- a/drivers/media/video/tveeprom.c
+++ b/drivers/media/video/tveeprom.c
@@ -427,6 +427,9 @@ void tveeprom_hauppauge_analog(struct i2c_client *c, struct tveeprom *tvee,
         const char *t_fmt_name2[8] = { " none", "", "", "", "", "", "", "" };
 
         memset(tvee, 0, sizeof(*tvee));
+        tvee->tuner_type = TUNER_ABSENT;
+        tvee->tuner2_type = TUNER_ABSENT;
+
         done = len = beenhere = 0;
 
         /* Different eeprom start offsets for em28xx, cx2388x and cx23418 */
diff --git a/drivers/media/video/tvp514x.c b/drivers/media/video/tvp514x.c
index ac9aa40d09f..8e23aa53c29 100644
--- a/drivers/media/video/tvp514x.c
+++ b/drivers/media/video/tvp514x.c
@@ -1401,7 +1401,7 @@ tvp514x_probe(struct i2c_client *client, const struct i2c_device_id *id)
 
         decoder->pdata = client->dev.platform_data;
         if (!decoder->pdata) {
-                v4l_err(client, "No platform data\n!!");
+                v4l_err(client, "No platform data!!\n");
                 return -ENODEV;
         }
         /*
diff --git a/drivers/media/video/upd64031a.c b/drivers/media/video/upd64031a.c
index 4f16effb530..f4522bb0891 100644
--- a/drivers/media/video/upd64031a.c
+++ b/drivers/media/video/upd64031a.c
@@ -21,7 +21,6 @@
  */
 
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/upd64083.c b/drivers/media/video/upd64083.c
index 4b712f69d1b..a5fb74bf240 100644
--- a/drivers/media/video/upd64083.c
+++ b/drivers/media/video/upd64083.c
@@ -21,7 +21,6 @@
  * 02110-1301, USA.
  */
 
-#include <linux/version.h>
 #include <linux/module.h>
 #include <linux/kernel.h>
 #include <linux/i2c.h>
diff --git a/drivers/media/video/usbvision/usbvision-i2c.c b/drivers/media/video/usbvision/usbvision-i2c.c
index 9907b9aff2b..6b66ae4f430 100644
--- a/drivers/media/video/usbvision/usbvision-i2c.c
+++ b/drivers/media/video/usbvision/usbvision-i2c.c
@@ -157,7 +157,7 @@ usbvision_i2c_xfer(struct i2c_adapter *i2c_adap, struct i2c_msg msgs[], int num)
         struct i2c_msg *pmsg;
         struct usb_usbvision *usbvision;
         int i, ret;
-        unsigned char addr;
+        unsigned char addr = 0;
 
         usbvision = (struct usb_usbvision *)i2c_get_adapdata(i2c_adap);
 
diff --git a/drivers/media/video/uvc/uvc_ctrl.c b/drivers/media/video/uvc/uvc_ctrl.c
index 2208165aa6f..d2576f6391c 100644
--- a/drivers/media/video/uvc/uvc_ctrl.c
+++ b/drivers/media/video/uvc/uvc_ctrl.c
@@ -1,7 +1,7 @@
 /*
  *      uvc_ctrl.c  --  USB Video Class driver - Controls
  *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
  *          Laurent Pinchart (laurent.pinchart@skynet.be)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/uaccess.h>
@@ -29,7 +28,7 @@
 #define UVC_CTRL_DATA_BACKUP    1
 
 /* ------------------------------------------------------------------------
- * Control, formats, ...
+ * Controls
  */
 
 static struct uvc_control_info uvc_ctrls[] = {
@@ -635,7 +634,7 @@ static __s32 uvc_get_le_value(struct uvc_control_mapping *mapping,
                 mask = (1 << bits) - 1;
         }
 
-        /* Sign-extend the value if needed */
+        /* Sign-extend the value if needed. */
         if (mapping->data_type == UVC_CTRL_DATA_TYPE_SIGNED)
                 value |= -(value & (1 << (mapping->size - 1)));
 
diff --git a/drivers/media/video/uvc/uvc_driver.c b/drivers/media/video/uvc/uvc_driver.c
index 89d8bd10a85..b12873265cc 100644
--- a/drivers/media/video/uvc/uvc_driver.c
+++ b/drivers/media/video/uvc/uvc_driver.c
@@ -1,7 +1,7 @@
 /*
  *      uvc_driver.c  --  USB Video Class driver
  *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
  *          Laurent Pinchart (laurent.pinchart@skynet.be)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -24,7 +24,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -49,7 +48,7 @@ static unsigned int uvc_quirks_param;
 unsigned int uvc_trace_param;
 
 /* ------------------------------------------------------------------------
- * Control, formats, ...
+ * Video formats
  */
 
 static struct uvc_format_desc uvc_fmts[] = {
@@ -474,7 +473,7 @@ static int uvc_parse_format(struct uvc_device *dev,
 
                 /* Several UVC chipsets screw up dwMaxVideoFrameBufferSize
                  * completely. Observed behaviours range from setting the
-                 * value to 1.1x the actual frame size of hardwiring the
+                 * value to 1.1x the actual frame size to hardwiring the
                  * 16 low bits to 0. This results in a higher than necessary
                  * memory usage as well as a wrong image size information. For
                  * uncompressed formats this can be fixed by computing the
@@ -487,7 +486,7 @@ static int uvc_parse_format(struct uvc_device *dev,
                 /* Some bogus devices report dwMinFrameInterval equal to
                  * dwMaxFrameInterval and have dwFrameIntervalStep set to
                  * zero. Setting all null intervals to 1 fixes the problem and
-                 * some other divisions by zero which could happen.
+                 * some other divisions by zero that could happen.
                  */
                 for (i = 0; i < n; ++i) {
                         interval = get_unaligned_le32(&buffer[26+4*i]);
@@ -1200,13 +1199,13 @@ static void uvc_unregister_video(struct uvc_device *dev)
  * Scan the UVC descriptors to locate a chain starting at an Output Terminal
  * and containing the following units:
  *
- * - a USB Streaming Output Terminal
+ * - one Output Terminal (USB Streaming or Display)
  * - zero or one Processing Unit
  * - zero, one or mode single-input Selector Units
  * - zero or one multiple-input Selector Units, provided all inputs are
  *   connected to input terminals
  * - zero, one or mode single-input Extension Units
- * - one Camera Input Terminal, or one or more External terminals.
+ * - one or more Input Terminals (Camera, External or USB Streaming)
  *
  * A side forward scan is made on each detected entity to check for additional
  * extension units.
@@ -1531,10 +1530,6 @@ static int uvc_register_video(struct uvc_device *dev)
 
         /* Set the driver data before calling video_register_device, otherwise
          * uvc_v4l2_open might race us.
-         *
-         * FIXME: usb_set_intfdata hasn't been called so far. Is that a
-         *        problem ? Does any function which could be called here get
-         *        a pointer to the usb_interface ?
          */
         dev->video.vdev = vdev;
         video_set_drvdata(vdev, &dev->video);
@@ -1569,7 +1564,7 @@ void uvc_delete(struct kref *kref)
         struct uvc_device *dev = container_of(kref, struct uvc_device, kref);
         struct list_head *p, *n;
 
-        /* Unregister the video device */
+        /* Unregister the video device. */
         uvc_unregister_video(dev);
         usb_put_intf(dev->intf);
         usb_put_dev(dev->udev);
@@ -1612,7 +1607,7 @@ static int uvc_probe(struct usb_interface *intf,
                 uvc_trace(UVC_TRACE_PROBE, "Probing generic UVC device %s\n",
                                 udev->devpath);
 
-        /* Allocate memory for the device and initialize it */
+        /* Allocate memory for the device and initialize it. */
         if ((dev = kzalloc(sizeof *dev, GFP_KERNEL)) == NULL)
                 return -ENOMEM;
 
@@ -1633,14 +1628,14 @@ static int uvc_probe(struct usb_interface *intf,
                         le16_to_cpu(udev->descriptor.idVendor),
                         le16_to_cpu(udev->descriptor.idProduct));
 
-        /* Parse the Video Class control descriptor */
+        /* Parse the Video Class control descriptor. */
         if (uvc_parse_control(dev) < 0) {
                 uvc_trace(UVC_TRACE_PROBE, "Unable to parse UVC "
                         "descriptors.\n");
                 goto error;
         }
 
-        uvc_printk(KERN_INFO, "Found UVC %u.%02u device %s (%04x:%04x)\n",
+        uvc_printk(KERN_INFO, "Found UVC %u.%02x device %s (%04x:%04x)\n",
                 dev->uvc_version >> 8, dev->uvc_version & 0xff,
                 udev->product ? udev->product : "<unnamed>",
                 le16_to_cpu(udev->descriptor.idVendor),
@@ -1653,18 +1648,18 @@ static int uvc_probe(struct usb_interface *intf,
                         "linux-uvc-devel mailing list.\n");
         }
 
-        /* Initialize controls */
+        /* Initialize controls. */
         if (uvc_ctrl_init_device(dev) < 0)
                 goto error;
 
-        /* Register the video devices */
+        /* Register the video devices. */
         if (uvc_register_video(dev) < 0)
                 goto error;
 
-        /* Save our data pointer in the interface data */
+        /* Save our data pointer in the interface data. */
         usb_set_intfdata(intf, dev);
 
-        /* Initialize the interrupt URB */
+        /* Initialize the interrupt URB. */
         if ((ret = uvc_status_init(dev)) < 0) {
                 uvc_printk(KERN_INFO, "Unable to initialize the status "
                         "endpoint (%d), status interrupt will not be "
@@ -1839,24 +1834,24 @@ static struct usb_device_id uvc_ids[] = {
           .bInterfaceSubClass   = 1,
           .bInterfaceProtocol   = 0 },
         /* Apple Built-In iSight */
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
           .idVendor             = 0x05ac,
           .idProduct            = 0x8501,
-          .bInterfaceClass      = USB_CLASS_VIDEO,
-          .bInterfaceSubClass   = 1,
-          .bInterfaceProtocol   = 0,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
           .driver_info          = UVC_QUIRK_PROBE_MINMAX
                                 | UVC_QUIRK_BUILTIN_ISIGHT },
         /* Genesys Logic USB 2.0 PC Camera */
-        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
+        { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
-          .idVendor             = 0x05e3,
-          .idProduct            = 0x0505,
-          .bInterfaceClass      = USB_CLASS_VIDEO,
-          .bInterfaceSubClass   = 1,
-          .bInterfaceProtocol   = 0,
-          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
+          .idVendor             = 0x05e3,
+          .idProduct            = 0x0505,
+          .bInterfaceClass      = USB_CLASS_VIDEO,
+          .bInterfaceSubClass   = 1,
+          .bInterfaceProtocol   = 0,
+          .driver_info          = UVC_QUIRK_STREAM_NO_FID },
         /* MT6227 */
         { .match_flags          = USB_DEVICE_ID_MATCH_DEVICE
                                 | USB_DEVICE_ID_MATCH_INT_INFO,
diff --git a/drivers/media/video/uvc/uvc_isight.c b/drivers/media/video/uvc/uvc_isight.c
index 37bdefdbead..436f462685a 100644
--- a/drivers/media/video/uvc/uvc_isight.c
+++ b/drivers/media/video/uvc/uvc_isight.c
@@ -3,6 +3,8 @@
  *
  *      Copyright (C) 2006-2007
  *              Ivan N. Zlatev <contact@i-nz.net>
+ *      Copyright (C) 2008-2009
+ *              Laurent Pinchart <laurent.pinchart@skynet.be>
  *
  *      This program is free software; you can redistribute it and/or modify
  *      it under the terms of the GNU General Public License as published by
diff --git a/drivers/media/video/uvc/uvc_queue.c b/drivers/media/video/uvc/uvc_queue.c
index 42546342e97..0155752e4a5 100644
--- a/drivers/media/video/uvc/uvc_queue.c
+++ b/drivers/media/video/uvc/uvc_queue.c
@@ -1,7 +1,7 @@
 /*
  *      uvc_queue.c  --  USB Video Class driver - Buffers management
  *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
  *          Laurent Pinchart (laurent.pinchart@skynet.be)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/mm.h>
 #include <linux/list.h>
 #include <linux/module.h>
@@ -37,22 +36,22 @@
  * to user space will return -EBUSY.
  *
  * Video buffers are managed using two queues. However, unlike most USB video
- * drivers which use an in queue and an out queue, we use a main queue which
- * holds all queued buffers (both 'empty' and 'done' buffers), and an irq
- * queue which holds empty buffers. This design (copied from video-buf)
- * minimizes locking in interrupt, as only one queue is shared between
- * interrupt and user contexts.
+ * drivers that use an in queue and an out queue, we use a main queue to hold
+ * all queued buffers (both 'empty' and 'done' buffers), and an irq queue to
+ * hold empty buffers. This design (copied from video-buf) minimizes locking
+ * in interrupt, as only one queue is shared between interrupt and user
+ * contexts.
  *
  * Use cases
  * ---------
  *
- * Unless stated otherwise, all operations which modify the irq buffers queue
+ * Unless stated otherwise, all operations that modify the irq buffers queue
  * are protected by the irq spinlock.
  *
  * 1. The user queues the buffers, starts streaming and dequeues a buffer.
  *
  *    The buffers are added to the main and irq queues. Both operations are
- *    protected by the queue lock, and the latert is protected by the irq
+ *    protected by the queue lock, and the later is protected by the irq
  *    spinlock as well.
  *
  *    The completion handler fetches a buffer from the irq queue and fills it
@@ -60,7 +59,7 @@
  *    returns immediately.
  *
  *    When the buffer is full, the completion handler removes it from the irq
- *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wake its wait queue.
+ *    queue, marks it as ready (UVC_BUF_STATE_DONE) and wakes its wait queue.
  *    At that point, any process waiting on the buffer will be woken up. If a
  *    process tries to dequeue a buffer after it has been marked ready, the
  *    dequeing will succeed immediately.
@@ -91,8 +90,8 @@ void uvc_queue_init(struct uvc_video_queue *queue, enum v4l2_buf_type type)
 /*
  * Allocate the video buffers.
  *
- * Pages are reserved to make sure they will not be swaped, as they will be
- * filled in URB completion handler.
+ * Pages are reserved to make sure they will not be swapped, as they will be
+ * filled in the URB completion handler.
  *
  * Buffers will be individually mapped, so they must all be page aligned.
  */
@@ -210,8 +209,8 @@ int uvc_query_buffer(struct uvc_video_queue *queue,
         __uvc_query_buffer(&queue->buffer[v4l2_buf->index], v4l2_buf);
 
 done:
-       mutex_unlock(&queue->mutex);
-       return ret;
+        mutex_unlock(&queue->mutex);
+        return ret;
 }
 
 /*
@@ -236,7 +235,7 @@ int uvc_queue_buffer(struct uvc_video_queue *queue,
         }
 
         mutex_lock(&queue->mutex);
-        if (v4l2_buf->index >= queue->count)  {
+        if (v4l2_buf->index >= queue->count) {
                 uvc_trace(UVC_TRACE_CAPTURE, "[E] Out of range index.\n");
                 ret = -EINVAL;
                 goto done;
@@ -429,7 +428,7 @@ done:
  * Cancel the video buffers queue.
  *
  * Cancelling the queue marks all buffers on the irq queue as erroneous,
- * wakes them up and remove them from the queue.
+ * wakes them up and removes them from the queue.
  *
  * If the disconnect parameter is set, further calls to uvc_queue_buffer will
  * fail with -ENODEV.
diff --git a/drivers/media/video/uvc/uvc_status.c b/drivers/media/video/uvc/uvc_status.c
index 5d60b264d59..c1e4ae27c61 100644
--- a/drivers/media/video/uvc/uvc_status.c
+++ b/drivers/media/video/uvc/uvc_status.c
@@ -1,7 +1,7 @@
 /*
  *      uvc_status.c  --  USB Video Class driver - Status endpoint
  *
- *      Copyright (C) 2007-2008
+ *      Copyright (C) 2007-2009
  *          Laurent Pinchart (laurent.pinchart@skynet.be)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/input.h>
 #include <linux/usb.h>
 #include <linux/usb/input.h>
diff --git a/drivers/media/video/uvc/uvc_v4l2.c b/drivers/media/video/uvc/uvc_v4l2.c
index fa150fff2c1..d681519d0c8 100644
--- a/drivers/media/video/uvc/uvc_v4l2.c
+++ b/drivers/media/video/uvc/uvc_v4l2.c
@@ -1,7 +1,7 @@
 /*
  *      uvc_v4l2.c  --  USB Video Class driver - V4L2 API
  *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
  *          Laurent Pinchart (laurent.pinchart@skynet.be)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -37,7 +37,7 @@
  * must be grouped (for instance the Red Balance, Blue Balance and Do White
  * Balance V4L2 controls use the White Balance Component UVC control) or
  * otherwise translated. The approach we take here is to use a translation
- * table for the controls which can be mapped directly, and handle the others
+ * table for the controls that can be mapped directly, and handle the others
  * manually.
  */
 static int uvc_v4l2_query_menu(struct uvc_video_device *video,
@@ -189,7 +189,7 @@ static int uvc_v4l2_try_format(struct uvc_video_device *video,
                 probe->dwMaxVideoFrameSize =
                         video->streaming->ctrl.dwMaxVideoFrameSize;
 
-        /* Probe the device */
+        /* Probe the device. */
         if ((ret = uvc_probe_video(video, probe)) < 0)
                 goto done;
 
@@ -354,11 +354,11 @@ static int uvc_v4l2_set_streamparm(struct uvc_video_device *video,
  *
  * Each open instance of a UVC device can either be in a privileged or
  * unprivileged state. Only a single instance can be in a privileged state at
- * a given time. Trying to perform an operation which requires privileges will
+ * a given time. Trying to perform an operation that requires privileges will
  * automatically acquire the required privileges if possible, or return -EBUSY
  * otherwise. Privileges are dismissed when closing the instance.
  *
- * Operations which require privileges are:
+ * Operations that require privileges are:
  *
  * - VIDIOC_S_INPUT
  * - VIDIOC_S_PARM
diff --git a/drivers/media/video/uvc/uvc_video.c b/drivers/media/video/uvc/uvc_video.c
index e7c31995527..9bc4705be78 100644
--- a/drivers/media/video/uvc/uvc_video.c
+++ b/drivers/media/video/uvc/uvc_video.c
@@ -1,7 +1,7 @@
 /*
  *      uvc_video.c  --  USB Video Class driver - Video handling
  *
- *      Copyright (C) 2005-2008
+ *      Copyright (C) 2005-2009
  *          Laurent Pinchart (laurent.pinchart@skynet.be)
  *
  *      This program is free software; you can redistribute it and/or modify
@@ -12,7 +12,6 @@
  */
 
 #include <linux/kernel.h>
-#include <linux/version.h>
 #include <linux/list.h>
 #include <linux/module.h>
 #include <linux/usb.h>
@@ -115,7 +114,7 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
                 ctrl->wCompQuality = le16_to_cpup((__le16 *)data);
                 ret = 0;
                 goto out;
-        } else if (query == GET_DEF && probe == 1) {
+        } else if (query == GET_DEF && probe == 1 && ret != size) {
                 /* Many cameras don't support the GET_DEF request on their
                  * video probe control. Warn once and return, the caller will
                  * fall back to GET_CUR.
@@ -160,7 +159,7 @@ static int uvc_get_video_ctrl(struct uvc_video_device *video,
         }
 
         /* Some broken devices return a null or wrong dwMaxVideoFrameSize.
-         * Try to get the value from the format and frame descriptor.
+         * Try to get the value from the format and frame descriptors.
          */
         uvc_fixup_buffer_size(video, ctrl);
         ret = 0;
@@ -191,9 +190,6 @@ static int uvc_set_video_ctrl(struct uvc_video_device *video,
         *(__le16 *)&data[12] = cpu_to_le16(ctrl->wCompQuality);
         *(__le16 *)&data[14] = cpu_to_le16(ctrl->wCompWindowSize);
         *(__le16 *)&data[16] = cpu_to_le16(ctrl->wDelay);
-        /* Note: Some of the fields below are not required for IN devices (see
-         * UVC spec, 4.3.1.1), but we still copy them in case support for OUT
-         * devices is added in the future. */
         put_unaligned_le32(ctrl->dwMaxVideoFrameSize, &data[18]);
         put_unaligned_le32(ctrl->dwMaxPayloadTransferSize, &data[22]);
 
@@ -400,7 +396,7 @@ static int uvc_video_decode_start(struct uvc_video_device *video,
          *
          * Empty buffers (bytesused == 0) don't trigger end of frame detection
          * as it doesn't make sense to return an empty buffer. This also
-         * avoids detecting and of frame conditions at FID toggling if the
+         * avoids detecting end of frame conditions at FID toggling if the
          * previous payload had the EOF bit set.
          */
         if (fid != video->last_fid && buf->buf.bytesused != 0) {
@@ -453,6 +449,17 @@ static void uvc_video_decode_end(struct uvc_video_device *video,
         }
 }
 
+/* Video payload encoding is handled by uvc_video_encode_header() and
+ * uvc_video_encode_data(). Only bulk transfers are currently supported.
+ *
+ * uvc_video_encode_header is called at the start of a payload. It adds header
+ * data to the transfer buffer and returns the header size. As the only known
+ * UVC output device transfers a whole frame in a single payload, the EOF bit
+ * is always set in the header.
+ *
+ * uvc_video_encode_data is called for every URB and copies the data from the
+ * video buffer to the transfer buffer.
+ */
 static int uvc_video_encode_header(struct uvc_video_device *video,
                 struct uvc_buffer *buf, __u8 *data, int len)
 {
@@ -953,7 +960,7 @@ int uvc_video_suspend(struct uvc_video_device *video)
 }
 
 /*
- * Reconfigure the video interface and restart streaming if it was enable
+ * Reconfigure the video interface and restart streaming if it was enabled
  * before suspend.
  *
  * If an error occurs, disable the video queue. This will wake all pending
@@ -985,8 +992,8 @@ int uvc_video_resume(struct uvc_video_device *video)
  */
 
 /*
- * Initialize the UVC video device by retrieving the default format and
- * committing it.
+ * Initialize the UVC video device by switching to alternate setting 0 and
+ * retrieve the default format.
  *
  * Some cameras (namely the Fuji Finepix) set the format and frame
  * indexes to zero. The UVC standard doesn't clearly make this a spec
@@ -1014,7 +1021,7 @@ int uvc_video_init(struct uvc_video_device *video)
          */
         usb_set_interface(video->dev->udev, video->streaming->intfnum, 0);
 
-        /* Some webcams don't suport GET_DEF request on the probe control. We
+        /* Some webcams don't suport GET_DEF requests on the probe control. We
          * fall back to GET_CUR if GET_DEF fails.
          */
         if ((ret = uvc_get_video_ctrl(video, probe, 1, GET_DEF)) < 0 &&
diff --git a/drivers/media/video/uvc/uvcvideo.h b/drivers/media/video/uvc/uvcvideo.h
index bcf4361dc1b..027947ea9b6 100644
--- a/drivers/media/video/uvc/uvcvideo.h
+++ b/drivers/media/video/uvc/uvcvideo.h
@@ -72,149 +72,149 @@ struct uvc_xu_control {
  * UVC constants
  */
 
-#define SC_UNDEFINED                    0x00
-#define SC_VIDEOCONTROL                 0x01
-#define SC_VIDEOSTREAMING               0x02
-#define SC_VIDEO_INTERFACE_COLLECTION   0x03
+#define SC_UNDEFINED                    0x00
+#define SC_VIDEOCONTROL                 0x01
+#define SC_VIDEOSTREAMING               0x02
+#define SC_VIDEO_INTERFACE_COLLECTION   0x03
 
-#define PC_PROTOCOL_UNDEFINED           0x00
+#define PC_PROTOCOL_UNDEFINED           0x00
 
-#define CS_UNDEFINED                    0x20
-#define CS_DEVICE                       0x21
-#define CS_CONFIGURATION                0x22
-#define CS_STRING                       0x23
-#define CS_INTERFACE                    0x24
-#define CS_ENDPOINT                     0x25
+#define CS_UNDEFINED                    0x20
+#define CS_DEVICE                       0x21
+#define CS_CONFIGURATION                0x22
+#define CS_STRING                       0x23
+#define CS_INTERFACE                    0x24
+#define CS_ENDPOINT                     0x25
 
 /* VideoControl class specific interface descriptor */
-#define VC_DESCRIPTOR_UNDEFINED         0x00
-#define VC_HEADER                       0x01
-#define VC_INPUT_TERMINAL               0x02
-#define VC_OUTPUT_TERMINAL              0x03
-#define VC_SELECTOR_UNIT                0x04
-#define VC_PROCESSING_UNIT              0x05
-#define VC_EXTENSION_UNIT               0x06
+#define VC_DESCRIPTOR_UNDEFINED         0x00
+#define VC_HEADER                       0x01
+#define VC_INPUT_TERMINAL               0x02
+#define VC_OUTPUT_TERMINAL              0x03
+#define VC_SELECTOR_UNIT                0x04
+#define VC_PROCESSING_UNIT              0x05
+#define VC_EXTENSION_UNIT               0x06
 
 /* VideoStreaming class specific interface descriptor */
-#define VS_UNDEFINED                    0x00
-#define VS_INPUT_HEADER                 0x01
-#define VS_OUTPUT_HEADER                0x02
-#define VS_STILL_IMAGE_FRAME            0x03
-#define VS_FORMAT_UNCOMPRESSED          0x04
-#define VS_FRAME_UNCOMPRESSED           0x05
-#define VS_FORMAT_MJPEG                 0x06
-#define VS_FRAME_MJPEG                  0x07
-#define VS_FORMAT_MPEG2TS               0x0a
-#define VS_FORMAT_DV                    0x0c
-#define VS_COLORFORMAT                  0x0d
-#define VS_FORMAT_FRAME_BASED           0x10
-#define VS_FRAME_FRAME_BASED            0x11
-#define VS_FORMAT_STREAM_BASED          0x12
+#define VS_UNDEFINED                    0x00
+#define VS_INPUT_HEADER                 0x01
+#define VS_OUTPUT_HEADER                0x02
+#define VS_STILL_IMAGE_FRAME            0x03
+#define VS_FORMAT_UNCOMPRESSED          0x04
+#define VS_FRAME_UNCOMPRESSED           0x05
+#define VS_FORMAT_MJPEG                 0x06
+#define VS_FRAME_MJPEG                  0x07
+#define VS_FORMAT_MPEG2TS               0x0a
+#define VS_FORMAT_DV                    0x0c
+#define VS_COLORFORMAT                  0x0d
+#define VS_FORMAT_FRAME_BASED           0x10
+#define VS_FRAME_FRAME_BASED            0x11
+#define VS_FORMAT_STREAM_BASED          0x12
 
 /* Endpoint type */
-#define EP_UNDEFINED                    0x00
-#define EP_GENERAL                      0x01
-#define EP_ENDPOINT                     0x02
-#define EP_INTERRUPT                    0x03
+#define EP_UNDEFINED                    0x00
+#define EP_GENERAL                      0x01
+#define EP_ENDPOINT                     0x02
+#define EP_INTERRUPT                    0x03
 
 /* Request codes */
-#define RC_UNDEFINED                    0x00
-#define SET_CUR                         0x01
-#define GET_CUR                         0x81
-#define GET_MIN                         0x82
-#define GET_MAX                         0x83
-#define GET_RES                         0x84
-#define GET_LEN                         0x85
-#define GET_INFO                        0x86
-#define GET_DEF                         0x87
+#define RC_UNDEFINED                    0x00
+#define SET_CUR                         0x01
+#define GET_CUR                         0x81
+#define GET_MIN                         0x82
+#define GET_MAX                         0x83
+#define GET_RES                         0x84
+#define GET_LEN                         0x85
+#define GET_INFO                        0x86
+#define GET_DEF                         0x87
 
 /* VideoControl interface controls */
-#define VC_CONTROL_UNDEFINED            0x00
-#define VC_VIDEO_POWER_MODE_CONTROL     0x01
-#define VC_REQUEST_ERROR_CODE_CONTROL   0x02
+#define VC_CONTROL_UNDEFINED            0x00
+#define VC_VIDEO_POWER_MODE_CONTROL     0x01
+#define VC_REQUEST_ERROR_CODE_CONTROL   0x02
 
 /* Terminal controls */
-#define TE_CONTROL_UNDEFINED            0x00
+#define TE_CONTROL_UNDEFINED            0x00
 
 /* Selector Unit controls */
-#define SU_CONTROL_UNDEFINED            0x00
-#define SU_INPUT_SELECT_CONTROL         0x01
+#define SU_CONTROL_UNDEFINED            0x00
+#define SU_INPUT_SELECT_CONTROL         0x01
 
 /* Camera Terminal controls */
-#define CT_CONTROL_UNDEFINED                            0x00
-#define CT_SCANNING_MODE_CONTROL                        0x01
-#define CT_AE_MODE_CONTROL                              0x02
-#define CT_AE_PRIORITY_CONTROL                          0x03
-#define CT_EXPOSURE_TIME_ABSOLUTE_CONTROL               0x04
-#define CT_EXPOSURE_TIME_RELATIVE_CONTROL               0x05
-#define CT_FOCUS_ABSOLUTE_CONTROL                       0x06
-#define CT_FOCUS_RELATIVE_CONTROL                       0x07
-#define CT_FOCUS_AUTO_CONTROL                           0x08
-#define CT_IRIS_ABSOLUTE_CONTROL                        0x09
-#define CT_IRIS_RELATIVE_CONTROL                        0x0a
-#define CT_ZOOM_ABSOLUTE_CONTROL                        0x0b
-#define CT_ZOOM_RELATIVE_CONTROL                        0x0c
-#define CT_PANTILT_ABSOLUTE_CONTROL                     0x0d
-#define CT_PANTILT_RELATIVE_CONTROL                     0x0e
-#define CT_ROLL_ABSOLUTE_CONTROL                        0x0f
-#define CT_ROLL_RELATIVE_CONTROL                        0x10
-#define CT_PRIVACY_CONTROL                              0x11
+#define CT_CONTROL_UNDEFINED                            0x00
+#define CT_SCANNING_MODE_CONTROL                        0x01
+#define CT_AE_MODE_CONTROL                              0x02
+#define CT_AE_PRIORITY_CONTROL                          0x03
+#define CT_EXPOSURE_TIME_ABSOLUTE_CONTROL               0x04
+#define CT_EXPOSURE_TIME_RELATIVE_CONTROL               0x05
+#define CT_FOCUS_ABSOLUTE_CONTROL                       0x06
+#define CT_FOCUS_RELATIVE_CONTROL                       0x07
+#define CT_FOCUS_AUTO_CONTROL                           0x08
+#define CT_IRIS_ABSOLUTE_CONTROL                        0x09
+#define CT_IRIS_RELATIVE_CONTROL                        0x0a
+#define CT_ZOOM_ABSOLUTE_CONTROL                        0x0b
+#define CT_ZOOM_RELATIVE_CONTROL                        0x0c
+#define CT_PANTILT_ABSOLUTE_CONTROL                     0x0d
+#define CT_PANTILT_RELATIVE_CONTROL                     0x0e
+#define CT_ROLL_ABSOLUTE_CONTROL                        0x0f
+#define CT_ROLL_RELATIVE_CONTROL                        0x10
+#define CT_PRIVACY_CONTROL                              0x11
 
 /* Processing Unit controls */
-#define PU_CONTROL_UNDEFINED                            0x00
-#define PU_BACKLIGHT_COMPENSATION_CONTROL               0x01
-#define PU_BRIGHTNESS_CONTROL                           0x02
-#define PU_CONTRAST_CONTROL                             0x03
-#define PU_GAIN_CONTROL                                 0x04
-#define PU_POWER_LINE_FREQUENCY_CONTROL                 0x05
-#define PU_HUE_CONTROL                                  0x06
-#define PU_SATURATION_CONTROL                           0x07
-#define PU_SHARPNESS_CONTROL                            0x08
-#define PU_GAMMA_CONTROL                                0x09
-#define PU_WHITE_BALANCE_TEMPERATURE_CONTROL            0x0a
-#define PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL       0x0b
-#define PU_WHITE_BALANCE_COMPONENT_CONTROL              0x0c
-#define PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL         0x0d
-#define PU_DIGITAL_MULTIPLIER_CONTROL                   0x0e
-#define PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL             0x0f
-#define PU_HUE_AUTO_CONTROL                             0x10
-#define PU_ANALOG_VIDEO_STANDARD_CONTROL                0x11
-#define PU_ANALOG_LOCK_STATUS_CONTROL                   0x12
+#define PU_CONTROL_UNDEFINED                            0x00
+#define PU_BACKLIGHT_COMPENSATION_CONTROL               0x01
+#define PU_BRIGHTNESS_CONTROL                           0x02
+#define PU_CONTRAST_CONTROL                             0x03
+#define PU_GAIN_CONTROL                                 0x04
+#define PU_POWER_LINE_FREQUENCY_CONTROL                 0x05
+#define PU_HUE_CONTROL                                  0x06
+#define PU_SATURATION_CONTROL                           0x07
+#define PU_SHARPNESS_CONTROL                            0x08
+#define PU_GAMMA_CONTROL                                0x09
+#define PU_WHITE_BALANCE_TEMPERATURE_CONTROL            0x0a
+#define PU_WHITE_BALANCE_TEMPERATURE_AUTO_CONTROL       0x0b
+#define PU_WHITE_BALANCE_COMPONENT_CONTROL              0x0c
+#define PU_WHITE_BALANCE_COMPONENT_AUTO_CONTROL         0x0d
+#define PU_DIGITAL_MULTIPLIER_CONTROL                   0x0e
+#define PU_DIGITAL_MULTIPLIER_LIMIT_CONTROL             0x0f
+#define PU_HUE_AUTO_CONTROL                             0x10
+#define PU_ANALOG_VIDEO_STANDARD_CONTROL                0x11
+#define PU_ANALOG_LOCK_STATUS_CONTROL                   0x12
 
 #define LXU_MOTOR_PANTILT_RELATIVE_CONTROL              0x01
 #define LXU_MOTOR_PANTILT_RESET_CONTROL                 0x02
 #define LXU_MOTOR_FOCUS_MOTOR_CONTROL                   0x03
 
 /* VideoStreaming interface controls */
-#define VS_CONTROL_UNDEFINED            0x00
-#define VS_PROBE_CONTROL                0x01
-#define VS_COMMIT_CONTROL               0x02
-#define VS_STILL_PROBE_CONTROL          0x03
-#define VS_STILL_COMMIT_CONTROL         0x04
-#define VS_STILL_IMAGE_TRIGGER_CONTROL  0x05
-#define VS_STREAM_ERROR_CODE_CONTROL    0x06
-#define VS_GENERATE_KEY_FRAME_CONTROL   0x07
-#define VS_UPDATE_FRAME_SEGMENT_CONTROL 0x08
-#define VS_SYNC_DELAY_CONTROL           0x09
-
-#define TT_VENDOR_SPECIFIC              0x0100
-#define TT_STREAMING                    0x0101
+#define VS_CONTROL_UNDEFINED            0x00
+#define VS_PROBE_CONTROL                0x01
+#define VS_COMMIT_CONTROL               0x02
+#define VS_STILL_PROBE_CONTROL          0x03
+#define VS_STILL_COMMIT_CONTROL         0x04
+#define VS_STILL_IMAGE_TRIGGER_CONTROL  0x05
+#define VS_STREAM_ERROR_CODE_CONTROL    0x06
+#define VS_GENERATE_KEY_FRAME_CONTROL   0x07
+#define VS_UPDATE_FRAME_SEGMENT_CONTROL 0x08
+#define VS_SYNC_DELAY_CONTROL           0x09
+
+#define TT_VENDOR_SPECIFIC              0x0100
+#define TT_STREAMING                    0x0101
 
 /* Input Terminal types */
-#define ITT_VENDOR_SPECIFIC             0x0200
-#define ITT_CAMERA                      0x0201
-#define ITT_MEDIA_TRANSPORT_INPUT       0x0202
+#define ITT_VENDOR_SPECIFIC             0x0200
+#define ITT_CAMERA                      0x0201
+#define ITT_MEDIA_TRANSPORT_INPUT       0x0202
 
 /* Output Terminal types */
-#define OTT_VENDOR_SPECIFIC             0x0300
-#define OTT_DISPLAY                     0x0301
-#define OTT_MEDIA_TRANSPORT_OUTPUT      0x0302
+#define OTT_VENDOR_SPECIFIC             0x0300
+#define OTT_DISPLAY                     0x0301
+#define OTT_MEDIA_TRANSPORT_OUTPUT      0x0302
 
 /* External Terminal types */
-#define EXTERNAL_VENDOR_SPECIFIC        0x0400
-#define COMPOSITE_CONNECTOR             0x0401
-#define SVIDEO_CONNECTOR                0x0402
-#define COMPONENT_CONNECTOR             0x0403
+#define EXTERNAL_VENDOR_SPECIFIC        0x0400
+#define COMPOSITE_CONNECTOR             0x0401
+#define SVIDEO_CONNECTOR                0x0402
+#define COMPONENT_CONNECTOR             0x0403
 
 #define UVC_TERM_INPUT                  0x0000
 #define UVC_TERM_OUTPUT                 0x8000
@@ -541,11 +541,11 @@ struct uvc_streaming {
 };
 
 enum uvc_buffer_state {
-        UVC_BUF_STATE_IDLE       = 0,
-        UVC_BUF_STATE_QUEUED     = 1,
-        UVC_BUF_STATE_ACTIVE     = 2,
-        UVC_BUF_STATE_DONE       = 3,
-        UVC_BUF_STATE_ERROR      = 4,
+        UVC_BUF_STATE_IDLE      = 0,
+        UVC_BUF_STATE_QUEUED    = 1,
+        UVC_BUF_STATE_ACTIVE    = 2,
+        UVC_BUF_STATE_DONE      = 3,
+        UVC_BUF_STATE_ERROR     = 4,
 };
 
 struct uvc_buffer {
diff --git a/drivers/media/video/v4l2-subdev.c b/drivers/media/video/v4l2-subdev.c
index fbe9cc0d433..21208805ea9 100644
--- a/drivers/media/video/v4l2-subdev.c
+++ b/drivers/media/video/v4l2-subdev.c
@@ -28,13 +28,13 @@ int v4l2_subdev_command(struct v4l2_subdev *sd, unsigned cmd, void *arg)
 {
         switch (cmd) {
         case VIDIOC_QUERYCTRL:
-                return v4l2_subdev_call(sd, core, querymenu, arg);
+                return v4l2_subdev_call(sd, core, queryctrl, arg);
         case VIDIOC_G_CTRL:
                 return v4l2_subdev_call(sd, core, g_ctrl, arg);
         case VIDIOC_S_CTRL:
                 return v4l2_subdev_call(sd, core, s_ctrl, arg);
         case VIDIOC_QUERYMENU:
-                return v4l2_subdev_call(sd, core, queryctrl, arg);
+                return v4l2_subdev_call(sd, core, querymenu, arg);
         case VIDIOC_LOG_STATUS:
                 return v4l2_subdev_call(sd, core, log_status);
         case VIDIOC_DBG_G_CHIP_IDENT:
diff --git a/drivers/media/video/zoran/zoran.h b/drivers/media/video/zoran/zoran.h
index 46b7ad477ce..e873a916250 100644
--- a/drivers/media/video/zoran/zoran.h
+++ b/drivers/media/video/zoran/zoran.h
@@ -349,7 +349,6 @@ struct card_info {
         u16 i2c_decoder, i2c_encoder;                   /* I2C types */
         u16 video_vfe, video_codec;                     /* videocodec types */
         u16 audio_chip;                                 /* audio type */
-        u16 vendor_id, device_id;       /* subsystem vendor/device ID */
 
         int inputs;             /* number of video inputs */
         struct input {
@@ -401,7 +400,6 @@ struct zoran {
         char name[32];          /* name of this device */
         struct pci_dev *pci_dev;        /* PCI device */
         unsigned char revision; /* revision of zr36057 */
-        unsigned int zr36057_adr;       /* bus address of IO mem returned by PCI BIOS */
         unsigned char __iomem *zr36057_mem;/* pointer to mapped IO memory */
 
         spinlock_t spinlock;    /* Spinlock */
@@ -490,16 +488,10 @@ struct zoran {
         wait_queue_head_t test_q;
 };
 
-/*The following should be done in more portable way. It depends on define
-  of _ALPHA_BUZ in the Makefile.*/
-
-#ifdef _ALPHA_BUZ
-#define btwrite(dat,adr)    writel((dat), zr->zr36057_adr+(adr))
-#define btread(adr)         readl(zr->zr36057_adr+(adr))
-#else
+/* There was something called _ALPHA_BUZ that used the PCI address instead of
+ * the kernel iomapped address for btread/btwrite.  */
 #define btwrite(dat,adr)    writel((dat), zr->zr36057_mem+(adr))
 #define btread(adr)         readl(zr->zr36057_mem+(adr))
-#endif
 
 #define btand(dat,adr)      btwrite((dat) & btread(adr), adr)
 #define btor(dat,adr)       btwrite((dat) | btread(adr), adr)
diff --git a/drivers/media/video/zoran/zoran_card.c b/drivers/media/video/zoran/zoran_card.c
index 05f39195372..5d2f090aa0f 100644
--- a/drivers/media/video/zoran/zoran_card.c
+++ b/drivers/media/video/zoran/zoran_card.c
@@ -61,17 +61,17 @@
 
 extern const struct zoran_format zoran_formats[];
 
-static int card[BUZ_MAX] = { -1, -1, -1, -1 };
+static int card[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(card, int, NULL, 0444);
-MODULE_PARM_DESC(card, "The type of card");
+MODULE_PARM_DESC(card, "Card type");
 
-static int encoder[BUZ_MAX] = { -1, -1, -1, -1 };
+static int encoder[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(encoder, int, NULL, 0444);
-MODULE_PARM_DESC(encoder, "i2c TV encoder");
+MODULE_PARM_DESC(encoder, "Video encoder chip");
 
-static int decoder[BUZ_MAX] = { -1, -1, -1, -1 };
+static int decoder[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(decoder, int, NULL, 0444);
-MODULE_PARM_DESC(decoder, "i2c TV decoder");
+MODULE_PARM_DESC(decoder, "Video decoder chip");
 
 /*
    The video mem address of the video card.
@@ -104,9 +104,9 @@ module_param(default_norm, int, 0444);
 MODULE_PARM_DESC(default_norm, "Default norm (0=PAL, 1=NTSC, 2=SECAM)");
 
 /* /dev/videoN, -1 for autodetect */
-static int video_nr[BUZ_MAX] = {-1, -1, -1, -1};
+static int video_nr[BUZ_MAX] = { [0 ... (BUZ_MAX-1)] = -1 };
 module_param_array(video_nr, int, NULL, 0444);
-MODULE_PARM_DESC(video_nr, "video device number (-1=Auto)");
+MODULE_PARM_DESC(video_nr, "Video device number (-1=Auto)");
 
 /*
    Number and size of grab buffers for Video 4 Linux
@@ -153,9 +153,21 @@ MODULE_DESCRIPTION("Zoran-36057/36067 JPEG codec driver");
 MODULE_AUTHOR("Serguei Miridonov");
 MODULE_LICENSE("GPL");
 
+#define ZR_DEVICE(subven, subdev, data) { \
+        .vendor = PCI_VENDOR_ID_ZORAN, .device = PCI_DEVICE_ID_ZORAN_36057, \
+        .subvendor = (subven), .subdevice = (subdev), .driver_data = (data) }
+
+static struct pci_device_id zr36067_pci_tbl[] = {
+        ZR_DEVICE(PCI_VENDOR_ID_MIRO, PCI_DEVICE_ID_MIRO_DC10PLUS, DC10plus),
+        ZR_DEVICE(PCI_VENDOR_ID_MIRO, PCI_DEVICE_ID_MIRO_DC30PLUS, DC30plus),
+        ZR_DEVICE(PCI_VENDOR_ID_ELECTRONICDESIGNGMBH, PCI_DEVICE_ID_LML_33R10, LML33R10),
+        ZR_DEVICE(PCI_VENDOR_ID_IOMEGA, PCI_DEVICE_ID_IOMEGA_BUZ, BUZ),
+        ZR_DEVICE(PCI_ANY_ID, PCI_ANY_ID, NUM_CARDS),
+        {0}
+};
+MODULE_DEVICE_TABLE(pci, zr36067_pci_tbl);
 
-int zoran_num;                  /* number of Buzs in use */
-struct zoran *zoran[BUZ_MAX];
+static unsigned int zoran_num;          /* number of cards found */
 
 /* videocodec bus functions ZR36060 */
 static u32
@@ -472,8 +484,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
         }, {
                 .type = DC10plus,
                 .name = "DC10plus",
-                .vendor_id = PCI_VENDOR_ID_MIRO,
-                .device_id = PCI_DEVICE_ID_MIRO_DC10PLUS,
                 .i2c_decoder = I2C_DRIVERID_SAA7110,
                 .i2c_encoder = I2C_DRIVERID_ADV7175,
                 .video_codec = CODEC_TYPE_ZR36060,
@@ -531,8 +541,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
         }, {
                 .type = DC30plus,
                 .name = "DC30plus",
-                .vendor_id = PCI_VENDOR_ID_MIRO,
-                .device_id = PCI_DEVICE_ID_MIRO_DC30PLUS,
                 .i2c_decoder = I2C_DRIVERID_VPX3220,
                 .i2c_encoder = I2C_DRIVERID_ADV7175,
                 .video_codec = CODEC_TYPE_ZR36050,
@@ -589,8 +597,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
         }, {
                 .type = LML33R10,
                 .name = "LML33R10",
-                .vendor_id = PCI_VENDOR_ID_ELECTRONICDESIGNGMBH,
-                .device_id = PCI_DEVICE_ID_LML_33R10,
                 .i2c_decoder = I2C_DRIVERID_SAA7114,
                 .i2c_encoder = I2C_DRIVERID_ADV7170,
                 .video_codec = CODEC_TYPE_ZR36060,
@@ -618,8 +624,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
         }, {
                 .type = BUZ,
                 .name = "Buz",
-                .vendor_id = PCI_VENDOR_ID_IOMEGA,
-                .device_id = PCI_DEVICE_ID_IOMEGA_BUZ,
                 .i2c_decoder = I2C_DRIVERID_SAA7111A,
                 .i2c_encoder = I2C_DRIVERID_SAA7185B,
                 .video_codec = CODEC_TYPE_ZR36060,
@@ -649,8 +653,6 @@ static struct card_info zoran_cards[NUM_CARDS] __devinitdata = {
                 .name = "6-Eyes",
                 /* AverMedia chose not to brand the 6-Eyes. Thus it
                    can't be autodetected, and requires card=x. */
-                .vendor_id = -1,
-                .device_id = -1,
                 .i2c_decoder = I2C_DRIVERID_KS0127,
                 .i2c_encoder = I2C_DRIVERID_BT866,
                 .video_codec = CODEC_TYPE_ZR36060,
@@ -1138,7 +1140,8 @@ zr36057_init (struct zoran *zr)
         strcpy(zr->video_dev->name, ZR_DEVNAME(zr));
         err = video_register_device(zr->video_dev, VFL_TYPE_GRABBER, video_nr[zr->id]);
         if (err < 0)
-                goto exit_unregister;
+                goto exit_free;
+        video_set_drvdata(zr->video_dev, zr);
 
         zoran_init_hardware(zr);
         if (zr36067_debug > 2)
@@ -1153,19 +1156,19 @@ zr36057_init (struct zoran *zr)
         zr->initialized = 1;
         return 0;
 
-exit_unregister:
-        zoran_unregister_i2c(zr);
 exit_free:
         kfree(zr->stat_com);
         kfree(zr->video_dev);
         return err;
 }
 
-static void
-zoran_release (struct zoran *zr)
+static void __devexit zoran_remove(struct pci_dev *pdev)
 {
+        struct zoran *zr = pci_get_drvdata(pdev);
+
         if (!zr->initialized)
                 goto exit_free;
+
         /* unregister videocodec bus */
         if (zr->codec) {
                 struct videocodec_master *master = zr->codec->master_data;
@@ -1194,6 +1197,7 @@ zoran_release (struct zoran *zr)
         pci_disable_device(zr->pci_dev);
         video_unregister_device(zr->video_dev);
 exit_free:
+        pci_set_drvdata(pdev, NULL);
         kfree(zr);
 }
 
@@ -1256,338 +1260,329 @@ zoran_setup_videocodec (struct zoran *zr,
  *   Scan for a Buz card (actually for the PCI controller ZR36057),
  *   request the irq and map the io memory
  */
-static int __devinit
-find_zr36057 (void)
+static int __devinit zoran_probe(struct pci_dev *pdev,
+                                 const struct pci_device_id *ent)
 {
         unsigned char latency, need_latency;
         struct zoran *zr;
-        struct pci_dev *dev = NULL;
         int result;
         struct videocodec_master *master_vfe = NULL;
         struct videocodec_master *master_codec = NULL;
         int card_num;
         char *i2c_enc_name, *i2c_dec_name, *codec_name, *vfe_name;
+        unsigned int nr;
 
-        zoran_num = 0;
-        while (zoran_num < BUZ_MAX &&
-               (dev = pci_get_device(PCI_VENDOR_ID_ZORAN, PCI_DEVICE_ID_ZORAN_36057, dev)) != NULL) {
-                card_num = card[zoran_num];
-                zr = kzalloc(sizeof(struct zoran), GFP_KERNEL);
-                if (!zr) {
-                        dprintk(1,
-                                KERN_ERR
-                                "%s: find_zr36057() - kzalloc failed\n",
-                                ZORAN_NAME);
-                        continue;
-                }
-                zr->pci_dev = dev;
-                //zr->zr36057_mem = NULL;
-                zr->id = zoran_num;
-                snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)), "MJPEG[%u]", zr->id);
-                spin_lock_init(&zr->spinlock);
-                mutex_init(&zr->resource_lock);
-                if (pci_enable_device(dev))
-                        goto zr_free_mem;
-                zr->zr36057_adr = pci_resource_start(zr->pci_dev, 0);
-                pci_read_config_byte(zr->pci_dev, PCI_CLASS_REVISION,
-                                     &zr->revision);
-                if (zr->revision < 2) {
-                        dprintk(1,
-                                KERN_INFO
-                                "%s: Zoran ZR36057 (rev %d) irq: %d, memory: 0x%08x.\n",
-                                ZR_DEVNAME(zr), zr->revision, zr->pci_dev->irq,
-                                zr->zr36057_adr);
 
-                        if (card_num == -1) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - no card specified, please use the card=X insmod option\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_free_mem;
-                        }
-                } else {
-                        int i;
-                        unsigned short ss_vendor, ss_device;
+        nr = zoran_num++;
+        if (nr >= BUZ_MAX) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: driver limited to %d card(s) maximum\n",
+                        ZORAN_NAME, BUZ_MAX);
+                return -ENOENT;
+        }
 
-                        ss_vendor = zr->pci_dev->subsystem_vendor;
-                        ss_device = zr->pci_dev->subsystem_device;
+        zr = kzalloc(sizeof(struct zoran), GFP_KERNEL);
+        if (!zr) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: find_zr36057() - kzalloc failed\n",
+                        ZORAN_NAME);
+                return -ENOMEM;
+        }
+        zr->pci_dev = pdev;
+        zr->id = nr;
+        snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)), "MJPEG[%u]", zr->id);
+        spin_lock_init(&zr->spinlock);
+        mutex_init(&zr->resource_lock);
+        if (pci_enable_device(pdev))
+                goto zr_free_mem;
+        pci_read_config_byte(zr->pci_dev, PCI_CLASS_REVISION, &zr->revision);
+
+        dprintk(1,
+                KERN_INFO
+                "%s: Zoran ZR360%c7 (rev %d), irq: %d, memory: 0x%08llx\n",
+                ZR_DEVNAME(zr), zr->revision < 2 ? '5' : '6', zr->revision,
+                zr->pci_dev->irq, (uint64_t)pci_resource_start(zr->pci_dev, 0));
+        if (zr->revision >= 2) {
+                dprintk(1,
+                        KERN_INFO
+                        "%s: Subsystem vendor=0x%04x id=0x%04x\n",
+                        ZR_DEVNAME(zr), zr->pci_dev->subsystem_vendor,
+                        zr->pci_dev->subsystem_device);
+        }
+
+        /* Use auto-detected card type? */
+        if (card[nr] == -1) {
+                if (zr->revision < 2) {
                         dprintk(1,
-                                KERN_INFO
-                                "%s: Zoran ZR36067 (rev %d) irq: %d, memory: 0x%08x\n",
-                                ZR_DEVNAME(zr), zr->revision, zr->pci_dev->irq,
-                                zr->zr36057_adr);
+                                KERN_ERR
+                                "%s: No card type specified, please use the card=X module parameter\n",
+                                ZR_DEVNAME(zr));
                         dprintk(1,
-                                KERN_INFO
-                                "%s: subsystem vendor=0x%04x id=0x%04x\n",
-                                ZR_DEVNAME(zr), ss_vendor, ss_device);
-                        if (card_num == -1) {
-                                dprintk(3,
-                                        KERN_DEBUG
-                                        "%s: find_zr36057() - trying to autodetect card type\n",
-                                        ZR_DEVNAME(zr));
-                                for (i=0;i<NUM_CARDS;i++) {
-                                        if (ss_vendor == zoran_cards[i].vendor_id &&
-                                            ss_device == zoran_cards[i].device_id) {
-                                                dprintk(3,
-                                                        KERN_DEBUG
-                                                        "%s: find_zr36057() - card %s detected\n",
-                                                        ZR_DEVNAME(zr),
-                                                        zoran_cards[i].name);
-                                                card_num = i;
-                                                break;
-                                        }
-                                }
-                                if (i == NUM_CARDS) {
-                                        dprintk(1,
-                                                KERN_ERR
-                                                "%s: find_zr36057() - unknown card\n",
-                                                ZR_DEVNAME(zr));
-                                        goto zr_free_mem;
-                                }
-                        }
-                }
-
-                if (card_num < 0 || card_num >= NUM_CARDS) {
-                        dprintk(2,
                                 KERN_ERR
-                                "%s: find_zr36057() - invalid cardnum %d\n",
-                                ZR_DEVNAME(zr), card_num);
+                                "%s: It is not possible to auto-detect ZR36057 based cards\n",
+                                ZR_DEVNAME(zr));
                         goto zr_free_mem;
                 }
 
-                /* even though we make this a non pointer and thus
-                 * theoretically allow for making changes to this struct
-                 * on a per-individual card basis at runtime, this is
-                 * strongly discouraged. This structure is intended to
-                 * keep general card information, no settings or anything */
-                zr->card = zoran_cards[card_num];
-                snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)),
-                         "%s[%u]", zr->card.name, zr->id);
-
-                zr->zr36057_mem = ioremap_nocache(zr->zr36057_adr, 0x1000);
-                if (!zr->zr36057_mem) {
+                card_num = ent->driver_data;
+                if (card_num >= NUM_CARDS) {
                         dprintk(1,
                                 KERN_ERR
-                                "%s: find_zr36057() - ioremap failed\n",
+                                "%s: Unknown card, try specifying card=X module parameter\n",
                                 ZR_DEVNAME(zr));
                         goto zr_free_mem;
                 }
-
-                result = request_irq(zr->pci_dev->irq,
-                                     zoran_irq,
-                                     IRQF_SHARED | IRQF_DISABLED,
-                                     ZR_DEVNAME(zr),
-                                     (void *) zr);
-                if (result < 0) {
-                        if (result == -EINVAL) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - bad irq number or handler\n",
-                                        ZR_DEVNAME(zr));
-                        } else if (result == -EBUSY) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - IRQ %d busy, change your PnP config in BIOS\n",
-                                        ZR_DEVNAME(zr), zr->pci_dev->irq);
-                        } else {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - can't assign irq, error code %d\n",
-                                        ZR_DEVNAME(zr), result);
-                        }
-                        goto zr_unmap;
-                }
-
-                /* set PCI latency timer */
-                pci_read_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
-                                     &latency);
-                need_latency = zr->revision > 1 ? 32 : 48;
-                if (latency != need_latency) {
-                        dprintk(2,
-                                KERN_INFO
-                                "%s: Changing PCI latency from %d to %d.\n",
-                                ZR_DEVNAME(zr), latency, need_latency);
-                        pci_write_config_byte(zr->pci_dev,
-                                              PCI_LATENCY_TIMER,
-                                              need_latency);
+                dprintk(3,
+                        KERN_DEBUG
+                        "%s: %s() - card %s detected\n",
+                        ZR_DEVNAME(zr), __func__, zoran_cards[card_num].name);
+        } else {
+                card_num = card[nr];
+                if (card_num >= NUM_CARDS || card_num < 0) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: User specified card type %d out of range (0 .. %d)\n",
+                                ZR_DEVNAME(zr), card_num, NUM_CARDS - 1);
+                        goto zr_free_mem;
                 }
+        }
 
-                zr36057_restart(zr);
-                /* i2c */
-                dprintk(2, KERN_INFO "%s: Initializing i2c bus...\n",
-                        ZR_DEVNAME(zr));
+        /* even though we make this a non pointer and thus
+         * theoretically allow for making changes to this struct
+         * on a per-individual card basis at runtime, this is
+         * strongly discouraged. This structure is intended to
+         * keep general card information, no settings or anything */
+        zr->card = zoran_cards[card_num];
+        snprintf(ZR_DEVNAME(zr), sizeof(ZR_DEVNAME(zr)),
+                 "%s[%u]", zr->card.name, zr->id);
+
+        zr->zr36057_mem = pci_ioremap_bar(zr->pci_dev, 0);
+        if (!zr->zr36057_mem) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: %s() - ioremap failed\n",
+                        ZR_DEVNAME(zr), __func__);
+                goto zr_free_mem;
+        }
 
-                /* i2c decoder */
-                if (decoder[zr->id] != -1) {
-                        i2c_dec_name = i2cid_to_modulename(decoder[zr->id]);
-                        zr->card.i2c_decoder = decoder[zr->id];
-                } else if (zr->card.i2c_decoder != 0) {
-                        i2c_dec_name =
-                                i2cid_to_modulename(zr->card.i2c_decoder);
+        result = request_irq(zr->pci_dev->irq, zoran_irq,
+                             IRQF_SHARED | IRQF_DISABLED, ZR_DEVNAME(zr), zr);
+        if (result < 0) {
+                if (result == -EINVAL) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - bad irq number or handler\n",
+                                ZR_DEVNAME(zr));
+                } else if (result == -EBUSY) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - IRQ %d busy, change your PnP config in BIOS\n",
+                                ZR_DEVNAME(zr), zr->pci_dev->irq);
                 } else {
-                        i2c_dec_name = NULL;
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - can't assign irq, error code %d\n",
+                                ZR_DEVNAME(zr), result);
                 }
+                goto zr_unmap;
+        }
 
-                if (i2c_dec_name) {
-                        if ((result = request_module(i2c_dec_name)) < 0) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: failed to load module %s: %d\n",
-                                        ZR_DEVNAME(zr), i2c_dec_name, result);
-                        }
-                }
+        /* set PCI latency timer */
+        pci_read_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
+                             &latency);
+        need_latency = zr->revision > 1 ? 32 : 48;
+        if (latency != need_latency) {
+                dprintk(2,
+                        KERN_INFO
+                        "%s: Changing PCI latency from %d to %d\n",
+                        ZR_DEVNAME(zr), latency, need_latency);
+                pci_write_config_byte(zr->pci_dev, PCI_LATENCY_TIMER,
+                                      need_latency);
+        }
 
-                /* i2c encoder */
-                if (encoder[zr->id] != -1) {
-                        i2c_enc_name = i2cid_to_modulename(encoder[zr->id]);
-                        zr->card.i2c_encoder = encoder[zr->id];
-                } else if (zr->card.i2c_encoder != 0) {
-                        i2c_enc_name =
-                                i2cid_to_modulename(zr->card.i2c_encoder);
-                } else {
-                        i2c_enc_name = NULL;
-                }
+        zr36057_restart(zr);
+        /* i2c */
+        dprintk(2, KERN_INFO "%s: Initializing i2c bus...\n",
+                ZR_DEVNAME(zr));
+
+        /* i2c decoder */
+        if (decoder[zr->id] != -1) {
+                i2c_dec_name = i2cid_to_modulename(decoder[zr->id]);
+                zr->card.i2c_decoder = decoder[zr->id];
+        } else if (zr->card.i2c_decoder != 0) {
+                i2c_dec_name = i2cid_to_modulename(zr->card.i2c_decoder);
+        } else {
+                i2c_dec_name = NULL;
+        }
 
-                if (i2c_enc_name) {
-                        if ((result = request_module(i2c_enc_name)) < 0) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: failed to load module %s: %d\n",
-                                        ZR_DEVNAME(zr), i2c_enc_name, result);
-                        }
+        if (i2c_dec_name) {
+                result = request_module(i2c_dec_name);
+                if (result < 0) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: failed to load module %s: %d\n",
+                                ZR_DEVNAME(zr), i2c_dec_name, result);
                 }
+        }
+
+        /* i2c encoder */
+        if (encoder[zr->id] != -1) {
+                i2c_enc_name = i2cid_to_modulename(encoder[zr->id]);
+                zr->card.i2c_encoder = encoder[zr->id];
+        } else if (zr->card.i2c_encoder != 0) {
+                i2c_enc_name = i2cid_to_modulename(zr->card.i2c_encoder);
+        } else {
+                i2c_enc_name = NULL;
+        }
 
-                if (zoran_register_i2c(zr) < 0) {
+        if (i2c_enc_name) {
+                result = request_module(i2c_enc_name);
+                if (result < 0) {
                         dprintk(1,
                                 KERN_ERR
-                                "%s: find_zr36057() - can't initialize i2c bus\n",
-                                ZR_DEVNAME(zr));
-                        goto zr_free_irq;
+                                "%s: failed to load module %s: %d\n",
+                                ZR_DEVNAME(zr), i2c_enc_name, result);
                 }
+        }
 
-                dprintk(2,
-                        KERN_INFO "%s: Initializing videocodec bus...\n",
+        if (zoran_register_i2c(zr) < 0) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: find_zr36057() - can't initialize i2c bus\n",
                         ZR_DEVNAME(zr));
+                goto zr_free_irq;
+        }
 
-                if (zr->card.video_codec != 0 &&
-                    (codec_name =
-                     codecid_to_modulename(zr->card.video_codec)) != NULL) {
-                        if ((result = request_module(codec_name)) < 0) {
+        dprintk(2,
+                KERN_INFO "%s: Initializing videocodec bus...\n",
+                ZR_DEVNAME(zr));
+
+        if (zr->card.video_codec) {
+                codec_name = codecid_to_modulename(zr->card.video_codec);
+                if (codec_name) {
+                        result = request_module(codec_name);
+                        if (result) {
                                 dprintk(1,
                                         KERN_ERR
                                         "%s: failed to load modules %s: %d\n",
                                         ZR_DEVNAME(zr), codec_name, result);
                         }
                 }
-                if (zr->card.video_vfe != 0 &&
-                    (vfe_name =
-                     codecid_to_modulename(zr->card.video_vfe)) != NULL) {
-                        if ((result = request_module(vfe_name)) < 0) {
+        }
+        if (zr->card.video_vfe) {
+                vfe_name = codecid_to_modulename(zr->card.video_vfe);
+                if (vfe_name) {
+                        result = request_module(vfe_name);
+                        if (result < 0) {
                                 dprintk(1,
                                         KERN_ERR
                                         "%s: failed to load modules %s: %d\n",
                                         ZR_DEVNAME(zr), vfe_name, result);
                         }
                 }
+        }
 
-                /* reset JPEG codec */
-                jpeg_codec_sleep(zr, 1);
-                jpeg_codec_reset(zr);
-                /* video bus enabled */
-                /* display codec revision */
-                if (zr->card.video_codec != 0) {
-                        master_codec = zoran_setup_videocodec(zr,
-                                                              zr->card.video_codec);
-                        if (!master_codec)
-                                goto zr_unreg_i2c;
-                        zr->codec = videocodec_attach(master_codec);
-                        if (!zr->codec) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - no codec found\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_free_codec;
-                        }
-                        if (zr->codec->type != zr->card.video_codec) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - wrong codec\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_detach_codec;
-                        }
+        /* reset JPEG codec */
+        jpeg_codec_sleep(zr, 1);
+        jpeg_codec_reset(zr);
+        /* video bus enabled */
+        /* display codec revision */
+        if (zr->card.video_codec != 0) {
+                master_codec = zoran_setup_videocodec(zr, zr->card.video_codec);
+                if (!master_codec)
+                        goto zr_unreg_i2c;
+                zr->codec = videocodec_attach(master_codec);
+                if (!zr->codec) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - no codec found\n",
+                                ZR_DEVNAME(zr));
+                        goto zr_free_codec;
                 }
-                if (zr->card.video_vfe != 0) {
-                        master_vfe = zoran_setup_videocodec(zr,
-                                                            zr->card.video_vfe);
-                        if (!master_vfe)
-                                goto zr_detach_codec;
-                        zr->vfe = videocodec_attach(master_vfe);
-                        if (!zr->vfe) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() - no VFE found\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_free_vfe;
-                        }
-                        if (zr->vfe->type != zr->card.video_vfe) {
-                                dprintk(1,
-                                        KERN_ERR
-                                        "%s: find_zr36057() = wrong VFE\n",
-                                        ZR_DEVNAME(zr));
-                                goto zr_detach_vfe;
-                        }
+                if (zr->codec->type != zr->card.video_codec) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - wrong codec\n",
+                                ZR_DEVNAME(zr));
+                        goto zr_detach_codec;
+                }
+        }
+        if (zr->card.video_vfe != 0) {
+                master_vfe = zoran_setup_videocodec(zr, zr->card.video_vfe);
+                if (!master_vfe)
+                        goto zr_detach_codec;
+                zr->vfe = videocodec_attach(master_vfe);
+                if (!zr->vfe) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() - no VFE found\n",
+                                ZR_DEVNAME(zr));
+                        goto zr_free_vfe;
+                }
+                if (zr->vfe->type != zr->card.video_vfe) {
+                        dprintk(1,
+                                KERN_ERR
+                                "%s: find_zr36057() = wrong VFE\n",
+                                ZR_DEVNAME(zr));
+                        goto zr_detach_vfe;
                 }
-                /* Success so keep the pci_dev referenced */
-                pci_dev_get(zr->pci_dev);
-                zoran[zoran_num++] = zr;
-                continue;
-
-                // Init errors
-              zr_detach_vfe:
-                videocodec_detach(zr->vfe);
-              zr_free_vfe:
-                kfree(master_vfe);
-              zr_detach_codec:
-                videocodec_detach(zr->codec);
-              zr_free_codec:
-                kfree(master_codec);
-              zr_unreg_i2c:
-                zoran_unregister_i2c(zr);
-              zr_free_irq:
-                btwrite(0, ZR36057_SPGPPCR);
-                free_irq(zr->pci_dev->irq, zr);
-              zr_unmap:
-                iounmap(zr->zr36057_mem);
-              zr_free_mem:
-                kfree(zr);
-                continue;
         }
-        if (dev)        /* Clean up ref count on early exit */
-                pci_dev_put(dev);
 
-        if (zoran_num == 0) {
-                dprintk(1, KERN_INFO "No known MJPEG cards found.\n");
+        /* take care of Natoma chipset and a revision 1 zr36057 */
+        if ((pci_pci_problems & PCIPCI_NATOMA) && zr->revision <= 1) {
+                zr->jpg_buffers.need_contiguous = 1;
+                dprintk(1,
+                        KERN_INFO
+                        "%s: ZR36057/Natoma bug, max. buffer size is 128K\n",
+                        ZR_DEVNAME(zr));
         }
-        return zoran_num;
+
+        if (zr36057_init(zr) < 0)
+                goto zr_detach_vfe;
+
+        zoran_proc_init(zr);
+
+        pci_set_drvdata(pdev, zr);
+
+        return 0;
+
+zr_detach_vfe:
+        videocodec_detach(zr->vfe);
+zr_free_vfe:
+        kfree(master_vfe);
+zr_detach_codec:
+        videocodec_detach(zr->codec);
+zr_free_codec:
+        kfree(master_codec);
+zr_unreg_i2c:
+        zoran_unregister_i2c(zr);
+zr_free_irq:
+        btwrite(0, ZR36057_SPGPPCR);
+        free_irq(zr->pci_dev->irq, zr);
+zr_unmap:
+        iounmap(zr->zr36057_mem);
+zr_free_mem:
+        kfree(zr);
+
+        return -ENODEV;
 }
 
-static int __init
-init_dc10_cards (void)
+static struct pci_driver zoran_driver = {
+        .name = "zr36067",
+        .id_table = zr36067_pci_tbl,
+        .probe = zoran_probe,
+        .remove = zoran_remove,
+};
+
+static int __init zoran_init(void)
 {
-        int i;
+        int res;
 
-        memset(zoran, 0, sizeof(zoran));
         printk(KERN_INFO "Zoran MJPEG board driver version %d.%d.%d\n",
                MAJOR_VERSION, MINOR_VERSION, RELEASE_VERSION);
 
-        /* Look for cards */
-        if (find_zr36057() < 0) {
-                return -EIO;
-        }
-        if (zoran_num == 0)
-                return -ENODEV;
-        dprintk(1, KERN_INFO "%s: %d card(s) found\n", ZORAN_NAME,
-                zoran_num);
         /* check the parameters we have been given, adjust if necessary */
         if (v4l_nbufs < 2)
                 v4l_nbufs = 2;
@@ -1629,37 +1624,22 @@ init_dc10_cards (void)
                         ZORAN_NAME);
         }
 
-        /* take care of Natoma chipset and a revision 1 zr36057 */
-        for (i = 0; i < zoran_num; i++) {
-                struct zoran *zr = zoran[i];
-
-                if ((pci_pci_problems & PCIPCI_NATOMA) && zr->revision <= 1) {
-                        zr->jpg_buffers.need_contiguous = 1;
-                        dprintk(1,
-                                KERN_INFO
-                                "%s: ZR36057/Natoma bug, max. buffer size is 128K\n",
-                                ZR_DEVNAME(zr));
-                }
-
-                if (zr36057_init(zr) < 0) {
-                        for (i = 0; i < zoran_num; i++)
-                                zoran_release(zoran[i]);
-                        return -EIO;
-                }
-                zoran_proc_init(zr);
+        res = pci_register_driver(&zoran_driver);
+        if (res) {
+                dprintk(1,
+                        KERN_ERR
+                        "%s: Unable to register ZR36057 driver\n",
+                        ZORAN_NAME);
+                return res;
         }
 
         return 0;
 }
 
-static void __exit
-unload_dc10_cards (void)
+static void __exit zoran_exit(void)
 {
-        int i;
-
-        for (i = 0; i < zoran_num; i++)
-                zoran_release(zoran[i]);
+        pci_unregister_driver(&zoran_driver);
 }
 
-module_init(init_dc10_cards);
-module_exit(unload_dc10_cards);
+module_init(zoran_init);
+module_exit(zoran_exit);
diff --git a/drivers/media/video/zoran/zoran_card.h b/drivers/media/video/zoran/zoran_card.h
index e4dc9d29b40..4507bdc5e33 100644
--- a/drivers/media/video/zoran/zoran_card.h
+++ b/drivers/media/video/zoran/zoran_card.h
@@ -40,8 +40,6 @@ extern int zr36067_debug;
 
 /* Anybody who uses more than four? */
 #define BUZ_MAX 4
-extern int zoran_num;
-extern struct zoran *zoran[BUZ_MAX];
 
 extern struct video_device zoran_template;
 
diff --git a/drivers/media/video/zoran/zoran_driver.c b/drivers/media/video/zoran/zoran_driver.c
index b58b9dda715..120ef235e63 100644
--- a/drivers/media/video/zoran/zoran_driver.c
+++ b/drivers/media/video/zoran/zoran_driver.c
@@ -1196,83 +1196,54 @@ zoran_close_end_session (struct file *file)
  *   Open a zoran card. Right now the flags stuff is just playing
  */
 
-static int
-zoran_open(struct file  *file)
+static int zoran_open(struct file *file)
 {
-        unsigned int minor = video_devdata(file)->minor;
-        struct zoran *zr = NULL;
+        struct zoran *zr = video_drvdata(file);
         struct zoran_fh *fh;
-        int i, res, first_open = 0, have_module_locks = 0;
+        int res, first_open = 0;
 
-        lock_kernel();
-        /* find the device */
-        for (i = 0; i < zoran_num; i++) {
-                if (zoran[i]->video_dev->minor == minor) {
-                        zr = zoran[i];
-                        break;
-                }
-        }
+        dprintk(2, KERN_INFO "%s: zoran_open(%s, pid=[%d]), users(-)=%d\n",
+                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user + 1);
 
-        if (!zr) {
-                dprintk(1, KERN_ERR "%s: device not found!\n", ZORAN_NAME);
-                res = -ENODEV;
-                goto open_unlock_and_return;
-        }
+        lock_kernel();
 
         /* see fs/device.c - the kernel already locks during open(),
          * so locking ourselves only causes deadlocks */
         /*mutex_lock(&zr->resource_lock);*/
 
+        if (zr->user >= 2048) {
+                dprintk(1, KERN_ERR "%s: too many users (%d) on device\n",
+                        ZR_DEVNAME(zr), zr->user);
+                res = -EBUSY;
+                goto fail_unlock;
+        }
+
         if (!zr->decoder) {
                 dprintk(1,
                         KERN_ERR "%s: no TV decoder loaded for device!\n",
                         ZR_DEVNAME(zr));
                 res = -EIO;
-                goto open_unlock_and_return;
+                goto fail_unlock;
         }
 
-        /* try to grab a module lock */
-        if (!try_module_get(THIS_MODULE)) {
-                dprintk(1,
-                        KERN_ERR
-                        "%s: failed to acquire my own lock! PANIC!\n",
-                        ZR_DEVNAME(zr));
-                res = -ENODEV;
-                goto open_unlock_and_return;
-        }
         if (!try_module_get(zr->decoder->driver->driver.owner)) {
                 dprintk(1,
                         KERN_ERR
-                        "%s: failed to grab ownership of i2c decoder\n",
+                        "%s: failed to grab ownership of video decoder\n",
                         ZR_DEVNAME(zr));
                 res = -EIO;
-                module_put(THIS_MODULE);
-                goto open_unlock_and_return;
+                goto fail_unlock;
         }
         if (zr->encoder &&
             !try_module_get(zr->encoder->driver->driver.owner)) {
                 dprintk(1,
                         KERN_ERR
-                        "%s: failed to grab ownership of i2c encoder\n",
+                        "%s: failed to grab ownership of video encoder\n",
                         ZR_DEVNAME(zr));
                 res = -EIO;
-                module_put(zr->decoder->driver->driver.owner);
-                module_put(THIS_MODULE);
-                goto open_unlock_and_return;
+                goto fail_decoder;
         }
 
-        have_module_locks = 1;
-
-        if (zr->user >= 2048) {
-                dprintk(1, KERN_ERR "%s: too many users (%d) on device\n",
-                        ZR_DEVNAME(zr), zr->user);
-                res = -EBUSY;
-                goto open_unlock_and_return;
-        }
-
-        dprintk(1, KERN_INFO "%s: zoran_open(%s, pid=[%d]), users(-)=%d\n",
-                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user);
-
         /* now, create the open()-specific file_ops struct */
         fh = kzalloc(sizeof(struct zoran_fh), GFP_KERNEL);
         if (!fh) {
@@ -1281,7 +1252,7 @@ zoran_open(struct file  *file)
                         "%s: zoran_open() - allocation of zoran_fh failed\n",
                         ZR_DEVNAME(zr));
                 res = -ENOMEM;
-                goto open_unlock_and_return;
+                goto fail_encoder;
         }
         /* used to be BUZ_MAX_WIDTH/HEIGHT, but that gives overflows
          * on norm-change! */
@@ -1292,9 +1263,8 @@ zoran_open(struct file  *file)
                         KERN_ERR
                         "%s: zoran_open() - allocation of overlay_mask failed\n",
                         ZR_DEVNAME(zr));
-                kfree(fh);
                 res = -ENOMEM;
-                goto open_unlock_and_return;
+                goto fail_fh;
         }
 
         if (zr->user++ == 0)
@@ -1319,22 +1289,19 @@ zoran_open(struct file  *file)
 
         return 0;
 
-open_unlock_and_return:
-        /* if we grabbed locks, release them accordingly */
-        if (have_module_locks) {
-                module_put(zr->decoder->driver->driver.owner);
-                if (zr->encoder) {
-                        module_put(zr->encoder->driver->driver.owner);
-                }
-                module_put(THIS_MODULE);
-        }
-
-        /* if there's no device found, we didn't obtain the lock either */
-        if (zr) {
-                /*mutex_unlock(&zr->resource_lock);*/
-        }
+fail_fh:
+        kfree(fh);
+fail_encoder:
+        if (zr->encoder)
+                module_put(zr->encoder->driver->driver.owner);
+fail_decoder:
+        module_put(zr->decoder->driver->driver.owner);
+fail_unlock:
         unlock_kernel();
 
+        dprintk(2, KERN_INFO "%s: open failed (%d), users(-)=%d\n",
+                ZR_DEVNAME(zr), res, zr->user);
+
         return res;
 }
 
@@ -1344,8 +1311,8 @@ zoran_close(struct file  *file)
         struct zoran_fh *fh = file->private_data;
         struct zoran *zr = fh->zr;
 
-        dprintk(1, KERN_INFO "%s: zoran_close(%s, pid=[%d]), users(+)=%d\n",
-                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user);
+        dprintk(2, KERN_INFO "%s: zoran_close(%s, pid=[%d]), users(+)=%d\n",
+                ZR_DEVNAME(zr), current->comm, task_pid_nr(current), zr->user - 1);
 
         /* kernel locks (fs/device.c), so don't do that ourselves
          * (prevents deadlocks) */
@@ -1391,10 +1358,8 @@ zoran_close(struct file  *file)
 
         /* release locks on the i2c modules */
         module_put(zr->decoder->driver->driver.owner);
-        if (zr->encoder) {
-                 module_put(zr->encoder->driver->driver.owner);
-        }
-        module_put(THIS_MODULE);
+        if (zr->encoder)
+                module_put(zr->encoder->driver->driver.owner);
 
         /*mutex_unlock(&zr->resource_lock);*/
 
diff --git a/drivers/mfd/pcf50633-core.c b/drivers/mfd/pcf50633-core.c
index 24508e28e3f..ea9488e7ad6 100644
--- a/drivers/mfd/pcf50633-core.c
+++ b/drivers/mfd/pcf50633-core.c
@@ -626,7 +626,6 @@ static int __devinit pcf50633_probe(struct i2c_client *client,
         }
 
         if (client->irq) {
-                set_irq_handler(client->irq, handle_level_irq);
                 ret = request_irq(client->irq, pcf50633_irq,
                                 IRQF_TRIGGER_LOW, "pcf50633", pcf);
 
diff --git a/drivers/misc/Kconfig b/drivers/misc/Kconfig
index 56073199ceb..1c484084ed4 100644
--- a/drivers/misc/Kconfig
+++ b/drivers/misc/Kconfig
@@ -162,7 +162,7 @@ config ENCLOSURE_SERVICES
 config SGI_XP
         tristate "Support communication between SGI SSIs"
         depends on NET
-        depends on (IA64_GENERIC || IA64_SGI_SN2 || IA64_SGI_UV || X86_64) && SMP
+        depends on (IA64_GENERIC || IA64_SGI_SN2 || IA64_SGI_UV || X86_UV) && SMP
         select IA64_UNCACHED_ALLOCATOR if IA64_GENERIC || IA64_SGI_SN2
         select GENERIC_ALLOCATOR if IA64_GENERIC || IA64_SGI_SN2
         select SGI_GRU if (IA64_GENERIC || IA64_SGI_UV || X86_64) && SMP
@@ -189,7 +189,7 @@ config HP_ILO
 
 config SGI_GRU
         tristate "SGI GRU driver"
-        depends on (X86_64 || IA64_SGI_UV || IA64_GENERIC) && SMP
+        depends on (X86_UV || IA64_SGI_UV || IA64_GENERIC) && SMP
         default n
         select MMU_NOTIFIER
         ---help---
@@ -217,6 +217,7 @@ config DELL_LAPTOP
         depends on EXPERIMENTAL
         depends on BACKLIGHT_CLASS_DEVICE
         depends on RFKILL
+        depends on POWER_SUPPLY
         default n
         ---help---
         This driver adds support for rfkill and backlight control to Dell
diff --git a/drivers/misc/atmel-ssc.c b/drivers/misc/atmel-ssc.c
index bf5e4d06543..558bf3f2c27 100644
--- a/drivers/misc/atmel-ssc.c
+++ b/drivers/misc/atmel-ssc.c
@@ -35,7 +35,7 @@ struct ssc_device *ssc_request(unsigned int ssc_num)
 
         if (!ssc_valid) {
                 spin_unlock(&user_lock);
-                dev_dbg(&ssc->pdev->dev, "could not find requested device\n");
+                pr_err("ssc: ssc%d platform device is missing\n", ssc_num);
                 return ERR_PTR(-ENODEV);
         }
 
diff --git a/drivers/misc/hpilo.c b/drivers/misc/hpilo.c
index 10c421b73ea..f26667a7abf 100644
--- a/drivers/misc/hpilo.c
+++ b/drivers/misc/hpilo.c
@@ -207,7 +207,7 @@ static void ilo_ccb_close(struct pci_dev *pdev, struct ccb_data *data)
                   &device_ccb->recv_ctrl);
 
         /* give iLO some time to process stop request */
-        for (retries = 1000; retries > 0; retries--) {
+        for (retries = MAX_WAIT; retries > 0; retries--) {
                 doorbell_set(driver_ccb);
                 udelay(1);
                 if (!(ioread32(&device_ccb->send_ctrl) & (1 << CTRL_BITPOS_A))
@@ -309,7 +309,7 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
         doorbell_clr(driver_ccb);
 
         /* make sure iLO is really handling requests */
-        for (i = 1000; i > 0; i--) {
+        for (i = MAX_WAIT; i > 0; i--) {
                 if (ilo_pkt_dequeue(hw, driver_ccb, SENDQ, &pkt_id, NULL, NULL))
                         break;
                 udelay(1);
@@ -326,7 +326,7 @@ static int ilo_ccb_open(struct ilo_hwinfo *hw, struct ccb_data *data, int slot)
 
         return 0;
 free:
-        pci_free_consistent(pdev, data->dma_size, data->dma_va, data->dma_pa);
+        ilo_ccb_close(pdev, data);
 out:
         return error;
 }
diff --git a/drivers/misc/hpilo.h b/drivers/misc/hpilo.h
index a281207696c..b64a20ef07e 100644
--- a/drivers/misc/hpilo.h
+++ b/drivers/misc/hpilo.h
@@ -19,6 +19,8 @@
 #define MAX_ILO_DEV     1
 /* max number of files */
 #define MAX_OPEN        (MAX_CCB * MAX_ILO_DEV)
+/* spin counter for open/close delay */
+#define MAX_WAIT        10000
 
 /*
  * Per device, used to track global memory allocations.
diff --git a/drivers/misc/sgi-gru/grufile.c b/drivers/misc/sgi-gru/grufile.c
index 65098380639..c67e4e8bd62 100644
--- a/drivers/misc/sgi-gru/grufile.c
+++ b/drivers/misc/sgi-gru/grufile.c
@@ -36,23 +36,11 @@
 #include <linux/interrupt.h>
 #include <linux/proc_fs.h>
 #include <linux/uaccess.h>
+#include <asm/uv/uv.h>
 #include "gru.h"
 #include "grulib.h"
 #include "grutables.h"
 
-#if defined CONFIG_X86_64
-#include <asm/genapic.h>
-#include <asm/irq.h>
-#define IS_UV()         is_uv_system()
-#elif defined CONFIG_IA64
-#include <asm/system.h>
-#include <asm/sn/simulator.h>
-/* temp support for running on hardware simulator */
-#define IS_UV()         IS_MEDUSA() || ia64_platform_is("uv")
-#else
-#define IS_UV()         0
-#endif
-
 #include <asm/uv/uv_hub.h>
 #include <asm/uv/uv_mmrs.h>
 
@@ -381,7 +369,7 @@ static int __init gru_init(void)
         char id[10];
         void *gru_start_vaddr;
 
-        if (!IS_UV())
+        if (!is_uv_system())
                 return 0;
 
 #if defined CONFIG_IA64
@@ -451,7 +439,7 @@ static void __exit gru_exit(void)
         int order = get_order(sizeof(struct gru_state) *
                               GRU_CHIPLETS_PER_BLADE);
 
-        if (!IS_UV())
+        if (!is_uv_system())
                 return;
 
         for (i = 0; i < GRU_CHIPLETS_PER_BLADE; i++)
diff --git a/drivers/misc/sgi-xp/xp.h b/drivers/misc/sgi-xp/xp.h
index 7b4cbd5e03e..2275126cb33 100644
--- a/drivers/misc/sgi-xp/xp.h
+++ b/drivers/misc/sgi-xp/xp.h
@@ -15,19 +15,19 @@
 
 #include <linux/mutex.h>
 
-#ifdef CONFIG_IA64
+#if defined CONFIG_X86_UV || defined CONFIG_IA64_SGI_UV
+#include <asm/uv/uv.h>
+#define is_uv()         is_uv_system()
+#endif
+
+#ifndef is_uv
+#define is_uv()         0
+#endif
+
+#if defined CONFIG_IA64
 #include <asm/system.h>
 #include <asm/sn/arch.h>        /* defines is_shub1() and is_shub2() */
 #define is_shub()       ia64_platform_is("sn2")
-#ifdef CONFIG_IA64_SGI_UV
-#define is_uv()         ia64_platform_is("uv")
-#else
-#define is_uv()         0
-#endif
-#endif
-#ifdef CONFIG_X86_64
-#include <asm/genapic.h>
-#define is_uv()         is_uv_system()
 #endif
 
 #ifndef is_shub1
@@ -42,10 +42,6 @@
 #define is_shub()       0
 #endif
 
-#ifndef is_uv
-#define is_uv()         0
-#endif
-
 #ifdef USE_DBUG_ON
 #define DBUG_ON(condition)      BUG_ON(condition)
 #else
diff --git a/drivers/misc/sgi-xp/xpc.h b/drivers/misc/sgi-xp/xpc.h
index a5bd658c2e8..275b78896a7 100644
--- a/drivers/misc/sgi-xp/xpc.h
+++ b/drivers/misc/sgi-xp/xpc.h
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2004-2008 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2004-2009 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 /*
@@ -514,7 +514,8 @@ struct xpc_channel_uv {
                                                 /* partition's notify mq */
 
         struct xpc_send_msg_slot_uv *send_msg_slots;
-        struct xpc_notify_mq_msg_uv *recv_msg_slots;
+        void *recv_msg_slots;   /* each slot will hold a xpc_notify_mq_msg_uv */
+                                /* structure plus the user's payload */
 
         struct xpc_fifo_head_uv msg_slot_free_list;
         struct xpc_fifo_head_uv recv_msg_list;  /* deliverable payloads */
diff --git a/drivers/misc/sgi-xp/xpc_main.c b/drivers/misc/sgi-xp/xpc_main.c
index 89218f7cfaa..6576170de96 100644
--- a/drivers/misc/sgi-xp/xpc_main.c
+++ b/drivers/misc/sgi-xp/xpc_main.c
@@ -318,7 +318,7 @@ xpc_hb_checker(void *ignore)
 
         /* this thread was marked active by xpc_hb_init() */
 
-        set_cpus_allowed_ptr(current, &cpumask_of_cpu(XPC_HB_CHECK_CPU));
+        set_cpus_allowed_ptr(current, cpumask_of(XPC_HB_CHECK_CPU));
 
         /* set our heartbeating to other partitions into motion */
         xpc_hb_check_timeout = jiffies + (xpc_hb_check_interval * HZ);
diff --git a/drivers/misc/sgi-xp/xpc_uv.c b/drivers/misc/sgi-xp/xpc_uv.c
index f17f7d40ea2..29c0502a96b 100644
--- a/drivers/misc/sgi-xp/xpc_uv.c
+++ b/drivers/misc/sgi-xp/xpc_uv.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (c) 2008 Silicon Graphics, Inc.  All Rights Reserved.
+ * Copyright (c) 2008-2009 Silicon Graphics, Inc.  All Rights Reserved.
  */
 
 /*
@@ -1010,8 +1010,8 @@ xpc_allocate_recv_msg_slot_uv(struct xpc_channel *ch)
                         continue;
 
                 for (entry = 0; entry < nentries; entry++) {
-                        msg_slot = ch_uv->recv_msg_slots + entry *
-                            ch->entry_size;
+                        msg_slot = ch_uv->recv_msg_slots +
+                            entry * ch->entry_size;
 
                         msg_slot->hdr.msg_slot_number = entry;
                 }
@@ -1308,9 +1308,8 @@ xpc_handle_notify_mq_msg_uv(struct xpc_partition *part,
         /* we're dealing with a normal message sent via the notify_mq */
         ch_uv = &ch->sn.uv;
 
-        msg_slot = (struct xpc_notify_mq_msg_uv *)((u64)ch_uv->recv_msg_slots +
-                    (msg->hdr.msg_slot_number % ch->remote_nentries) *
-                    ch->entry_size);
+        msg_slot = ch_uv->recv_msg_slots +
+            (msg->hdr.msg_slot_number % ch->remote_nentries) * ch->entry_size;
 
         BUG_ON(msg->hdr.msg_slot_number != msg_slot->hdr.msg_slot_number);
         BUG_ON(msg_slot->hdr.size != 0);
diff --git a/drivers/misc/sgi-xp/xpnet.c b/drivers/misc/sgi-xp/xpnet.c
index 7957f525b2f..6faefcffcb5 100644
--- a/drivers/misc/sgi-xp/xpnet.c
+++ b/drivers/misc/sgi-xp/xpnet.c
@@ -3,7 +3,7 @@
  * License.  See the file "COPYING" in the main directory of this archive
  * for more details.
  *
- * Copyright (C) 1999-2008 Silicon Graphics, Inc. All rights reserved.
+ * Copyright (C) 1999-2009 Silicon Graphics, Inc. All rights reserved.
  */
 
 /*
@@ -551,6 +551,7 @@ xpnet_init(void)
 
         netif_carrier_off(xpnet_device);
 
+        xpnet_device->netdev_ops = &xpnet_netdev_ops;
         xpnet_device->mtu = XPNET_DEF_MTU;
 
         /*
diff --git a/drivers/mmc/host/Kconfig b/drivers/mmc/host/Kconfig
index 0efa390978b..99d4b28d52e 100644
--- a/drivers/mmc/host/Kconfig
+++ b/drivers/mmc/host/Kconfig
@@ -145,6 +145,16 @@ config MMC_IMX
 
           If unsure, say N.
 
+config MMC_MXC
+        tristate "Freescale i.MX2/3 Multimedia Card Interface support"
+        depends on ARCH_MXC
+        help
+          This selects the Freescale i.MX2/3 Multimedia card Interface.
+          If you have a i.MX platform with a Multimedia Card slot,
+          say Y or M here.
+
+          If unsure, say N.
+
 config MMC_TIFM_SD
         tristate "TI Flash Media MMC/SD Interface support  (EXPERIMENTAL)"
         depends on EXPERIMENTAL && PCI
diff --git a/drivers/mmc/host/Makefile b/drivers/mmc/host/Makefile
index 98cab84829b..dedec55861d 100644
--- a/drivers/mmc/host/Makefile
+++ b/drivers/mmc/host/Makefile
@@ -9,6 +9,7 @@ endif
 obj-$(CONFIG_MMC_ARMMMCI)       += mmci.o
 obj-$(CONFIG_MMC_PXA)           += pxamci.o
 obj-$(CONFIG_MMC_IMX)           += imxmmc.o
+obj-$(CONFIG_MMC_MXC)           += mxcmmc.o
 obj-$(CONFIG_MMC_SDHCI)         += sdhci.o
 obj-$(CONFIG_MMC_SDHCI_PCI)     += sdhci-pci.o
 obj-$(CONFIG_MMC_RICOH_MMC)     += ricoh_mmc.o
diff --git a/drivers/mmc/host/mmci.c b/drivers/mmc/host/mmci.c
index 1bcbdd6763a..2909bbc8ad0 100644
--- a/drivers/mmc/host/mmci.c
+++ b/drivers/mmc/host/mmci.c
@@ -430,6 +430,8 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
                                 clk = 255;
                         host->cclk = host->mclk / (2 * (clk + 1));
                 }
+                if (host->hw_designer == 0x80)
+                        clk |= MCI_FCEN; /* Bug fix in ST IP block */
                 clk |= MCI_CLK_ENABLE;
         }
 
@@ -440,15 +442,27 @@ static void mmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
         case MMC_POWER_OFF:
                 break;
         case MMC_POWER_UP:
-                pwr |= MCI_PWR_UP;
-                break;
+                /* The ST version does not have this, fall through to POWER_ON */
+                if (host->hw_designer != 0x80) {
+                        pwr |= MCI_PWR_UP;
+                        break;
+                }
         case MMC_POWER_ON:
                 pwr |= MCI_PWR_ON;
                 break;
         }
 
-        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN)
-                pwr |= MCI_ROD;
+        if (ios->bus_mode == MMC_BUSMODE_OPENDRAIN) {
+                if (host->hw_designer != 0x80)
+                        pwr |= MCI_ROD;
+                else {
+                        /*
+                         * The ST Micro variant use the ROD bit for something
+                         * else and only has OD (Open Drain).
+                         */
+                        pwr |= MCI_OD;
+                }
+        }
 
         writel(clk, host->base + MMCICLOCK);
 
@@ -500,6 +514,12 @@ static int mmci_probe(struct amba_device *dev, void *id)
         }
 
         host = mmc_priv(mmc);
+        /* Bits 12 thru 19 is the designer */
+        host->hw_designer = (dev->periphid >> 12) & 0xff;
+        /* Bits 20 thru 23 is the revison */
+        host->hw_revision = (dev->periphid >> 20) & 0xf;
+        DBG(host, "designer ID = 0x%02x\n", host->hw_designer);
+        DBG(host, "revision = 0x%01x\n", host->hw_revision);
         host->clk = clk_get(&dev->dev, NULL);
         if (IS_ERR(host->clk)) {
                 ret = PTR_ERR(host->clk);
@@ -693,6 +713,15 @@ static struct amba_id mmci_ids[] = {
                 .id     = 0x00041181,
                 .mask   = 0x000fffff,
         },
+        /* ST Micro variants */
+        {
+                .id     = 0x00180180,
+                .mask   = 0x00ffffff,
+        },
+        {
+                .id     = 0x00280180,
+                .mask   = 0x00ffffff,
+        },
         { 0, 0 },
 };
 
diff --git a/drivers/mmc/host/mmci.h b/drivers/mmc/host/mmci.h
index 0f39c490f02..0441bac1c0e 100644
--- a/drivers/mmc/host/mmci.h
+++ b/drivers/mmc/host/mmci.h
@@ -11,13 +11,23 @@
 #define MCI_PWR_OFF             0x00
 #define MCI_PWR_UP              0x02
 #define MCI_PWR_ON              0x03
+#define MCI_DATA2DIREN          (1 << 2)
+#define MCI_CMDDIREN            (1 << 3)
+#define MCI_DATA0DIREN          (1 << 4)
+#define MCI_DATA31DIREN         (1 << 5)
 #define MCI_OD                  (1 << 6)
 #define MCI_ROD                 (1 << 7)
+/* The ST Micro version does not have ROD */
+#define MCI_FBCLKEN             (1 << 7)
+#define MCI_DATA74DIREN         (1 << 8)
 
 #define MMCICLOCK               0x004
 #define MCI_CLK_ENABLE          (1 << 8)
 #define MCI_CLK_PWRSAVE         (1 << 9)
 #define MCI_CLK_BYPASS          (1 << 10)
+#define MCI_WIDE_BUS            (1 << 11)
+/* HW flow control on the ST Micro version */
+#define MCI_FCEN                (1 << 13)
 
 #define MMCIARGUMENT            0x008
 #define MMCICOMMAND             0x00c
@@ -26,6 +36,10 @@
 #define MCI_CPSM_INTERRUPT      (1 << 8)
 #define MCI_CPSM_PENDING        (1 << 9)
 #define MCI_CPSM_ENABLE         (1 << 10)
+#define MCI_SDIO_SUSP           (1 << 11)
+#define MCI_ENCMD_COMPL         (1 << 12)
+#define MCI_NIEN                (1 << 13)
+#define MCI_CE_ATACMD           (1 << 14)
 
 #define MMCIRESPCMD             0x010
 #define MMCIRESPONSE0           0x014
@@ -39,6 +53,11 @@
 #define MCI_DPSM_DIRECTION      (1 << 1)
 #define MCI_DPSM_MODE           (1 << 2)
 #define MCI_DPSM_DMAENABLE      (1 << 3)
+#define MCI_DPSM_BLOCKSIZE      (1 << 4)
+#define MCI_DPSM_RWSTART        (1 << 8)
+#define MCI_DPSM_RWSTOP         (1 << 9)
+#define MCI_DPSM_RWMOD          (1 << 10)
+#define MCI_DPSM_SDIOEN         (1 << 11)
 
 #define MMCIDATACNT             0x030
 #define MMCISTATUS              0x034
@@ -63,6 +82,8 @@
 #define MCI_RXFIFOEMPTY         (1 << 19)
 #define MCI_TXDATAAVLBL         (1 << 20)
 #define MCI_RXDATAAVLBL         (1 << 21)
+#define MCI_SDIOIT              (1 << 22)
+#define MCI_CEATAEND            (1 << 23)
 
 #define MMCICLEAR               0x038
 #define MCI_CMDCRCFAILCLR       (1 << 0)
@@ -75,6 +96,8 @@
 #define MCI_CMDSENTCLR          (1 << 7)
 #define MCI_DATAENDCLR          (1 << 8)
 #define MCI_DATABLOCKENDCLR     (1 << 10)
+#define MCI_SDIOITC             (1 << 22)
+#define MCI_CEATAENDC           (1 << 23)
 
 #define MMCIMASK0               0x03c
 #define MCI_CMDCRCFAILMASK      (1 << 0)
@@ -98,6 +121,8 @@
 #define MCI_RXFIFOEMPTYMASK     (1 << 19)
 #define MCI_TXDATAAVLBLMASK     (1 << 20)
 #define MCI_RXDATAAVLBLMASK     (1 << 21)
+#define MCI_SDIOITMASK          (1 << 22)
+#define MCI_CEATAENDMASK        (1 << 23)
 
 #define MMCIMASK1               0x040
 #define MMCIFIFOCNT             0x048
@@ -136,6 +161,9 @@ struct mmci_host {
         u32                     pwr;
         struct mmc_platform_data *plat;
 
+        u8                      hw_designer;
+        u8                      hw_revision:4;
+
         struct timer_list       timer;
         unsigned int            oldstat;
 
diff --git a/drivers/mmc/host/mxcmmc.c b/drivers/mmc/host/mxcmmc.c
new file mode 100644
index 00000000000..dda0be4e25d
--- /dev/null
+++ b/drivers/mmc/host/mxcmmc.c
@@ -0,0 +1,880 @@
+/*
+ *  linux/drivers/mmc/host/mxcmmc.c - Freescale i.MX MMCI driver
+ *
+ *  This is a driver for the SDHC controller found in Freescale MX2/MX3
+ *  SoCs. It is basically the same hardware as found on MX1 (imxmmc.c).
+ *  Unlike the hardware found on MX1, this hardware just works and does
+ *  not need all the quirks found in imxmmc.c, hence the seperate driver.
+ *
+ *  Copyright (C) 2008 Sascha Hauer, Pengutronix <s.hauer@pengutronix.de>
+ *  Copyright (C) 2006 Pavel Pisa, PiKRON <ppisa@pikron.com>
+ *
+ *  derived from pxamci.c by Russell King
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License version 2 as
+ * published by the Free Software Foundation.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/init.h>
+#include <linux/ioport.h>
+#include <linux/platform_device.h>
+#include <linux/interrupt.h>
+#include <linux/irq.h>
+#include <linux/blkdev.h>
+#include <linux/dma-mapping.h>
+#include <linux/mmc/host.h>
+#include <linux/mmc/card.h>
+#include <linux/delay.h>
+#include <linux/clk.h>
+#include <linux/io.h>
+#include <linux/gpio.h>
+
+#include <asm/dma.h>
+#include <asm/irq.h>
+#include <asm/sizes.h>
+#include <mach/mmc.h>
+
+#ifdef CONFIG_ARCH_MX2
+#include <mach/dma-mx1-mx2.h>
+#define HAS_DMA
+#endif
+
+#define DRIVER_NAME "imx-mmc"
+
+#define MMC_REG_STR_STP_CLK             0x00
+#define MMC_REG_STATUS                  0x04
+#define MMC_REG_CLK_RATE                0x08
+#define MMC_REG_CMD_DAT_CONT            0x0C
+#define MMC_REG_RES_TO                  0x10
+#define MMC_REG_READ_TO                 0x14
+#define MMC_REG_BLK_LEN                 0x18
+#define MMC_REG_NOB                     0x1C
+#define MMC_REG_REV_NO                  0x20
+#define MMC_REG_INT_CNTR                0x24
+#define MMC_REG_CMD                     0x28
+#define MMC_REG_ARG                     0x2C
+#define MMC_REG_RES_FIFO                0x34
+#define MMC_REG_BUFFER_ACCESS           0x38
+
+#define STR_STP_CLK_RESET               (1 << 3)
+#define STR_STP_CLK_START_CLK           (1 << 1)
+#define STR_STP_CLK_STOP_CLK            (1 << 0)
+
+#define STATUS_CARD_INSERTION           (1 << 31)
+#define STATUS_CARD_REMOVAL             (1 << 30)
+#define STATUS_YBUF_EMPTY               (1 << 29)
+#define STATUS_XBUF_EMPTY               (1 << 28)
+#define STATUS_YBUF_FULL                (1 << 27)
+#define STATUS_XBUF_FULL                (1 << 26)
+#define STATUS_BUF_UND_RUN              (1 << 25)
+#define STATUS_BUF_OVFL                 (1 << 24)
+#define STATUS_SDIO_INT_ACTIVE          (1 << 14)
+#define STATUS_END_CMD_RESP             (1 << 13)
+#define STATUS_WRITE_OP_DONE            (1 << 12)
+#define STATUS_DATA_TRANS_DONE          (1 << 11)
+#define STATUS_READ_OP_DONE             (1 << 11)
+#define STATUS_WR_CRC_ERROR_CODE_MASK   (3 << 10)
+#define STATUS_CARD_BUS_CLK_RUN         (1 << 8)
+#define STATUS_BUF_READ_RDY             (1 << 7)
+#define STATUS_BUF_WRITE_RDY            (1 << 6)
+#define STATUS_RESP_CRC_ERR             (1 << 5)
+#define STATUS_CRC_READ_ERR             (1 << 3)
+#define STATUS_CRC_WRITE_ERR            (1 << 2)
+#define STATUS_TIME_OUT_RESP            (1 << 1)
+#define STATUS_TIME_OUT_READ            (1 << 0)
+#define STATUS_ERR_MASK                 0x2f
+
+#define CMD_DAT_CONT_CMD_RESP_LONG_OFF  (1 << 12)
+#define CMD_DAT_CONT_STOP_READWAIT      (1 << 11)
+#define CMD_DAT_CONT_START_READWAIT     (1 << 10)
+#define CMD_DAT_CONT_BUS_WIDTH_4        (2 << 8)
+#define CMD_DAT_CONT_INIT               (1 << 7)
+#define CMD_DAT_CONT_WRITE              (1 << 4)
+#define CMD_DAT_CONT_DATA_ENABLE        (1 << 3)
+#define CMD_DAT_CONT_RESPONSE_48BIT_CRC (1 << 0)
+#define CMD_DAT_CONT_RESPONSE_136BIT    (2 << 0)
+#define CMD_DAT_CONT_RESPONSE_48BIT     (3 << 0)
+
+#define INT_SDIO_INT_WKP_EN             (1 << 18)
+#define INT_CARD_INSERTION_WKP_EN       (1 << 17)
+#define INT_CARD_REMOVAL_WKP_EN         (1 << 16)
+#define INT_CARD_INSERTION_EN           (1 << 15)
+#define INT_CARD_REMOVAL_EN             (1 << 14)
+#define INT_SDIO_IRQ_EN                 (1 << 13)
+#define INT_DAT0_EN                     (1 << 12)
+#define INT_BUF_READ_EN                 (1 << 4)
+#define INT_BUF_WRITE_EN                (1 << 3)
+#define INT_END_CMD_RES_EN              (1 << 2)
+#define INT_WRITE_OP_DONE_EN            (1 << 1)
+#define INT_READ_OP_EN                  (1 << 0)
+
+struct mxcmci_host {
+        struct mmc_host         *mmc;
+        struct resource         *res;
+        void __iomem            *base;
+        int                     irq;
+        int                     detect_irq;
+        int                     dma;
+        int                     do_dma;
+        unsigned int            power_mode;
+        struct imxmmc_platform_data *pdata;
+
+        struct mmc_request      *req;
+        struct mmc_command      *cmd;
+        struct mmc_data         *data;
+
+        unsigned int            dma_nents;
+        unsigned int            datasize;
+        unsigned int            dma_dir;
+
+        u16                     rev_no;
+        unsigned int            cmdat;
+
+        struct clk              *clk;
+
+        int                     clock;
+
+        struct work_struct      datawork;
+};
+
+static inline int mxcmci_use_dma(struct mxcmci_host *host)
+{
+        return host->do_dma;
+}
+
+static void mxcmci_softreset(struct mxcmci_host *host)
+{
+        int i;
+
+        /* reset sequence */
+        writew(STR_STP_CLK_RESET, host->base + MMC_REG_STR_STP_CLK);
+        writew(STR_STP_CLK_RESET | STR_STP_CLK_START_CLK,
+                        host->base + MMC_REG_STR_STP_CLK);
+
+        for (i = 0; i < 8; i++)
+                writew(STR_STP_CLK_START_CLK, host->base + MMC_REG_STR_STP_CLK);
+
+        writew(0xff, host->base + MMC_REG_RES_TO);
+}
+
+static void mxcmci_setup_data(struct mxcmci_host *host, struct mmc_data *data)
+{
+        unsigned int nob = data->blocks;
+        unsigned int blksz = data->blksz;
+        unsigned int datasize = nob * blksz;
+#ifdef HAS_DMA
+        struct scatterlist *sg;
+        int i;
+#endif
+        if (data->flags & MMC_DATA_STREAM)
+                nob = 0xffff;
+
+        host->data = data;
+        data->bytes_xfered = 0;
+
+        writew(nob, host->base + MMC_REG_NOB);
+        writew(blksz, host->base + MMC_REG_BLK_LEN);
+        host->datasize = datasize;
+
+#ifdef HAS_DMA
+        for_each_sg(data->sg, sg, data->sg_len, i) {
+                if (sg->offset & 3 || sg->length & 3) {
+                        host->do_dma = 0;
+                        return;
+                }
+        }
+
+        if (data->flags & MMC_DATA_READ) {
+                host->dma_dir = DMA_FROM_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                             data->sg_len,  host->dma_dir);
+
+                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
+                                 host->res->start + MMC_REG_BUFFER_ACCESS,
+                                 DMA_MODE_READ);
+        } else {
+                host->dma_dir = DMA_TO_DEVICE;
+                host->dma_nents = dma_map_sg(mmc_dev(host->mmc), data->sg,
+                                             data->sg_len,  host->dma_dir);
+
+                imx_dma_setup_sg(host->dma, data->sg, host->dma_nents, datasize,
+                                 host->res->start + MMC_REG_BUFFER_ACCESS,
+                                 DMA_MODE_WRITE);
+        }
+
+        wmb();
+
+        imx_dma_enable(host->dma);
+#endif /* HAS_DMA */
+}
+
+static int mxcmci_start_cmd(struct mxcmci_host *host, struct mmc_command *cmd,
+                unsigned int cmdat)
+{
+        WARN_ON(host->cmd != NULL);
+        host->cmd = cmd;
+
+        switch (mmc_resp_type(cmd)) {
+        case MMC_RSP_R1: /* short CRC, OPCODE */
+        case MMC_RSP_R1B:/* short CRC, OPCODE, BUSY */
+                cmdat |= CMD_DAT_CONT_RESPONSE_48BIT_CRC;
+                break;
+        case MMC_RSP_R2: /* long 136 bit + CRC */
+                cmdat |= CMD_DAT_CONT_RESPONSE_136BIT;
+                break;
+        case MMC_RSP_R3: /* short */
+                cmdat |= CMD_DAT_CONT_RESPONSE_48BIT;
+                break;
+        case MMC_RSP_NONE:
+                break;
+        default:
+                dev_err(mmc_dev(host->mmc), "unhandled response type 0x%x\n",
+                                mmc_resp_type(cmd));
+                cmd->error = -EINVAL;
+                return -EINVAL;
+        }
+
+        if (mxcmci_use_dma(host))
+                writel(INT_READ_OP_EN | INT_WRITE_OP_DONE_EN |
+                                INT_END_CMD_RES_EN,
+                                host->base + MMC_REG_INT_CNTR);
+        else
+                writel(INT_END_CMD_RES_EN, host->base + MMC_REG_INT_CNTR);
+
+        writew(cmd->opcode, host->base + MMC_REG_CMD);
+        writel(cmd->arg, host->base + MMC_REG_ARG);
+        writew(cmdat, host->base + MMC_REG_CMD_DAT_CONT);
+
+        return 0;
+}
+
+static void mxcmci_finish_request(struct mxcmci_host *host,
+                struct mmc_request *req)
+{
+        writel(0, host->base + MMC_REG_INT_CNTR);
+
+        host->req = NULL;
+        host->cmd = NULL;
+        host->data = NULL;
+
+        mmc_request_done(host->mmc, req);
+}
+
+static int mxcmci_finish_data(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+
+#ifdef HAS_DMA
+        if (mxcmci_use_dma(host)) {
+                imx_dma_disable(host->dma);
+                dma_unmap_sg(mmc_dev(host->mmc), data->sg, host->dma_nents,
+                                host->dma_dir);
+        }
+#endif
+
+        if (stat & STATUS_ERR_MASK) {
+                dev_dbg(mmc_dev(host->mmc), "request failed. status: 0x%08x\n",
+                                stat);
+                if (stat & STATUS_CRC_READ_ERR) {
+                        data->error = -EILSEQ;
+                } else if (stat & STATUS_CRC_WRITE_ERR) {
+                        u32 err_code = (stat >> 9) & 0x3;
+                        if (err_code == 2) /* No CRC response */
+                                data->error = -ETIMEDOUT;
+                        else
+                                data->error = -EILSEQ;
+                } else if (stat & STATUS_TIME_OUT_READ) {
+                        data->error = -ETIMEDOUT;
+                } else {
+                        data->error = -EIO;
+                }
+        } else {
+                data->bytes_xfered = host->datasize;
+        }
+
+        data_error = data->error;
+
+        host->data = NULL;
+
+        return data_error;
+}
+
+static void mxcmci_read_response(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_command *cmd = host->cmd;
+        int i;
+        u32 a, b, c;
+
+        if (!cmd)
+                return;
+
+        if (stat & STATUS_TIME_OUT_RESP) {
+                dev_dbg(mmc_dev(host->mmc), "CMD TIMEOUT\n");
+                cmd->error = -ETIMEDOUT;
+        } else if (stat & STATUS_RESP_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
+                dev_dbg(mmc_dev(host->mmc), "cmd crc error\n");
+                cmd->error = -EILSEQ;
+        }
+
+        if (cmd->flags & MMC_RSP_PRESENT) {
+                if (cmd->flags & MMC_RSP_136) {
+                        for (i = 0; i < 4; i++) {
+                                a = readw(host->base + MMC_REG_RES_FIFO);
+                                b = readw(host->base + MMC_REG_RES_FIFO);
+                                cmd->resp[i] = a << 16 | b;
+                        }
+                } else {
+                        a = readw(host->base + MMC_REG_RES_FIFO);
+                        b = readw(host->base + MMC_REG_RES_FIFO);
+                        c = readw(host->base + MMC_REG_RES_FIFO);
+                        cmd->resp[0] = a << 24 | b << 8 | c >> 8;
+                }
+        }
+}
+
+static int mxcmci_poll_status(struct mxcmci_host *host, u32 mask)
+{
+        u32 stat;
+        unsigned long timeout = jiffies + HZ;
+
+        do {
+                stat = readl(host->base + MMC_REG_STATUS);
+                if (stat & STATUS_ERR_MASK)
+                        return stat;
+                if (time_after(jiffies, timeout))
+                        return STATUS_TIME_OUT_READ;
+                if (stat & mask)
+                        return 0;
+                cpu_relax();
+        } while (1);
+}
+
+static int mxcmci_pull(struct mxcmci_host *host, void *_buf, int bytes)
+{
+        unsigned int stat;
+        u32 *buf = _buf;
+
+        while (bytes > 3) {
+                stat = mxcmci_poll_status(host,
+                                STATUS_BUF_READ_RDY | STATUS_READ_OP_DONE);
+                if (stat)
+                        return stat;
+                *buf++ = readl(host->base + MMC_REG_BUFFER_ACCESS);
+                bytes -= 4;
+        }
+
+        if (bytes) {
+                u8 *b = (u8 *)buf;
+                u32 tmp;
+
+                stat = mxcmci_poll_status(host,
+                                STATUS_BUF_READ_RDY | STATUS_READ_OP_DONE);
+                if (stat)
+                        return stat;
+                tmp = readl(host->base + MMC_REG_BUFFER_ACCESS);
+                memcpy(b, &tmp, bytes);
+        }
+
+        return 0;
+}
+
+static int mxcmci_push(struct mxcmci_host *host, void *_buf, int bytes)
+{
+        unsigned int stat;
+        u32 *buf = _buf;
+
+        while (bytes > 3) {
+                stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+                if (stat)
+                        return stat;
+                writel(*buf++, host->base + MMC_REG_BUFFER_ACCESS);
+                bytes -= 4;
+        }
+
+        if (bytes) {
+                u8 *b = (u8 *)buf;
+                u32 tmp;
+
+                stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+                if (stat)
+                        return stat;
+
+                memcpy(&tmp, b, bytes);
+                writel(tmp, host->base + MMC_REG_BUFFER_ACCESS);
+        }
+
+        stat = mxcmci_poll_status(host, STATUS_BUF_WRITE_RDY);
+        if (stat)
+                return stat;
+
+        return 0;
+}
+
+static int mxcmci_transfer_data(struct mxcmci_host *host)
+{
+        struct mmc_data *data = host->req->data;
+        struct scatterlist *sg;
+        int stat, i;
+
+        host->datasize = 0;
+
+        host->data = data;
+        host->datasize = 0;
+
+        if (data->flags & MMC_DATA_READ) {
+                for_each_sg(data->sg, sg, data->sg_len, i) {
+                        stat = mxcmci_pull(host, sg_virt(sg), sg->length);
+                        if (stat)
+                                return stat;
+                        host->datasize += sg->length;
+                }
+        } else {
+                for_each_sg(data->sg, sg, data->sg_len, i) {
+                        stat = mxcmci_push(host, sg_virt(sg), sg->length);
+                        if (stat)
+                                return stat;
+                        host->datasize += sg->length;
+                }
+                stat = mxcmci_poll_status(host, STATUS_WRITE_OP_DONE);
+                if (stat)
+                        return stat;
+        }
+        return 0;
+}
+
+static void mxcmci_datawork(struct work_struct *work)
+{
+        struct mxcmci_host *host = container_of(work, struct mxcmci_host,
+                                                  datawork);
+        int datastat = mxcmci_transfer_data(host);
+        mxcmci_finish_data(host, datastat);
+
+        if (host->req->stop) {
+                if (mxcmci_start_cmd(host, host->req->stop, 0)) {
+                        mxcmci_finish_request(host, host->req);
+                        return;
+                }
+        } else {
+                mxcmci_finish_request(host, host->req);
+        }
+}
+
+#ifdef HAS_DMA
+static void mxcmci_data_done(struct mxcmci_host *host, unsigned int stat)
+{
+        struct mmc_data *data = host->data;
+        int data_error;
+
+        if (!data)
+                return;
+
+        data_error = mxcmci_finish_data(host, stat);
+
+        mxcmci_read_response(host, stat);
+        host->cmd = NULL;
+
+        if (host->req->stop) {
+                if (mxcmci_start_cmd(host, host->req->stop, 0)) {
+                        mxcmci_finish_request(host, host->req);
+                        return;
+                }
+        } else {
+                mxcmci_finish_request(host, host->req);
+        }
+}
+#endif /* HAS_DMA */
+
+static void mxcmci_cmd_done(struct mxcmci_host *host, unsigned int stat)
+{
+        mxcmci_read_response(host, stat);
+        host->cmd = NULL;
+
+        if (!host->data && host->req) {
+                mxcmci_finish_request(host, host->req);
+                return;
+        }
+
+        /* For the DMA case the DMA engine handles the data transfer
+         * automatically. For non DMA we have to to it ourselves.
+         * Don't do it in interrupt context though.
+         */
+        if (!mxcmci_use_dma(host) && host->data)
+                schedule_work(&host->datawork);
+
+}
+
+static irqreturn_t mxcmci_irq(int irq, void *devid)
+{
+        struct mxcmci_host *host = devid;
+        u32 stat;
+
+        stat = readl(host->base + MMC_REG_STATUS);
+        writel(stat, host->base + MMC_REG_STATUS);
+
+        dev_dbg(mmc_dev(host->mmc), "%s: 0x%08x\n", __func__, stat);
+
+        if (stat & STATUS_END_CMD_RESP)
+                mxcmci_cmd_done(host, stat);
+#ifdef HAS_DMA
+        if (mxcmci_use_dma(host) &&
+                  (stat & (STATUS_DATA_TRANS_DONE | STATUS_WRITE_OP_DONE)))
+                mxcmci_data_done(host, stat);
+#endif
+        return IRQ_HANDLED;
+}
+
+static void mxcmci_request(struct mmc_host *mmc, struct mmc_request *req)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+        unsigned int cmdat = host->cmdat;
+
+        WARN_ON(host->req != NULL);
+
+        host->req = req;
+        host->cmdat &= ~CMD_DAT_CONT_INIT;
+#ifdef HAS_DMA
+        host->do_dma = 1;
+#endif
+        if (req->data) {
+                mxcmci_setup_data(host, req->data);
+
+                cmdat |= CMD_DAT_CONT_DATA_ENABLE;
+
+                if (req->data->flags & MMC_DATA_WRITE)
+                        cmdat |= CMD_DAT_CONT_WRITE;
+        }
+
+        if (mxcmci_start_cmd(host, req->cmd, cmdat))
+                mxcmci_finish_request(host, req);
+}
+
+static void mxcmci_set_clk_rate(struct mxcmci_host *host, unsigned int clk_ios)
+{
+        unsigned int divider;
+        int prescaler = 0;
+        unsigned int clk_in = clk_get_rate(host->clk);
+
+        while (prescaler <= 0x800) {
+                for (divider = 1; divider <= 0xF; divider++) {
+                        int x;
+
+                        x = (clk_in / (divider + 1));
+
+                        if (prescaler)
+                                x /= (prescaler * 2);
+
+                        if (x <= clk_ios)
+                                break;
+                }
+                if (divider < 0x10)
+                        break;
+
+                if (prescaler == 0)
+                        prescaler = 1;
+                else
+                        prescaler <<= 1;
+        }
+
+        writew((prescaler << 4) | divider, host->base + MMC_REG_CLK_RATE);
+
+        dev_dbg(mmc_dev(host->mmc), "scaler: %d divider: %d in: %d out: %d\n",
+                        prescaler, divider, clk_in, clk_ios);
+}
+
+static void mxcmci_set_ios(struct mmc_host *mmc, struct mmc_ios *ios)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+#ifdef HAS_DMA
+        unsigned int blen;
+        /*
+         * use burstlen of 64 in 4 bit mode (--> reg value  0)
+         * use burstlen of 16 in 1 bit mode (--> reg value 16)
+         */
+        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                blen = 0;
+        else
+                blen = 16;
+
+        imx_dma_config_burstlen(host->dma, blen);
+#endif
+        if (ios->bus_width == MMC_BUS_WIDTH_4)
+                host->cmdat |= CMD_DAT_CONT_BUS_WIDTH_4;
+        else
+                host->cmdat &= ~CMD_DAT_CONT_BUS_WIDTH_4;
+
+        if (host->power_mode != ios->power_mode) {
+                if (host->pdata && host->pdata->setpower)
+                        host->pdata->setpower(mmc_dev(mmc), ios->vdd);
+                host->power_mode = ios->power_mode;
+                if (ios->power_mode == MMC_POWER_ON)
+                        host->cmdat |= CMD_DAT_CONT_INIT;
+        }
+
+        if (ios->clock) {
+                mxcmci_set_clk_rate(host, ios->clock);
+                writew(STR_STP_CLK_START_CLK, host->base + MMC_REG_STR_STP_CLK);
+        } else {
+                writew(STR_STP_CLK_STOP_CLK, host->base + MMC_REG_STR_STP_CLK);
+        }
+
+        host->clock = ios->clock;
+}
+
+static irqreturn_t mxcmci_detect_irq(int irq, void *data)
+{
+        struct mmc_host *mmc = data;
+
+        dev_dbg(mmc_dev(mmc), "%s\n", __func__);
+
+        mmc_detect_change(mmc, msecs_to_jiffies(250));
+        return IRQ_HANDLED;
+}
+
+static int mxcmci_get_ro(struct mmc_host *mmc)
+{
+        struct mxcmci_host *host = mmc_priv(mmc);
+
+        if (host->pdata && host->pdata->get_ro)
+                return !!host->pdata->get_ro(mmc_dev(mmc));
+        /*
+         * Board doesn't support read only detection; let the mmc core
+         * decide what to do.
+         */
+        return -ENOSYS;
+}
+
+
+static const struct mmc_host_ops mxcmci_ops = {
+        .request        = mxcmci_request,
+        .set_ios        = mxcmci_set_ios,
+        .get_ro         = mxcmci_get_ro,
+};
+
+static int mxcmci_probe(struct platform_device *pdev)
+{
+        struct mmc_host *mmc;
+        struct mxcmci_host *host = NULL;
+        struct resource *r;
+        int ret = 0, irq;
+
+        printk(KERN_INFO "i.MX SDHC driver\n");
+
+        r = platform_get_resource(pdev, IORESOURCE_MEM, 0);
+        irq = platform_get_irq(pdev, 0);
+        if (!r || irq < 0)
+                return -EINVAL;
+
+        r = request_mem_region(r->start, resource_size(r), pdev->name);
+        if (!r)
+                return -EBUSY;
+
+        mmc = mmc_alloc_host(sizeof(struct mxcmci_host), &pdev->dev);
+        if (!mmc) {
+                ret = -ENOMEM;
+                goto out_release_mem;
+        }
+
+        mmc->ops = &mxcmci_ops;
+        mmc->caps = MMC_CAP_4_BIT_DATA;
+
+        /* MMC core transfer sizes tunable parameters */
+        mmc->max_hw_segs = 64;
+        mmc->max_phys_segs = 64;
+        mmc->max_blk_size = 2048;
+        mmc->max_blk_count = 65535;
+        mmc->max_req_size = mmc->max_blk_size * mmc->max_blk_count;
+        mmc->max_seg_size = mmc->max_seg_size;
+
+        host = mmc_priv(mmc);
+        host->base = ioremap(r->start, resource_size(r));
+        if (!host->base) {
+                ret = -ENOMEM;
+                goto out_free;
+        }
+
+        host->mmc = mmc;
+        host->pdata = pdev->dev.platform_data;
+
+        if (host->pdata && host->pdata->ocr_avail)
+                mmc->ocr_avail = host->pdata->ocr_avail;
+        else
+                mmc->ocr_avail = MMC_VDD_32_33 | MMC_VDD_33_34;
+
+        host->res = r;
+        host->irq = irq;
+
+        host->clk = clk_get(&pdev->dev, "sdhc_clk");
+        if (IS_ERR(host->clk)) {
+                ret = PTR_ERR(host->clk);
+                goto out_iounmap;
+        }
+        clk_enable(host->clk);
+
+        mxcmci_softreset(host);
+
+        host->rev_no = readw(host->base + MMC_REG_REV_NO);
+        if (host->rev_no != 0x400) {
+                ret = -ENODEV;
+                dev_err(mmc_dev(host->mmc), "wrong rev.no. 0x%08x. aborting.\n",
+                        host->rev_no);
+                goto out_clk_put;
+        }
+
+        mmc->f_min = clk_get_rate(host->clk) >> 7;
+        mmc->f_max = clk_get_rate(host->clk) >> 1;
+
+        /* recommended in data sheet */
+        writew(0x2db4, host->base + MMC_REG_READ_TO);
+
+        writel(0, host->base + MMC_REG_INT_CNTR);
+
+#ifdef HAS_DMA
+        host->dma = imx_dma_request_by_prio(DRIVER_NAME, DMA_PRIO_LOW);
+        if (host->dma < 0) {
+                dev_err(mmc_dev(host->mmc), "imx_dma_request_by_prio failed\n");
+                ret = -EBUSY;
+                goto out_clk_put;
+        }
+
+        r = platform_get_resource(pdev, IORESOURCE_DMA, 0);
+        if (!r) {
+                ret = -EINVAL;
+                goto out_free_dma;
+        }
+
+        ret = imx_dma_config_channel(host->dma,
+                                     IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_FIFO,
+                                     IMX_DMA_MEMSIZE_32 | IMX_DMA_TYPE_LINEAR,
+                                     r->start, 0);
+        if (ret) {
+                dev_err(mmc_dev(host->mmc), "failed to config DMA channel\n");
+                goto out_free_dma;
+        }
+#endif
+        INIT_WORK(&host->datawork, mxcmci_datawork);
+
+        ret = request_irq(host->irq, mxcmci_irq, 0, DRIVER_NAME, host);
+        if (ret)
+                goto out_free_dma;
+
+        platform_set_drvdata(pdev, mmc);
+
+        if (host->pdata && host->pdata->init) {
+                ret = host->pdata->init(&pdev->dev, mxcmci_detect_irq,
+                                host->mmc);
+                if (ret)
+                        goto out_free_irq;
+        }
+
+        mmc_add_host(mmc);
+
+        return 0;
+
+out_free_irq:
+        free_irq(host->irq, host);
+out_free_dma:
+#ifdef HAS_DMA
+        imx_dma_free(host->dma);
+#endif
+out_clk_put:
+        clk_disable(host->clk);
+        clk_put(host->clk);
+out_iounmap:
+        iounmap(host->base);
+out_free:
+        mmc_free_host(mmc);
+out_release_mem:
+        release_mem_region(host->res->start, resource_size(host->res));
+        return ret;
+}
+
+static int mxcmci_remove(struct platform_device *pdev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(pdev);
+        struct mxcmci_host *host = mmc_priv(mmc);
+
+        platform_set_drvdata(pdev, NULL);
+
+        mmc_remove_host(mmc);
+
+        if (host->pdata && host->pdata->exit)
+                host->pdata->exit(&pdev->dev, mmc);
+
+        free_irq(host->irq, host);
+        iounmap(host->base);
+#ifdef HAS_DMA
+        imx_dma_free(host->dma);
+#endif
+        clk_disable(host->clk);
+        clk_put(host->clk);
+
+        release_mem_region(host->res->start, resource_size(host->res));
+        release_resource(host->res);
+
+        mmc_free_host(mmc);
+
+        return 0;
+}
+
+#ifdef CONFIG_PM
+static int mxcmci_suspend(struct platform_device *dev, pm_message_t state)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        int ret = 0;
+
+        if (mmc)
+                ret = mmc_suspend_host(mmc, state);
+
+        return ret;
+}
+
+static int mxcmci_resume(struct platform_device *dev)
+{
+        struct mmc_host *mmc = platform_get_drvdata(dev);
+        struct mxcmci_host *host;
+        int ret = 0;
+
+        if (mmc) {
+                host = mmc_priv(mmc);
+                ret = mmc_resume_host(mmc);
+        }
+
+        return ret;
+}
+#else
+#define mxcmci_suspend  NULL
+#define mxcmci_resume   NULL
+#endif /* CONFIG_PM */
+
+static struct platform_driver mxcmci_driver = {
+        .probe          = mxcmci_probe,
+        .remove         = mxcmci_remove,
+        .suspend        = mxcmci_suspend,
+        .resume         = mxcmci_resume,
+        .driver         = {
+                .name           = DRIVER_NAME,
+                .owner          = THIS_MODULE,
+        }
+};
+
+static int __init mxcmci_init(void)
+{
+        return platform_driver_register(&mxcmci_driver);
+}
+
+static void __exit mxcmci_exit(void)
+{
+        platform_driver_unregister(&mxcmci_driver);
+}
+
+module_init(mxcmci_init);
+module_exit(mxcmci_exit);
+
+MODULE_DESCRIPTION("i.MX Multimedia Card Interface Driver");
+MODULE_AUTHOR("Sascha Hauer, Pengutronix");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("platform:imx-mmc");
diff --git a/drivers/mmc/host/pxamci.c b/drivers/mmc/host/pxamci.c
index 3c5483b75da..9702ad3774c 100644
--- a/drivers/mmc/host/pxamci.c
+++ b/drivers/mmc/host/pxamci.c
@@ -180,7 +180,15 @@ static void pxamci_setup_data(struct pxamci_host *host, struct mmc_data *data)
         else
                 DALGN &= ~(1 << host->dma);
         DDADR(host->dma) = host->sg_dma;
-        DCSR(host->dma) = DCSR_RUN;
+
+        /*
+         * workaround for erratum #91:
+         * only start DMA now if we are doing a read,
+         * otherwise we wait until CMD/RESP has finished
+         * before starting DMA.
+         */
+        if (!cpu_is_pxa27x() || data->flags & MMC_DATA_READ)
+                DCSR(host->dma) = DCSR_RUN;
 }
 
 static void pxamci_start_cmd(struct pxamci_host *host, struct mmc_command *cmd, unsigned int cmdat)
@@ -251,23 +259,28 @@ static int pxamci_cmd_done(struct pxamci_host *host, unsigned int stat)
         if (stat & STAT_TIME_OUT_RESPONSE) {
                 cmd->error = -ETIMEDOUT;
         } else if (stat & STAT_RES_CRC_ERR && cmd->flags & MMC_RSP_CRC) {
-#ifdef CONFIG_PXA27x
                 /*
                  * workaround for erratum #42:
                  * Intel PXA27x Family Processor Specification Update Rev 001
                  * A bogus CRC error can appear if the msb of a 136 bit
                  * response is a one.
                  */
-                if (cmd->flags & MMC_RSP_136 && cmd->resp[0] & 0x80000000) {
+                if (cpu_is_pxa27x() &&
+                    (cmd->flags & MMC_RSP_136 && cmd->resp[0] & 0x80000000))
                         pr_debug("ignoring CRC from command %d - *risky*\n", cmd->opcode);
-                } else
-#endif
-                cmd->error = -EILSEQ;
+                else
+                        cmd->error = -EILSEQ;
         }
 
         pxamci_disable_irq(host, END_CMD_RES);
         if (host->data && !cmd->error) {
                 pxamci_enable_irq(host, DATA_TRAN_DONE);
+                /*
+                 * workaround for erratum #91, if doing write
+                 * enable DMA late
+                 */
+                if (cpu_is_pxa27x() && host->data->flags & MMC_DATA_WRITE)
+                        DCSR(host->dma) = DCSR_RUN;
         } else {
                 pxamci_finish_request(host, host->mrq);
         }
diff --git a/drivers/mmc/host/ricoh_mmc.c b/drivers/mmc/host/ricoh_mmc.c
index be9e7b32b34..f6279051332 100644
--- a/drivers/mmc/host/ricoh_mmc.c
+++ b/drivers/mmc/host/ricoh_mmc.c
@@ -196,7 +196,7 @@ static void __devexit ricoh_mmc_remove(struct pci_dev *pdev)
         pci_set_drvdata(pdev, NULL);
 }
 
-static int ricoh_mmc_suspend(struct pci_dev *pdev, pm_message_t state)
+static int ricoh_mmc_suspend_late(struct pci_dev *pdev, pm_message_t state)
 {
         struct pci_dev *fw_dev = NULL;
 
@@ -210,7 +210,7 @@ static int ricoh_mmc_suspend(struct pci_dev *pdev, pm_message_t state)
         return 0;
 }
 
-static int ricoh_mmc_resume(struct pci_dev *pdev)
+static int ricoh_mmc_resume_early(struct pci_dev *pdev)
 {
         struct pci_dev *fw_dev = NULL;
 
@@ -229,8 +229,8 @@ static struct pci_driver ricoh_mmc_driver = {
         .id_table =     pci_ids,
         .probe =        ricoh_mmc_probe,
         .remove =       __devexit_p(ricoh_mmc_remove),
-        .suspend =      ricoh_mmc_suspend,
-        .resume =       ricoh_mmc_resume,
+        .suspend_late = ricoh_mmc_suspend_late,
+        .resume_early = ricoh_mmc_resume_early,
 };
 
 /*****************************************************************************\
diff --git a/drivers/mtd/maps/sa1100-flash.c b/drivers/mtd/maps/sa1100-flash.c
index 7df6bbf0e4d..6f6a0f6dafd 100644
--- a/drivers/mtd/maps/sa1100-flash.c
+++ b/drivers/mtd/maps/sa1100-flash.c
@@ -453,7 +453,7 @@ static struct platform_driver sa1100_mtd_driver = {
         .resume         = sa1100_mtd_resume,
         .shutdown       = sa1100_mtd_shutdown,
         .driver         = {
-                .name   = "flash",
+                .name   = "sa1100-mtd",
                 .owner  = THIS_MODULE,
         },
 };
@@ -474,4 +474,4 @@ module_exit(sa1100_mtd_exit);
 MODULE_AUTHOR("Nicolas Pitre");
 MODULE_DESCRIPTION("SA1100 CFI map driver");
 MODULE_LICENSE("GPL");
-MODULE_ALIAS("platform:flash");
+MODULE_ALIAS("platform:sa1100-mtd");
diff --git a/drivers/mtd/nand/Kconfig b/drivers/mtd/nand/Kconfig
index 8b12e6e109d..2ff88791ceb 100644
--- a/drivers/mtd/nand/Kconfig
+++ b/drivers/mtd/nand/Kconfig
@@ -273,7 +273,7 @@ config MTD_NAND_CAFE
 
 config MTD_NAND_CS553X
         tristate "NAND support for CS5535/CS5536 (AMD Geode companion chip)"
-        depends on X86_32 && (X86_PC || X86_GENERICARCH)
+        depends on X86_32
         help
           The CS553x companion chips for the AMD Geode processor
           include NAND flash controllers with built-in hardware ECC
diff --git a/drivers/net/3c509.c b/drivers/net/3c509.c
index 535c234286e..8c694213035 100644
--- a/drivers/net/3c509.c
+++ b/drivers/net/3c509.c
@@ -1475,6 +1475,7 @@ el3_resume(struct device *pdev)
         spin_lock_irqsave(&lp->lock, flags);
 
         outw(PowerUp, ioaddr + EL3_CMD);
+        EL3WINDOW(0);
         el3_up(dev);
 
         if (netif_running(dev))
diff --git a/drivers/net/arm/etherh.c b/drivers/net/arm/etherh.c
index d15d8b79d8e..54b52e5b182 100644
--- a/drivers/net/arm/etherh.c
+++ b/drivers/net/arm/etherh.c
@@ -646,7 +646,7 @@ static const struct net_device_ops etherh_netdev_ops = {
         .ndo_get_stats          = ei_get_stats,
         .ndo_set_multicast_list = ei_set_multicast_list,
         .ndo_validate_addr      = eth_validate_addr,
-        .ndo_set_mac_address    = eth_set_mac_addr,
+        .ndo_set_mac_address    = eth_mac_addr,
         .ndo_change_mtu         = eth_change_mtu,
 #ifdef CONFIG_NET_POLL_CONTROLLER
         .ndo_poll_controller    = ei_poll,
diff --git a/drivers/net/cassini.c b/drivers/net/cassini.c
index 840b3d1a22f..bbbc3bb08aa 100644
--- a/drivers/net/cassini.c
+++ b/drivers/net/cassini.c
@@ -806,7 +806,7 @@ static int cas_reset_mii_phy(struct cas *cp)
 
         cas_phy_write(cp, MII_BMCR, BMCR_RESET);
         udelay(100);
-        while (limit--) {
+        while (--limit) {
                 val = cas_phy_read(cp, MII_BMCR);
                 if ((val & BMCR_RESET) == 0)
                         break;
@@ -979,7 +979,7 @@ static void cas_phy_init(struct cas *cp)
                 writel(val, cp->regs + REG_PCS_MII_CTRL);
 
                 limit = STOP_TRIES;
-                while (limit-- > 0) {
+                while (--limit > 0) {
                         udelay(10);
                         if ((readl(cp->regs + REG_PCS_MII_CTRL) &
                              PCS_MII_RESET) == 0)
diff --git a/drivers/net/cxgb3/sge.c b/drivers/net/cxgb3/sge.c
index 379a1324db4..d31791f6029 100644
--- a/drivers/net/cxgb3/sge.c
+++ b/drivers/net/cxgb3/sge.c
@@ -2276,8 +2276,7 @@ no_mem:
                 } else if ((len = ntohl(r->len_cq)) != 0) {
                         struct sge_fl *fl;
 
-                        if (eth)
-                                lro = qs->lro_enabled && is_eth_tcp(rss_hi);
+                        lro &= eth && is_eth_tcp(rss_hi);
 
                         fl = (len & F_RSPD_FLQ) ? &qs->fl[1] : &qs->fl[0];
                         if (fl->use_pages) {
diff --git a/drivers/net/e1000/e1000_main.c b/drivers/net/e1000/e1000_main.c
index 26474c92193..6bd63cc67b3 100644
--- a/drivers/net/e1000/e1000_main.c
+++ b/drivers/net/e1000/e1000_main.c
@@ -31,7 +31,7 @@
 
 char e1000_driver_name[] = "e1000";
 static char e1000_driver_string[] = "Intel(R) PRO/1000 Network Driver";
-#define DRV_VERSION "7.3.20-k3-NAPI"
+#define DRV_VERSION "7.3.21-k3-NAPI"
 const char e1000_driver_version[] = DRV_VERSION;
 static const char e1000_copyright[] = "Copyright (c) 1999-2006 Intel Corporation.";
 
@@ -940,7 +940,7 @@ static int __devinit e1000_probe(struct pci_dev *pdev,
                 err = pci_enable_device(pdev);
         } else {
                 bars = pci_select_bars(pdev, IORESOURCE_MEM);
-                err = pci_enable_device(pdev);
+                err = pci_enable_device_mem(pdev);
         }
         if (err)
                 return err;
@@ -3712,7 +3712,7 @@ static irqreturn_t e1000_intr(int irq, void *data)
         struct e1000_hw *hw = &adapter->hw;
         u32 rctl, icr = er32(ICR);
 
-        if (unlikely(!icr))
+        if (unlikely((!icr) || test_bit(__E1000_RESETTING, &adapter->flags)))
                 return IRQ_NONE;  /* Not our interrupt */
 
         /* IMS will not auto-mask if INT_ASSERTED is not set, and if it is
diff --git a/drivers/net/gianfar.c b/drivers/net/gianfar.c
index 3f7eab42aef..9b12a13a640 100644
--- a/drivers/net/gianfar.c
+++ b/drivers/net/gianfar.c
@@ -351,6 +351,9 @@ static int gfar_probe(struct of_device *ofdev,
         /* Reset MAC layer */
         gfar_write(&priv->regs->maccfg1, MACCFG1_SOFT_RESET);
 
+        /* We need to delay at least 3 TX clocks */
+        udelay(2);
+
         tempval = (MACCFG1_TX_FLOW | MACCFG1_RX_FLOW);
         gfar_write(&priv->regs->maccfg1, tempval);
 
@@ -1626,6 +1629,12 @@ static void gfar_schedule_cleanup(struct net_device *dev)
         if (netif_rx_schedule_prep(&priv->napi)) {
                 gfar_write(&priv->regs->imask, IMASK_RTX_DISABLED);
                 __netif_rx_schedule(&priv->napi);
+        } else {
+                /*
+                 * Clear IEVENT, so interrupts aren't called again
+                 * because of the packets that have already arrived.
+                 */
+                gfar_write(&priv->regs->ievent, IEVENT_RTX_MASK);
         }
 
         spin_unlock(&priv->rxlock);
diff --git a/drivers/net/gianfar.h b/drivers/net/gianfar.h
index b1a83344acc..eaa86897f5c 100644
--- a/drivers/net/gianfar.h
+++ b/drivers/net/gianfar.h
@@ -312,7 +312,7 @@ extern const char gfar_driver_version[];
 #define ATTRELI_EI(x) (x)
 
 #define BD_LFLAG(flags) ((flags) << 16)
-#define BD_LENGTH_MASK          0x00ff
+#define BD_LENGTH_MASK          0x0000ffff
 
 /* TxBD status field bits */
 #define TXBD_READY              0x8000
diff --git a/drivers/net/gianfar_mii.c b/drivers/net/gianfar_mii.c
index f3706e415b4..f49a426ad68 100644
--- a/drivers/net/gianfar_mii.c
+++ b/drivers/net/gianfar_mii.c
@@ -234,6 +234,8 @@ static int gfar_mdio_probe(struct of_device *ofdev,
         if (NULL == new_bus)
                 return -ENOMEM;
 
+        device_init_wakeup(&ofdev->dev, 1);
+
         new_bus->name = "Gianfar MII Bus",
         new_bus->read = &gfar_mdio_read,
         new_bus->write = &gfar_mdio_write,
diff --git a/drivers/net/ibm_newemac/phy.c b/drivers/net/ibm_newemac/phy.c
index c40cd8df221..ac9d964e59e 100644
--- a/drivers/net/ibm_newemac/phy.c
+++ b/drivers/net/ibm_newemac/phy.c
@@ -60,7 +60,7 @@ int emac_mii_reset_phy(struct mii_phy *phy)
 
         udelay(300);
 
-        while (limit--) {
+        while (--limit) {
                 val = phy_read(phy, MII_BMCR);
                 if (val >= 0 && (val & BMCR_RESET) == 0)
                         break;
@@ -84,7 +84,7 @@ int emac_mii_reset_gpcs(struct mii_phy *phy)
 
         udelay(300);
 
-        while (limit--) {
+        while (--limit) {
                 val = gpcs_phy_read(phy, MII_BMCR);
                 if (val >= 0 && (val & BMCR_RESET) == 0)
                         break;
diff --git a/drivers/net/igb/e1000_82575.c b/drivers/net/igb/e1000_82575.c
index f5e2e7235fc..13ca73f96ec 100644
--- a/drivers/net/igb/e1000_82575.c
+++ b/drivers/net/igb/e1000_82575.c
@@ -699,11 +699,18 @@ static s32 igb_check_for_link_82575(struct e1000_hw *hw)
 
         /* SGMII link check is done through the PCS register. */
         if ((hw->phy.media_type != e1000_media_type_copper) ||
-            (igb_sgmii_active_82575(hw)))
+            (igb_sgmii_active_82575(hw))) {
                 ret_val = igb_get_pcs_speed_and_duplex_82575(hw, &speed,
                                                              &duplex);
-        else
+                /*
+                 * Use this flag to determine if link needs to be checked or
+                 * not.  If  we have link clear the flag so that we do not
+                 * continue to check for link.
+                 */
+                hw->mac.get_link_status = !hw->mac.serdes_has_link;
+        } else {
                 ret_val = igb_check_for_copper_link(hw);
+        }
 
         return ret_val;
 }
diff --git a/drivers/net/igb/igb.h b/drivers/net/igb/igb.h
index 5a27825cc48..aebef8e48e7 100644
--- a/drivers/net/igb/igb.h
+++ b/drivers/net/igb/igb.h
@@ -300,11 +300,10 @@ struct igb_adapter {
 
 #define IGB_FLAG_HAS_MSI           (1 << 0)
 #define IGB_FLAG_MSI_ENABLE        (1 << 1)
-#define IGB_FLAG_HAS_DCA           (1 << 2)
-#define IGB_FLAG_DCA_ENABLED       (1 << 3)
-#define IGB_FLAG_IN_NETPOLL        (1 << 5)
-#define IGB_FLAG_QUAD_PORT_A       (1 << 6)
-#define IGB_FLAG_NEED_CTX_IDX      (1 << 7)
+#define IGB_FLAG_DCA_ENABLED       (1 << 2)
+#define IGB_FLAG_IN_NETPOLL        (1 << 3)
+#define IGB_FLAG_QUAD_PORT_A       (1 << 4)
+#define IGB_FLAG_NEED_CTX_IDX      (1 << 5)
 
 enum e1000_state_t {
         __IGB_TESTING,
diff --git a/drivers/net/igb/igb_main.c b/drivers/net/igb/igb_main.c
index b82b0fb2056..a50db5398fa 100644
--- a/drivers/net/igb/igb_main.c
+++ b/drivers/net/igb/igb_main.c
@@ -206,10 +206,11 @@ static int __init igb_init_module(void)
 
         global_quad_port_a = 0;
 
-        ret = pci_register_driver(&igb_driver);
 #ifdef CONFIG_IGB_DCA
         dca_register_notify(&dca_notifier);
 #endif
+
+        ret = pci_register_driver(&igb_driver);
         return ret;
 }
 
@@ -1156,11 +1157,10 @@ static int __devinit igb_probe(struct pci_dev *pdev,
 
         /* set flags */
         switch (hw->mac.type) {
-        case e1000_82576:
         case e1000_82575:
-                adapter->flags |= IGB_FLAG_HAS_DCA;
                 adapter->flags |= IGB_FLAG_NEED_CTX_IDX;
                 break;
+        case e1000_82576:
         default:
                 break;
         }
@@ -1310,8 +1310,7 @@ static int __devinit igb_probe(struct pci_dev *pdev,
                 goto err_register;
 
 #ifdef CONFIG_IGB_DCA
-        if ((adapter->flags & IGB_FLAG_HAS_DCA) &&
-            (dca_add_requester(&pdev->dev) == 0)) {
+        if (dca_add_requester(&pdev->dev) == 0) {
                 adapter->flags |= IGB_FLAG_DCA_ENABLED;
                 dev_info(&pdev->dev, "DCA enabled\n");
                 /* Always use CB2 mode, difference is masked
@@ -1835,11 +1834,11 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
         rctl |= E1000_RCTL_SECRC;
 
         /*
-         * disable store bad packets, long packet enable, and clear size bits.
+         * disable store bad packets and clear size bits.
          */
-        rctl &= ~(E1000_RCTL_SBP | E1000_RCTL_LPE | E1000_RCTL_SZ_256);
+        rctl &= ~(E1000_RCTL_SBP | E1000_RCTL_SZ_256);
 
-        if (adapter->netdev->mtu > ETH_DATA_LEN)
+        /* enable LPE when to prevent packets larger than max_frame_size */
                 rctl |= E1000_RCTL_LPE;
 
         /* Setup buffer sizes */
@@ -1865,7 +1864,7 @@ static void igb_setup_rctl(struct igb_adapter *adapter)
          */
         /* allocations using alloc_page take too long for regular MTU
          * so only enable packet split for jumbo frames */
-        if (rctl & E1000_RCTL_LPE) {
+        if (adapter->netdev->mtu > ETH_DATA_LEN) {
                 adapter->rx_ps_hdr_size = IGB_RXBUFFER_128;
                 srrctl |= adapter->rx_ps_hdr_size <<
                          E1000_SRRCTL_BSIZEHDRSIZE_SHIFT;
@@ -3473,19 +3472,16 @@ static int __igb_notify_dca(struct device *dev, void *data)
         struct e1000_hw *hw = &adapter->hw;
         unsigned long event = *(unsigned long *)data;
 
-        if (!(adapter->flags & IGB_FLAG_HAS_DCA))
-                goto out;
-
         switch (event) {
         case DCA_PROVIDER_ADD:
                 /* if already enabled, don't do it again */
                 if (adapter->flags & IGB_FLAG_DCA_ENABLED)
                         break;
-                adapter->flags |= IGB_FLAG_DCA_ENABLED;
                 /* Always use CB2 mode, difference is masked
                  * in the CB driver. */
                 wr32(E1000_DCA_CTRL, 2);
                 if (dca_add_requester(dev) == 0) {
+                        adapter->flags |= IGB_FLAG_DCA_ENABLED;
                         dev_info(&adapter->pdev->dev, "DCA enabled\n");
                         igb_setup_dca(adapter);
                         break;
@@ -3502,7 +3498,7 @@ static int __igb_notify_dca(struct device *dev, void *data)
                 }
                 break;
         }
-out:
+
         return 0;
 }
 
diff --git a/drivers/net/ne3210.c b/drivers/net/ne3210.c
index fac43fd6fc8..6a843f7350a 100644
--- a/drivers/net/ne3210.c
+++ b/drivers/net/ne3210.c
@@ -150,7 +150,8 @@ static int __init ne3210_eisa_probe (struct device *device)
                 if (phys_mem < virt_to_phys(high_memory)) {
                         printk(KERN_CRIT "ne3210.c: Card RAM overlaps with normal memory!!!\n");
                         printk(KERN_CRIT "ne3210.c: Use EISA SCU to set card memory below 1MB,\n");
-                        printk(KERN_CRIT "ne3210.c: or to an address above 0x%lx.\n", virt_to_phys(high_memory));
+                        printk(KERN_CRIT "ne3210.c: or to an address above 0x%llx.\n",
+                                (u64)virt_to_phys(high_memory));
                         printk(KERN_CRIT "ne3210.c: Driver NOT installed.\n");
                         retval = -EINVAL;
                         goto out3;
diff --git a/drivers/net/netxen/netxen_nic.h b/drivers/net/netxen/netxen_nic.h
index a75a31005fd..f4dd9acb687 100644
--- a/drivers/net/netxen/netxen_nic.h
+++ b/drivers/net/netxen/netxen_nic.h
@@ -210,7 +210,7 @@
 #define MAX_CMD_DESCRIPTORS_HOST        1024
 #define MAX_RCV_DESCRIPTORS_1G          2048
 #define MAX_RCV_DESCRIPTORS_10G         4096
-#define MAX_JUMBO_RCV_DESCRIPTORS       512
+#define MAX_JUMBO_RCV_DESCRIPTORS       1024
 #define MAX_LRO_RCV_DESCRIPTORS         8
 #define MAX_RCVSTATUS_DESCRIPTORS       MAX_RCV_DESCRIPTORS
 #define MAX_JUMBO_RCV_DESC      MAX_JUMBO_RCV_DESCRIPTORS
@@ -1203,7 +1203,7 @@ typedef struct {
 #define NETXEN_IS_MSI_FAMILY(adapter) \
         ((adapter)->flags & (NETXEN_NIC_MSI_ENABLED | NETXEN_NIC_MSIX_ENABLED))
 
-#define MSIX_ENTRIES_PER_ADAPTER        8
+#define MSIX_ENTRIES_PER_ADAPTER        1
 #define NETXEN_MSIX_TBL_SPACE           8192
 #define NETXEN_PCI_REG_MSIX_TBL         0x44
 
diff --git a/drivers/net/netxen/netxen_nic_init.c b/drivers/net/netxen/netxen_nic_init.c
index ca7c8d8050c..ffd37bea162 100644
--- a/drivers/net/netxen/netxen_nic_init.c
+++ b/drivers/net/netxen/netxen_nic_init.c
@@ -947,8 +947,10 @@ int netxen_pinit_from_rom(struct netxen_adapter *adapter, int verbose)
         }
         for (i = 0; i < n; i++) {
                 if (netxen_rom_fast_read(adapter, 8*i + 4*offset, &val) != 0 ||
-                netxen_rom_fast_read(adapter, 8*i + 4*offset + 4, &addr) != 0)
+                netxen_rom_fast_read(adapter, 8*i + 4*offset + 4, &addr) != 0) {
+                        kfree(buf);
                         return -EIO;
+                }
 
                 buf[i].addr = addr;
                 buf[i].data = val;
diff --git a/drivers/net/netxen/netxen_nic_main.c b/drivers/net/netxen/netxen_nic_main.c
index 645d384fe87..3b17a793614 100644
--- a/drivers/net/netxen/netxen_nic_main.c
+++ b/drivers/net/netxen/netxen_nic_main.c
@@ -76,6 +76,7 @@ static void netxen_nic_poll_controller(struct net_device *netdev);
 #endif
 static irqreturn_t netxen_intr(int irq, void *data);
 static irqreturn_t netxen_msi_intr(int irq, void *data);
+static irqreturn_t netxen_msix_intr(int irq, void *data);
 
 /*  PCI Device ID Table  */
 #define ENTRY(device) \
@@ -1084,7 +1085,9 @@ static int netxen_nic_open(struct net_device *netdev)
                         for (ring = 0; ring < adapter->max_rds_rings; ring++)
                                 netxen_post_rx_buffers(adapter, ctx, ring);
                 }
-                if (NETXEN_IS_MSI_FAMILY(adapter))
+                if (adapter->flags & NETXEN_NIC_MSIX_ENABLED)
+                        handler = netxen_msix_intr;
+                else if (adapter->flags & NETXEN_NIC_MSI_ENABLED)
                         handler = netxen_msi_intr;
                 else {
                         flags |= IRQF_SHARED;
@@ -1612,6 +1615,14 @@ static irqreturn_t netxen_msi_intr(int irq, void *data)
         return IRQ_HANDLED;
 }
 
+static irqreturn_t netxen_msix_intr(int irq, void *data)
+{
+        struct netxen_adapter *adapter = data;
+
+        napi_schedule(&adapter->napi);
+        return IRQ_HANDLED;
+}
+
 static int netxen_nic_poll(struct napi_struct *napi, int budget)
 {
         struct netxen_adapter *adapter = container_of(napi, struct netxen_adapter, napi);
diff --git a/drivers/net/pcmcia/pcnet_cs.c b/drivers/net/pcmcia/pcnet_cs.c
index c38ed777f0a..a6999403f37 100644
--- a/drivers/net/pcmcia/pcnet_cs.c
+++ b/drivers/net/pcmcia/pcnet_cs.c
@@ -586,7 +586,7 @@ static int pcnet_config(struct pcmcia_device *link)
     }
 
     if ((link->conf.ConfigBase == 0x03c0)
-        && (link->manf_id == 0x149) && (link->card_id = 0xc1ab)) {
+        && (link->manf_id == 0x149) && (link->card_id == 0xc1ab)) {
         printk(KERN_INFO "pcnet_cs: this is an AX88190 card!\n");
         printk(KERN_INFO "pcnet_cs: use axnet_cs instead.\n");
         goto failed;
diff --git a/drivers/net/ps3_gelic_wireless.c b/drivers/net/ps3_gelic_wireless.c
index ec231424668..335da4831ab 100644
--- a/drivers/net/ps3_gelic_wireless.c
+++ b/drivers/net/ps3_gelic_wireless.c
@@ -2168,7 +2168,7 @@ static void gelic_wl_connected_event(struct gelic_wl_info *wl,
                 complete(&wl->assoc_done);
                 netif_carrier_on(port_to_netdev(wl_port(wl)));
         } else
-                pr_debug("%s: event %#lx under wpa\n",
+                pr_debug("%s: event %#llx under wpa\n",
                                  __func__, event);
 }
 
diff --git a/drivers/net/qlge/qlge.h b/drivers/net/qlge/qlge.h
index c1dadadfab1..e6fdce9206c 100644
--- a/drivers/net/qlge/qlge.h
+++ b/drivers/net/qlge/qlge.h
@@ -787,12 +787,12 @@ struct mbox_params {
 
 struct flash_params {
         u8 dev_id_str[4];
-        u16 size;
-        u16 csum;
-        u16 ver;
-        u16 sub_dev_id;
+        __le16 size;
+        __le16 csum;
+        __le16 ver;
+        __le16 sub_dev_id;
         u8 mac_addr[6];
-        u16 res;
+        __le16 res;
 };
 
 
diff --git a/drivers/net/qlge/qlge_main.c b/drivers/net/qlge/qlge_main.c
index 45421c8b601..3d1d7b6e55a 100644
--- a/drivers/net/qlge/qlge_main.c
+++ b/drivers/net/qlge/qlge_main.c
@@ -641,7 +641,7 @@ static void ql_enable_all_completion_interrupts(struct ql_adapter *qdev)
 
 }
 
-static int ql_read_flash_word(struct ql_adapter *qdev, int offset, u32 *data)
+static int ql_read_flash_word(struct ql_adapter *qdev, int offset, __le32 *data)
 {
         int status = 0;
         /* wait for reg to come ready */
@@ -656,8 +656,11 @@ static int ql_read_flash_word(struct ql_adapter *qdev, int offset, u32 *data)
                         FLASH_ADDR, FLASH_ADDR_RDY, FLASH_ADDR_ERR);
         if (status)
                 goto exit;
-        /* get the data */
-        *data = ql_read32(qdev, FLASH_DATA);
+         /* This data is stored on flash as an array of
+         * __le32.  Since ql_read32() returns cpu endian
+         * we need to swap it back.
+         */
+        *data = cpu_to_le32(ql_read32(qdev, FLASH_DATA));
 exit:
         return status;
 }
@@ -666,13 +669,20 @@ static int ql_get_flash_params(struct ql_adapter *qdev)
 {
         int i;
         int status;
-        u32 *p = (u32 *)&qdev->flash;
+        __le32 *p = (__le32 *)&qdev->flash;
+        u32 offset = 0;
+
+        /* Second function's parameters follow the first
+         * function's.
+         */
+        if (qdev->func)
+                offset = sizeof(qdev->flash) / sizeof(u32);
 
         if (ql_sem_spinlock(qdev, SEM_FLASH_MASK))
                 return -ETIMEDOUT;
 
         for (i = 0; i < sizeof(qdev->flash) / sizeof(u32); i++, p++) {
-                status = ql_read_flash_word(qdev, i, p);
+                status = ql_read_flash_word(qdev, i+offset, p);
                 if (status) {
                         QPRINTK(qdev, IFUP, ERR, "Error reading flash.\n");
                         goto exit;
@@ -3826,7 +3836,7 @@ static int qlge_suspend(struct pci_dev *pdev, pm_message_t state)
 {
         struct net_device *ndev = pci_get_drvdata(pdev);
         struct ql_adapter *qdev = netdev_priv(ndev);
-        int err;
+        int err, i;
 
         netif_device_detach(ndev);
 
@@ -3836,6 +3846,9 @@ static int qlge_suspend(struct pci_dev *pdev, pm_message_t state)
                         return err;
         }
 
+        for (i = qdev->rss_ring_first_cq_id; i < qdev->rx_ring_count; i++)
+                netif_napi_del(&qdev->rx_ring[i].napi);
+
         err = pci_save_state(pdev);
         if (err)
                 return err;
diff --git a/drivers/net/r6040.c b/drivers/net/r6040.c
index 72fd9e97c19..b2dcdb5ed8b 100644
--- a/drivers/net/r6040.c
+++ b/drivers/net/r6040.c
@@ -438,7 +438,6 @@ static void r6040_down(struct net_device *dev)
 {
         struct r6040_private *lp = netdev_priv(dev);
         void __iomem *ioaddr = lp->base;
-        struct pci_dev *pdev = lp->pdev;
         int limit = 2048;
         u16 *adrp;
         u16 cmd;
diff --git a/drivers/net/r8169.c b/drivers/net/r8169.c
index 2c73ca606b3..0771eb6fc6e 100644
--- a/drivers/net/r8169.c
+++ b/drivers/net/r8169.c
@@ -437,6 +437,22 @@ enum features {
         RTL_FEATURE_GMII        = (1 << 2),
 };
 
+struct rtl8169_counters {
+        __le64  tx_packets;
+        __le64  rx_packets;
+        __le64  tx_errors;
+        __le32  rx_errors;
+        __le16  rx_missed;
+        __le16  align_errors;
+        __le32  tx_one_collision;
+        __le32  tx_multi_collision;
+        __le64  rx_unicast;
+        __le64  rx_broadcast;
+        __le32  rx_multicast;
+        __le16  tx_aborted;
+        __le16  tx_underun;
+};
+
 struct rtl8169_private {
         void __iomem *mmio_addr;        /* memory map physical address */
         struct pci_dev *pci_dev;        /* Index of PCI device */
@@ -480,6 +496,7 @@ struct rtl8169_private {
         unsigned features;
 
         struct mii_if_info mii;
+        struct rtl8169_counters counters;
 };
 
 MODULE_AUTHOR("Realtek and the Linux r8169 crew <netdev@vger.kernel.org>");
@@ -1100,22 +1117,6 @@ static const char rtl8169_gstrings[][ETH_GSTRING_LEN] = {
         "tx_underrun",
 };
 
-struct rtl8169_counters {
-        __le64  tx_packets;
-        __le64  rx_packets;
-        __le64  tx_errors;
-        __le32  rx_errors;
-        __le16  rx_missed;
-        __le16  align_errors;
-        __le32  tx_one_collision;
-        __le32  tx_multi_collision;
-        __le64  rx_unicast;
-        __le64  rx_broadcast;
-        __le32  rx_multicast;
-        __le16  tx_aborted;
-        __le16  tx_underun;
-};
-
 static int rtl8169_get_sset_count(struct net_device *dev, int sset)
 {
         switch (sset) {
@@ -1126,16 +1127,21 @@ static int rtl8169_get_sset_count(struct net_device *dev, int sset)
         }
 }
 
-static void rtl8169_get_ethtool_stats(struct net_device *dev,
-                                      struct ethtool_stats *stats, u64 *data)
+static void rtl8169_update_counters(struct net_device *dev)
 {
         struct rtl8169_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->mmio_addr;
         struct rtl8169_counters *counters;
         dma_addr_t paddr;
         u32 cmd;
+        int wait = 1000;
 
-        ASSERT_RTNL();
+        /*
+         * Some chips are unable to dump tally counters when the receiver
+         * is disabled.
+         */
+        if ((RTL_R8(ChipCmd) & CmdRxEnb) == 0)
+                return;
 
         counters = pci_alloc_consistent(tp->pci_dev, sizeof(*counters), &paddr);
         if (!counters)
@@ -1146,31 +1152,45 @@ static void rtl8169_get_ethtool_stats(struct net_device *dev,
         RTL_W32(CounterAddrLow, cmd);
         RTL_W32(CounterAddrLow, cmd | CounterDump);
 
-        while (RTL_R32(CounterAddrLow) & CounterDump) {
-                if (msleep_interruptible(1))
+        while (wait--) {
+                if ((RTL_R32(CounterAddrLow) & CounterDump) == 0) {
+                        /* copy updated counters */
+                        memcpy(&tp->counters, counters, sizeof(*counters));
                         break;
+                }
+                udelay(10);
         }
 
         RTL_W32(CounterAddrLow, 0);
         RTL_W32(CounterAddrHigh, 0);
 
-        data[0] = le64_to_cpu(counters->tx_packets);
-        data[1] = le64_to_cpu(counters->rx_packets);
-        data[2] = le64_to_cpu(counters->tx_errors);
-        data[3] = le32_to_cpu(counters->rx_errors);
-        data[4] = le16_to_cpu(counters->rx_missed);
-        data[5] = le16_to_cpu(counters->align_errors);
-        data[6] = le32_to_cpu(counters->tx_one_collision);
-        data[7] = le32_to_cpu(counters->tx_multi_collision);
-        data[8] = le64_to_cpu(counters->rx_unicast);
-        data[9] = le64_to_cpu(counters->rx_broadcast);
-        data[10] = le32_to_cpu(counters->rx_multicast);
-        data[11] = le16_to_cpu(counters->tx_aborted);
-        data[12] = le16_to_cpu(counters->tx_underun);
-
         pci_free_consistent(tp->pci_dev, sizeof(*counters), counters, paddr);
 }
 
+static void rtl8169_get_ethtool_stats(struct net_device *dev,
+                                      struct ethtool_stats *stats, u64 *data)
+{
+        struct rtl8169_private *tp = netdev_priv(dev);
+
+        ASSERT_RTNL();
+
+        rtl8169_update_counters(dev);
+
+        data[0] = le64_to_cpu(tp->counters.tx_packets);
+        data[1] = le64_to_cpu(tp->counters.rx_packets);
+        data[2] = le64_to_cpu(tp->counters.tx_errors);
+        data[3] = le32_to_cpu(tp->counters.rx_errors);
+        data[4] = le16_to_cpu(tp->counters.rx_missed);
+        data[5] = le16_to_cpu(tp->counters.align_errors);
+        data[6] = le32_to_cpu(tp->counters.tx_one_collision);
+        data[7] = le32_to_cpu(tp->counters.tx_multi_collision);
+        data[8] = le64_to_cpu(tp->counters.rx_unicast);
+        data[9] = le64_to_cpu(tp->counters.rx_broadcast);
+        data[10] = le32_to_cpu(tp->counters.rx_multicast);
+        data[11] = le16_to_cpu(tp->counters.tx_aborted);
+        data[12] = le16_to_cpu(tp->counters.tx_underun);
+}
+
 static void rtl8169_get_strings(struct net_device *dev, u32 stringset, u8 *data)
 {
         switch(stringset) {
@@ -3682,6 +3702,9 @@ static int rtl8169_close(struct net_device *dev)
         struct rtl8169_private *tp = netdev_priv(dev);
         struct pci_dev *pdev = tp->pci_dev;
 
+        /* update counters before going down */
+        rtl8169_update_counters(dev);
+
         rtl8169_down(dev);
 
         free_irq(dev->irq, dev);
diff --git a/drivers/net/sfc/efx.c b/drivers/net/sfc/efx.c
index 7673fd92eaf..847e9bb0098 100644
--- a/drivers/net/sfc/efx.c
+++ b/drivers/net/sfc/efx.c
@@ -676,9 +676,8 @@ static int efx_init_port(struct efx_nic *efx)
         rc = efx->phy_op->init(efx);
         if (rc)
                 return rc;
-        efx->phy_op->reconfigure(efx);
-
         mutex_lock(&efx->mac_lock);
+        efx->phy_op->reconfigure(efx);
         rc = falcon_switch_mac(efx);
         mutex_unlock(&efx->mac_lock);
         if (rc)
@@ -686,7 +685,7 @@ static int efx_init_port(struct efx_nic *efx)
         efx->mac_op->reconfigure(efx);
 
         efx->port_initialized = true;
-        efx->stats_enabled = true;
+        efx_stats_enable(efx);
         return 0;
 
 fail:
@@ -735,6 +734,7 @@ static void efx_fini_port(struct efx_nic *efx)
         if (!efx->port_initialized)
                 return;
 
+        efx_stats_disable(efx);
         efx->phy_op->fini(efx);
         efx->port_initialized = false;
 
@@ -854,20 +854,27 @@ static void efx_fini_io(struct efx_nic *efx)
  * interrupts across them. */
 static int efx_wanted_rx_queues(void)
 {
-        cpumask_t core_mask;
+        cpumask_var_t core_mask;
         int count;
         int cpu;
 
-        cpus_clear(core_mask);
+        if (!alloc_cpumask_var(&core_mask, GFP_KERNEL)) {
+                printk(KERN_WARNING
+                       "efx.c: allocation failure, irq balancing hobbled\n");
+                return 1;
+        }
+
+        cpumask_clear(core_mask);
         count = 0;
         for_each_online_cpu(cpu) {
-                if (!cpu_isset(cpu, core_mask)) {
+                if (!cpumask_test_cpu(cpu, core_mask)) {
                         ++count;
-                        cpus_or(core_mask, core_mask,
-                                topology_core_siblings(cpu));
+                        cpumask_or(core_mask, core_mask,
+                                   topology_core_cpumask(cpu));
                 }
         }
 
+        free_cpumask_var(core_mask);
         return count;
 }
 
@@ -1361,6 +1368,20 @@ static int efx_net_stop(struct net_device *net_dev)
         return 0;
 }
 
+void efx_stats_disable(struct efx_nic *efx)
+{
+        spin_lock(&efx->stats_lock);
+        ++efx->stats_disable_count;
+        spin_unlock(&efx->stats_lock);
+}
+
+void efx_stats_enable(struct efx_nic *efx)
+{
+        spin_lock(&efx->stats_lock);
+        --efx->stats_disable_count;
+        spin_unlock(&efx->stats_lock);
+}
+
 /* Context: process, dev_base_lock or RTNL held, non-blocking. */
 static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
 {
@@ -1369,12 +1390,12 @@ static struct net_device_stats *efx_net_stats(struct net_device *net_dev)
         struct net_device_stats *stats = &net_dev->stats;
 
         /* Update stats if possible, but do not wait if another thread
-         * is updating them (or resetting the NIC); slightly stale
-         * stats are acceptable.
+         * is updating them or if MAC stats fetches are temporarily
+         * disabled; slightly stale stats are acceptable.
          */
         if (!spin_trylock(&efx->stats_lock))
                 return stats;
-        if (efx->stats_enabled) {
+        if (!efx->stats_disable_count) {
                 efx->mac_op->update_stats(efx);
                 falcon_update_nic_stats(efx);
         }
@@ -1622,16 +1643,12 @@ static void efx_unregister_netdev(struct efx_nic *efx)
 
 /* Tears down the entire software state and most of the hardware state
  * before reset.  */
-void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+void efx_reset_down(struct efx_nic *efx, enum reset_type method,
+                    struct ethtool_cmd *ecmd)
 {
         EFX_ASSERT_RESET_SERIALISED(efx);
 
-        /* The net_dev->get_stats handler is quite slow, and will fail
-         * if a fetch is pending over reset. Serialise against it. */
-        spin_lock(&efx->stats_lock);
-        efx->stats_enabled = false;
-        spin_unlock(&efx->stats_lock);
-
+        efx_stats_disable(efx);
         efx_stop_all(efx);
         mutex_lock(&efx->mac_lock);
         mutex_lock(&efx->spi_lock);
@@ -1639,6 +1656,8 @@ void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
         efx->phy_op->get_settings(efx, ecmd);
 
         efx_fini_channels(efx);
+        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE)
+                efx->phy_op->fini(efx);
 }
 
 /* This function will always ensure that the locks acquired in
@@ -1646,7 +1665,8 @@ void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd)
  * that we were unable to reinitialise the hardware, and the
  * driver should be disabled. If ok is false, then the rx and tx
  * engines are not restarted, pending a RESET_DISABLE. */
-int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
+int efx_reset_up(struct efx_nic *efx, enum reset_type method,
+                 struct ethtool_cmd *ecmd, bool ok)
 {
         int rc;
 
@@ -1658,6 +1678,15 @@ int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
                 ok = false;
         }
 
+        if (efx->port_initialized && method != RESET_TYPE_INVISIBLE) {
+                if (ok) {
+                        rc = efx->phy_op->init(efx);
+                        if (rc)
+                                ok = false;
+                } else
+                        efx->port_initialized = false;
+        }
+
         if (ok) {
                 efx_init_channels(efx);
 
@@ -1670,7 +1699,7 @@ int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd, bool ok)
 
         if (ok) {
                 efx_start_all(efx);
-                efx->stats_enabled = true;
+                efx_stats_enable(efx);
         }
         return rc;
 }
@@ -1702,7 +1731,7 @@ static int efx_reset(struct efx_nic *efx)
 
         EFX_INFO(efx, "resetting (%d)\n", method);
 
-        efx_reset_down(efx, &ecmd);
+        efx_reset_down(efx, method, &ecmd);
 
         rc = falcon_reset_hw(efx, method);
         if (rc) {
@@ -1721,10 +1750,10 @@ static int efx_reset(struct efx_nic *efx)
 
         /* Leave device stopped if necessary */
         if (method == RESET_TYPE_DISABLE) {
-                efx_reset_up(efx, &ecmd, false);
+                efx_reset_up(efx, method, &ecmd, false);
                 rc = -EIO;
         } else {
-                rc = efx_reset_up(efx, &ecmd, true);
+                rc = efx_reset_up(efx, method, &ecmd, true);
         }
 
 out_disable:
@@ -1876,6 +1905,7 @@ static int efx_init_struct(struct efx_nic *efx, struct efx_nic_type *type,
         efx->rx_checksum_enabled = true;
         spin_lock_init(&efx->netif_stop_lock);
         spin_lock_init(&efx->stats_lock);
+        efx->stats_disable_count = 1;
         mutex_init(&efx->mac_lock);
         efx->mac_op = &efx_dummy_mac_operations;
         efx->phy_op = &efx_dummy_phy_operations;
diff --git a/drivers/net/sfc/efx.h b/drivers/net/sfc/efx.h
index 0dd7a532c78..55d0f131b0e 100644
--- a/drivers/net/sfc/efx.h
+++ b/drivers/net/sfc/efx.h
@@ -36,13 +36,16 @@ extern void efx_process_channel_now(struct efx_channel *channel);
 extern void efx_flush_queues(struct efx_nic *efx);
 
 /* Ports */
+extern void efx_stats_disable(struct efx_nic *efx);
+extern void efx_stats_enable(struct efx_nic *efx);
 extern void efx_reconfigure_port(struct efx_nic *efx);
 extern void __efx_reconfigure_port(struct efx_nic *efx);
 
 /* Reset handling */
-extern void efx_reset_down(struct efx_nic *efx, struct ethtool_cmd *ecmd);
-extern int efx_reset_up(struct efx_nic *efx, struct ethtool_cmd *ecmd,
-                        bool ok);
+extern void efx_reset_down(struct efx_nic *efx, enum reset_type method,
+                           struct ethtool_cmd *ecmd);
+extern int efx_reset_up(struct efx_nic *efx, enum reset_type method,
+                        struct ethtool_cmd *ecmd, bool ok);
 
 /* Global */
 extern void efx_schedule_reset(struct efx_nic *efx, enum reset_type type);
diff --git a/drivers/net/sfc/ethtool.c b/drivers/net/sfc/ethtool.c
index 53d259e9018..7b5924c039b 100644
--- a/drivers/net/sfc/ethtool.c
+++ b/drivers/net/sfc/ethtool.c
@@ -219,9 +219,6 @@ int efx_ethtool_set_settings(struct net_device *net_dev,
         struct efx_nic *efx = netdev_priv(net_dev);
         int rc;
 
-        if (EFX_WORKAROUND_13963(efx) && !ecmd->autoneg)
-                return -EINVAL;
-
         /* Falcon GMAC does not support 1000Mbps HD */
         if (ecmd->speed == SPEED_1000 && ecmd->duplex != DUPLEX_FULL) {
                 EFX_LOG(efx, "rejecting unsupported 1000Mbps HD"
diff --git a/drivers/net/sfc/falcon.c b/drivers/net/sfc/falcon.c
index 5b9f2d9cc4e..064307c2277 100644
--- a/drivers/net/sfc/falcon.c
+++ b/drivers/net/sfc/falcon.c
@@ -338,10 +338,10 @@ static int falcon_alloc_special_buffer(struct efx_nic *efx,
         nic_data->next_buffer_table += buffer->entries;
 
         EFX_LOG(efx, "allocating special buffers %d-%d at %llx+%x "
-                "(virt %p phys %lx)\n", buffer->index,
+                "(virt %p phys %llx)\n", buffer->index,
                 buffer->index + buffer->entries - 1,
-                (unsigned long long)buffer->dma_addr, len,
-                buffer->addr, virt_to_phys(buffer->addr));
+                (u64)buffer->dma_addr, len,
+                buffer->addr, (u64)virt_to_phys(buffer->addr));
 
         return 0;
 }
@@ -353,10 +353,10 @@ static void falcon_free_special_buffer(struct efx_nic *efx,
                 return;
 
         EFX_LOG(efx, "deallocating special buffers %d-%d at %llx+%x "
-                "(virt %p phys %lx)\n", buffer->index,
+                "(virt %p phys %llx)\n", buffer->index,
                 buffer->index + buffer->entries - 1,
-                (unsigned long long)buffer->dma_addr, buffer->len,
-                buffer->addr, virt_to_phys(buffer->addr));
+                (u64)buffer->dma_addr, buffer->len,
+                buffer->addr, (u64)virt_to_phys(buffer->addr));
 
         pci_free_consistent(efx->pci_dev, buffer->len, buffer->addr,
                             buffer->dma_addr);
@@ -824,10 +824,6 @@ static void falcon_handle_rx_not_ok(struct efx_rx_queue *rx_queue,
                             rx_ev_pause_frm ? " [PAUSE]" : "");
         }
 #endif
-
-        if (unlikely(rx_ev_eth_crc_err && EFX_WORKAROUND_10750(efx) &&
-                     efx->phy_type == PHY_TYPE_SFX7101))
-                tenxpress_crc_err(efx);
 }
 
 /* Handle receive events that are not in-order. */
@@ -1887,7 +1883,7 @@ static int falcon_reset_macs(struct efx_nic *efx)
 
         /* MAC stats will fail whilst the TX fifo is draining. Serialise
          * the drain sequence with the statistics fetch */
-        spin_lock(&efx->stats_lock);
+        efx_stats_disable(efx);
 
         falcon_read(efx, &reg, MAC0_CTRL_REG_KER);
         EFX_SET_OWORD_FIELD(reg, TXFIFO_DRAIN_EN_B0, 1);
@@ -1917,7 +1913,7 @@ static int falcon_reset_macs(struct efx_nic *efx)
                 udelay(10);
         }
 
-        spin_unlock(&efx->stats_lock);
+        efx_stats_enable(efx);
 
         /* If we've reset the EM block and the link is up, then
          * we'll have to kick the XAUI link so the PHY can recover */
@@ -2277,6 +2273,10 @@ int falcon_switch_mac(struct efx_nic *efx)
         struct efx_mac_operations *old_mac_op = efx->mac_op;
         efx_oword_t nic_stat;
         unsigned strap_val;
+        int rc = 0;
+
+        /* Don't try to fetch MAC stats while we're switching MACs */
+        efx_stats_disable(efx);
 
         /* Internal loopbacks override the phy speed setting */
         if (efx->loopback_mode == LOOPBACK_GMAC) {
@@ -2287,16 +2287,12 @@ int falcon_switch_mac(struct efx_nic *efx)
                 efx->link_fd = true;
         }
 
+        WARN_ON(!mutex_is_locked(&efx->mac_lock));
         efx->mac_op = (EFX_IS10G(efx) ?
                        &falcon_xmac_operations : &falcon_gmac_operations);
-        if (old_mac_op == efx->mac_op)
-                return 0;
-
-        WARN_ON(!mutex_is_locked(&efx->mac_lock));
-
-        /* Not all macs support a mac-level link state */
-        efx->mac_up = true;
 
+        /* Always push the NIC_STAT_REG setting even if the mac hasn't
+         * changed, because this function is run post online reset */
         falcon_read(efx, &nic_stat, NIC_STAT_REG);
         strap_val = EFX_IS10G(efx) ? 5 : 3;
         if (falcon_rev(efx) >= FALCON_REV_B0) {
@@ -2309,9 +2305,17 @@ int falcon_switch_mac(struct efx_nic *efx)
                 BUG_ON(EFX_OWORD_FIELD(nic_stat, STRAP_PINS) != strap_val);
         }
 
+        if (old_mac_op == efx->mac_op)
+                goto out;
 
         EFX_LOG(efx, "selected %cMAC\n", EFX_IS10G(efx) ? 'X' : 'G');
-        return falcon_reset_macs(efx);
+        /* Not all macs support a mac-level link state */
+        efx->mac_up = true;
+
+        rc = falcon_reset_macs(efx);
+out:
+        efx_stats_enable(efx);
+        return rc;
 }
 
 /* This call is responsible for hooking in the MAC and PHY operations */
@@ -2339,10 +2343,10 @@ int falcon_probe_port(struct efx_nic *efx)
                                  FALCON_MAC_STATS_SIZE);
         if (rc)
                 return rc;
-        EFX_LOG(efx, "stats buffer at %llx (virt %p phys %lx)\n",
-                (unsigned long long)efx->stats_buffer.dma_addr,
+        EFX_LOG(efx, "stats buffer at %llx (virt %p phys %llx)\n",
+                (u64)efx->stats_buffer.dma_addr,
                 efx->stats_buffer.addr,
-                virt_to_phys(efx->stats_buffer.addr));
+                (u64)virt_to_phys(efx->stats_buffer.addr));
 
         return 0;
 }
@@ -2917,9 +2921,9 @@ int falcon_probe_nic(struct efx_nic *efx)
                 goto fail4;
         BUG_ON(efx->irq_status.dma_addr & 0x0f);
 
-        EFX_LOG(efx, "INT_KER at %llx (virt %p phys %lx)\n",
-                (unsigned long long)efx->irq_status.dma_addr,
-                efx->irq_status.addr, virt_to_phys(efx->irq_status.addr));
+        EFX_LOG(efx, "INT_KER at %llx (virt %p phys %llx)\n",
+                (u64)efx->irq_status.dma_addr,
+                efx->irq_status.addr, (u64)virt_to_phys(efx->irq_status.addr));
 
         falcon_probe_spi_devices(efx);
 
diff --git a/drivers/net/sfc/mdio_10g.c b/drivers/net/sfc/mdio_10g.c
index f6a16428113..f9e2f95c3b4 100644
--- a/drivers/net/sfc/mdio_10g.c
+++ b/drivers/net/sfc/mdio_10g.c
@@ -15,6 +15,7 @@
 #include "net_driver.h"
 #include "mdio_10g.h"
 #include "boards.h"
+#include "workarounds.h"
 
 int mdio_clause45_reset_mmd(struct efx_nic *port, int mmd,
                             int spins, int spintime)
@@ -179,17 +180,12 @@ bool mdio_clause45_links_ok(struct efx_nic *efx, unsigned int mmd_mask)
                 return false;
         else if (efx_phy_mode_disabled(efx->phy_mode))
                 return false;
-        else if (efx->loopback_mode == LOOPBACK_PHYXS) {
+        else if (efx->loopback_mode == LOOPBACK_PHYXS)
                 mmd_mask &= ~(MDIO_MMDREG_DEVS_PHYXS |
                               MDIO_MMDREG_DEVS_PCS |
                               MDIO_MMDREG_DEVS_PMAPMD |
                               MDIO_MMDREG_DEVS_AN);
-                if (!mmd_mask) {
-                        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PHYXS,
-                                                 MDIO_PHYXS_STATUS2);
-                        return !(reg & (1 << MDIO_PHYXS_STATUS2_RX_FAULT_LBN));
-                }
-        } else if (efx->loopback_mode == LOOPBACK_PCS)
+        else if (efx->loopback_mode == LOOPBACK_PCS)
                 mmd_mask &= ~(MDIO_MMDREG_DEVS_PCS |
                               MDIO_MMDREG_DEVS_PMAPMD |
                               MDIO_MMDREG_DEVS_AN);
@@ -197,6 +193,13 @@ bool mdio_clause45_links_ok(struct efx_nic *efx, unsigned int mmd_mask)
                 mmd_mask &= ~(MDIO_MMDREG_DEVS_PMAPMD |
                               MDIO_MMDREG_DEVS_AN);
 
+        if (!mmd_mask) {
+                /* Use presence of XGMII faults in leui of link state */
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PHYXS,
+                                         MDIO_PHYXS_STATUS2);
+                return !(reg & (1 << MDIO_PHYXS_STATUS2_RX_FAULT_LBN));
+        }
+
         while (mmd_mask) {
                 if (mmd_mask & 1) {
                         /* Double reads because link state is latched, and a
@@ -263,7 +266,7 @@ void mdio_clause45_set_mmds_lpower(struct efx_nic *efx,
         }
 }
 
-static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr, u32 xnp)
+static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr)
 {
         int phy_id = efx->mii.phy_id;
         u32 result = 0;
@@ -278,9 +281,6 @@ static u32 mdio_clause45_get_an(struct efx_nic *efx, u16 addr, u32 xnp)
                 result |= ADVERTISED_100baseT_Half;
         if (reg & ADVERTISE_100FULL)
                 result |= ADVERTISED_100baseT_Full;
-        if (reg & LPA_RESV)
-                result |= xnp;
-
         return result;
 }
 
@@ -310,7 +310,7 @@ void mdio_clause45_get_settings(struct efx_nic *efx,
  */
 void mdio_clause45_get_settings_ext(struct efx_nic *efx,
                                     struct ethtool_cmd *ecmd,
-                                    u32 xnp, u32 xnp_lpa)
+                                    u32 npage_adv, u32 npage_lpa)
 {
         int phy_id = efx->mii.phy_id;
         int reg;
@@ -361,8 +361,8 @@ void mdio_clause45_get_settings_ext(struct efx_nic *efx,
                         ecmd->autoneg = AUTONEG_ENABLE;
                         ecmd->advertising |=
                                 ADVERTISED_Autoneg |
-                                mdio_clause45_get_an(efx,
-                                                     MDIO_AN_ADVERTISE, xnp);
+                                mdio_clause45_get_an(efx, MDIO_AN_ADVERTISE) |
+                                npage_adv;
                 } else
                         ecmd->autoneg = AUTONEG_DISABLE;
         } else
@@ -371,27 +371,30 @@ void mdio_clause45_get_settings_ext(struct efx_nic *efx,
         if (ecmd->autoneg) {
                 /* If AN is complete, report best common mode,
                  * otherwise report best advertised mode. */
-                u32 common = ecmd->advertising;
+                u32 modes = 0;
                 if (mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
                                        MDIO_MMDREG_STAT1) &
-                    (1 << MDIO_AN_STATUS_AN_DONE_LBN)) {
-                        common &= mdio_clause45_get_an(efx, MDIO_AN_LPA,
-                                                       xnp_lpa);
-                }
-                if (common & ADVERTISED_10000baseT_Full) {
+                    (1 << MDIO_AN_STATUS_AN_DONE_LBN))
+                        modes = (ecmd->advertising &
+                                 (mdio_clause45_get_an(efx, MDIO_AN_LPA) |
+                                  npage_lpa));
+                if (modes == 0)
+                        modes = ecmd->advertising;
+
+                if (modes & ADVERTISED_10000baseT_Full) {
                         ecmd->speed = SPEED_10000;
                         ecmd->duplex = DUPLEX_FULL;
-                } else if (common & (ADVERTISED_1000baseT_Full |
-                                     ADVERTISED_1000baseT_Half)) {
+                } else if (modes & (ADVERTISED_1000baseT_Full |
+                                    ADVERTISED_1000baseT_Half)) {
                         ecmd->speed = SPEED_1000;
-                        ecmd->duplex = !!(common & ADVERTISED_1000baseT_Full);
-                } else if (common & (ADVERTISED_100baseT_Full |
-                                     ADVERTISED_100baseT_Half)) {
+                        ecmd->duplex = !!(modes & ADVERTISED_1000baseT_Full);
+                } else if (modes & (ADVERTISED_100baseT_Full |
+                                    ADVERTISED_100baseT_Half)) {
                         ecmd->speed = SPEED_100;
-                        ecmd->duplex = !!(common & ADVERTISED_100baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_100baseT_Full);
                 } else {
                         ecmd->speed = SPEED_10;
-                        ecmd->duplex = !!(common & ADVERTISED_10baseT_Full);
+                        ecmd->duplex = !!(modes & ADVERTISED_10baseT_Full);
                 }
         } else {
                 /* Report forced settings */
@@ -415,7 +418,7 @@ int mdio_clause45_set_settings(struct efx_nic *efx,
         int phy_id = efx->mii.phy_id;
         struct ethtool_cmd prev;
         u32 required;
-        int ctrl1_bits, reg;
+        int reg;
 
         efx->phy_op->get_settings(efx, &prev);
 
@@ -430,99 +433,83 @@ int mdio_clause45_set_settings(struct efx_nic *efx,
         if (prev.port != PORT_TP || ecmd->port != PORT_TP)
                 return -EINVAL;
 
-        /* Check that PHY supports these settings and work out the
-         * basic control bits */
-        if (ecmd->duplex) {
+        /* Check that PHY supports these settings */
+        if (ecmd->autoneg) {
+                required = SUPPORTED_Autoneg;
+        } else if (ecmd->duplex) {
                 switch (ecmd->speed) {
-                case SPEED_10:
-                        ctrl1_bits = BMCR_FULLDPLX;
-                        required = SUPPORTED_10baseT_Full;
-                        break;
-                case SPEED_100:
-                        ctrl1_bits = BMCR_SPEED100 | BMCR_FULLDPLX;
-                        required = SUPPORTED_100baseT_Full;
-                        break;
-                case SPEED_1000:
-                        ctrl1_bits = BMCR_SPEED1000 | BMCR_FULLDPLX;
-                        required = SUPPORTED_1000baseT_Full;
-                        break;
-                case SPEED_10000:
-                        ctrl1_bits = (BMCR_SPEED1000 | BMCR_SPEED100 |
-                                      BMCR_FULLDPLX);
-                        required = SUPPORTED_10000baseT_Full;
-                        break;
-                default:
-                        return -EINVAL;
+                case SPEED_10:  required = SUPPORTED_10baseT_Full;  break;
+                case SPEED_100: required = SUPPORTED_100baseT_Full; break;
+                default:        return -EINVAL;
                 }
         } else {
                 switch (ecmd->speed) {
-                case SPEED_10:
-                        ctrl1_bits = 0;
-                        required = SUPPORTED_10baseT_Half;
-                        break;
-                case SPEED_100:
-                        ctrl1_bits = BMCR_SPEED100;
-                        required = SUPPORTED_100baseT_Half;
-                        break;
-                case SPEED_1000:
-                        ctrl1_bits = BMCR_SPEED1000;
-                        required = SUPPORTED_1000baseT_Half;
-                        break;
-                default:
-                        return -EINVAL;
+                case SPEED_10:  required = SUPPORTED_10baseT_Half;  break;
+                case SPEED_100: required = SUPPORTED_100baseT_Half; break;
+                default:        return -EINVAL;
                 }
         }
-        if (ecmd->autoneg)
-                required |= SUPPORTED_Autoneg;
         required |= ecmd->advertising;
         if (required & ~prev.supported)
                 return -EINVAL;
 
-        /* Set the basic control bits */
-        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
-                                 MDIO_MMDREG_CTRL1);
-        reg &= ~(BMCR_SPEED1000 | BMCR_SPEED100 | BMCR_FULLDPLX | 0x003c);
-        reg |= ctrl1_bits;
-        mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD, MDIO_MMDREG_CTRL1,
-                            reg);
-
-        /* Set the AN registers */
-        if (ecmd->autoneg != prev.autoneg ||
-            ecmd->advertising != prev.advertising) {
-                bool xnp = false;
-
-                if (efx->phy_op->set_xnp_advertise)
-                        xnp = efx->phy_op->set_xnp_advertise(efx,
-                                                             ecmd->advertising);
-
-                if (ecmd->autoneg) {
-                        reg = 0;
-                        if (ecmd->advertising & ADVERTISED_10baseT_Half)
-                                reg |= ADVERTISE_10HALF;
-                        if (ecmd->advertising & ADVERTISED_10baseT_Full)
-                                reg |= ADVERTISE_10FULL;
-                        if (ecmd->advertising & ADVERTISED_100baseT_Half)
-                                reg |= ADVERTISE_100HALF;
-                        if (ecmd->advertising & ADVERTISED_100baseT_Full)
-                                reg |= ADVERTISE_100FULL;
-                        if (xnp)
-                                reg |= ADVERTISE_RESV;
-                        mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
-                                            MDIO_AN_ADVERTISE, reg);
-                }
+        if (ecmd->autoneg) {
+                bool xnp = (ecmd->advertising & ADVERTISED_10000baseT_Full
+                            || EFX_WORKAROUND_13204(efx));
+
+                /* Set up the base page */
+                reg = ADVERTISE_CSMA;
+                if (ecmd->advertising & ADVERTISED_10baseT_Half)
+                        reg |= ADVERTISE_10HALF;
+                if (ecmd->advertising & ADVERTISED_10baseT_Full)
+                        reg |= ADVERTISE_10FULL;
+                if (ecmd->advertising & ADVERTISED_100baseT_Half)
+                        reg |= ADVERTISE_100HALF;
+                if (ecmd->advertising & ADVERTISED_100baseT_Full)
+                        reg |= ADVERTISE_100FULL;
+                if (xnp)
+                        reg |= ADVERTISE_RESV;
+                else if (ecmd->advertising & (ADVERTISED_1000baseT_Half |
+                                              ADVERTISED_1000baseT_Full))
+                        reg |= ADVERTISE_NPAGE;
+                reg |= efx_fc_advertise(efx->wanted_fc);
+                mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
+                                    MDIO_AN_ADVERTISE, reg);
+
+                /* Set up the (extended) next page if necessary */
+                if (efx->phy_op->set_npage_adv)
+                        efx->phy_op->set_npage_adv(efx, ecmd->advertising);
 
+                /* Enable and restart AN */
                 reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
                                          MDIO_MMDREG_CTRL1);
-                if (ecmd->autoneg)
-                        reg |= BMCR_ANENABLE | BMCR_ANRESTART;
-                else
-                        reg &= ~BMCR_ANENABLE;
+                reg |= BMCR_ANENABLE;
+                if (!(EFX_WORKAROUND_15195(efx) &&
+                      LOOPBACK_MASK(efx) & efx->phy_op->loopbacks))
+                        reg |= BMCR_ANRESTART;
                 if (xnp)
                         reg |= 1 << MDIO_AN_CTRL_XNP_LBN;
                 else
                         reg &= ~(1 << MDIO_AN_CTRL_XNP_LBN);
                 mdio_clause45_write(efx, phy_id, MDIO_MMD_AN,
                                     MDIO_MMDREG_CTRL1, reg);
+        } else {
+                /* Disable AN */
+                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_AN,
+                                       MDIO_MMDREG_CTRL1,
+                                       __ffs(BMCR_ANENABLE), false);
+
+                /* Set the basic control bits */
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
+                                         MDIO_MMDREG_CTRL1);
+                reg &= ~(BMCR_SPEED1000 | BMCR_SPEED100 | BMCR_FULLDPLX |
+                         0x003c);
+                if (ecmd->speed == SPEED_100)
+                        reg |= BMCR_SPEED100;
+                if (ecmd->duplex)
+                        reg |= BMCR_FULLDPLX;
+                mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD,
+                                    MDIO_MMDREG_CTRL1, reg);
         }
 
         return 0;
diff --git a/drivers/net/sfc/mdio_10g.h b/drivers/net/sfc/mdio_10g.h
index 09bf801d056..8ba49773ce7 100644
--- a/drivers/net/sfc/mdio_10g.h
+++ b/drivers/net/sfc/mdio_10g.h
@@ -155,7 +155,8 @@
 #define MDIO_AN_XNP                     22
 #define MDIO_AN_LPA_XNP                 25
 
-#define MDIO_AN_10GBT_ADVERTISE         32
+#define MDIO_AN_10GBT_CTRL              32
+#define MDIO_AN_10GBT_CTRL_ADV_10G_LBN  12
 #define MDIO_AN_10GBT_STATUS            (33)
 #define MDIO_AN_10GBT_STATUS_MS_FLT_LBN (15) /* MASTER/SLAVE config fault */
 #define MDIO_AN_10GBT_STATUS_MS_LBN     (14) /* MASTER/SLAVE config */
diff --git a/drivers/net/sfc/net_driver.h b/drivers/net/sfc/net_driver.h
index 5f255f75754..e019ad1fb9a 100644
--- a/drivers/net/sfc/net_driver.h
+++ b/drivers/net/sfc/net_driver.h
@@ -566,7 +566,7 @@ struct efx_mac_operations {
  * @poll: Poll for hardware state. Serialised by the mac_lock.
  * @get_settings: Get ethtool settings. Serialised by the mac_lock.
  * @set_settings: Set ethtool settings. Serialised by the mac_lock.
- * @set_xnp_advertise: Set abilities advertised in Extended Next Page
+ * @set_npage_adv: Set abilities advertised in (Extended) Next Page
  *      (only needed where AN bit is set in mmds)
  * @num_tests: Number of PHY-specific tests/results
  * @test_names: Names of the tests/results
@@ -586,7 +586,7 @@ struct efx_phy_operations {
                               struct ethtool_cmd *ecmd);
         int (*set_settings) (struct efx_nic *efx,
                              struct ethtool_cmd *ecmd);
-        bool (*set_xnp_advertise) (struct efx_nic *efx, u32);
+        void (*set_npage_adv) (struct efx_nic *efx, u32);
         u32 num_tests;
         const char *const *test_names;
         int (*run_tests) (struct efx_nic *efx, int *results, unsigned flags);
@@ -754,8 +754,7 @@ union efx_multicast_hash {
  *      &struct net_device_stats.
  * @stats_buffer: DMA buffer for statistics
  * @stats_lock: Statistics update lock. Serialises statistics fetches
- * @stats_enabled: Temporarily disable statistics fetches.
- *      Serialised by @stats_lock
+ * @stats_disable_count: Nest count for disabling statistics fetches
  * @mac_op: MAC interface
  * @mac_address: Permanent MAC address
  * @phy_type: PHY type
@@ -837,7 +836,7 @@ struct efx_nic {
         struct efx_mac_stats mac_stats;
         struct efx_buffer stats_buffer;
         spinlock_t stats_lock;
-        bool stats_enabled;
+        unsigned int stats_disable_count;
 
         struct efx_mac_operations *mac_op;
         unsigned char mac_address[ETH_ALEN];
diff --git a/drivers/net/sfc/phy.h b/drivers/net/sfc/phy.h
index 58c493ef81b..07e855c148b 100644
--- a/drivers/net/sfc/phy.h
+++ b/drivers/net/sfc/phy.h
@@ -17,7 +17,6 @@ extern struct efx_phy_operations falcon_sfx7101_phy_ops;
 extern struct efx_phy_operations falcon_sft9001_phy_ops;
 
 extern void tenxpress_phy_blink(struct efx_nic *efx, bool blink);
-extern void tenxpress_crc_err(struct efx_nic *efx);
 
 /****************************************************************************
  * Exported functions from the driver for XFP optical PHYs
diff --git a/drivers/net/sfc/selftest.c b/drivers/net/sfc/selftest.c
index dba0d64d50c..0a598084c51 100644
--- a/drivers/net/sfc/selftest.c
+++ b/drivers/net/sfc/selftest.c
@@ -665,6 +665,7 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
 {
         enum efx_loopback_mode loopback_mode = efx->loopback_mode;
         int phy_mode = efx->phy_mode;
+        enum reset_type reset_method = RESET_TYPE_INVISIBLE;
         struct ethtool_cmd ecmd;
         struct efx_channel *channel;
         int rc_test = 0, rc_reset = 0, rc;
@@ -718,21 +719,21 @@ int efx_selftest(struct efx_nic *efx, struct efx_self_tests *tests,
         mutex_unlock(&efx->mac_lock);
 
         /* free up all consumers of SRAM (including all the queues) */
-        efx_reset_down(efx, &ecmd);
+        efx_reset_down(efx, reset_method, &ecmd);
 
         rc = efx_test_chip(efx, tests);
         if (rc && !rc_test)
                 rc_test = rc;
 
         /* reset the chip to recover from the register test */
-        rc_reset = falcon_reset_hw(efx, RESET_TYPE_ALL);
+        rc_reset = falcon_reset_hw(efx, reset_method);
 
         /* Ensure that the phy is powered and out of loopback
          * for the bist and loopback tests */
         efx->phy_mode &= ~PHY_MODE_LOW_POWER;
         efx->loopback_mode = LOOPBACK_NONE;
 
-        rc = efx_reset_up(efx, &ecmd, rc_reset == 0);
+        rc = efx_reset_up(efx, reset_method, &ecmd, rc_reset == 0);
         if (rc && !rc_reset)
                 rc_reset = rc;
 
diff --git a/drivers/net/sfc/sfe4001.c b/drivers/net/sfc/sfe4001.c
index 16b80acb999..cb25ae5b257 100644
--- a/drivers/net/sfc/sfe4001.c
+++ b/drivers/net/sfc/sfe4001.c
@@ -186,19 +186,22 @@ static int sfn4111t_reset(struct efx_nic *efx)
 {
         efx_oword_t reg;
 
-        /* GPIO pins are also used for I2C, so block that temporarily */
+        /* GPIO 3 and the GPIO register are shared with I2C, so block that */
         mutex_lock(&efx->i2c_adap.bus_lock);
 
+        /* Pull RST_N (GPIO 2) low then let it up again, setting the
+         * FLASH_CFG_1 strap (GPIO 3) appropriately.  Only change the
+         * output enables; the output levels should always be 0 (low)
+         * and we rely on external pull-ups. */
         falcon_read(efx, &reg, GPIO_CTL_REG_KER);
         EFX_SET_OWORD_FIELD(reg, GPIO2_OEN, true);
-        EFX_SET_OWORD_FIELD(reg, GPIO2_OUT, false);
         falcon_write(efx, &reg, GPIO_CTL_REG_KER);
         msleep(1000);
-        EFX_SET_OWORD_FIELD(reg, GPIO2_OUT, true);
-        EFX_SET_OWORD_FIELD(reg, GPIO3_OEN, true);
-        EFX_SET_OWORD_FIELD(reg, GPIO3_OUT,
-                            !(efx->phy_mode & PHY_MODE_SPECIAL));
+        EFX_SET_OWORD_FIELD(reg, GPIO2_OEN, false);
+        EFX_SET_OWORD_FIELD(reg, GPIO3_OEN,
+                            !!(efx->phy_mode & PHY_MODE_SPECIAL));
         falcon_write(efx, &reg, GPIO_CTL_REG_KER);
+        msleep(1);
 
         mutex_unlock(&efx->i2c_adap.bus_lock);
 
@@ -232,12 +235,18 @@ static ssize_t set_phy_flash_cfg(struct device *dev,
         } else if (efx->state != STATE_RUNNING || netif_running(efx->net_dev)) {
                 err = -EBUSY;
         } else {
+                /* Reset the PHY, reconfigure the MAC and enable/disable
+                 * MAC stats accordingly. */
                 efx->phy_mode = new_mode;
+                if (new_mode & PHY_MODE_SPECIAL)
+                        efx_stats_disable(efx);
                 if (efx->board_info.type == EFX_BOARD_SFE4001)
                         err = sfe4001_poweron(efx);
                 else
                         err = sfn4111t_reset(efx);
                 efx_reconfigure_port(efx);
+                if (!(new_mode & PHY_MODE_SPECIAL))
+                        efx_stats_enable(efx);
         }
         rtnl_unlock();
 
@@ -326,6 +335,11 @@ int sfe4001_init(struct efx_nic *efx)
         efx->board_info.monitor = sfe4001_check_hw;
         efx->board_info.fini = sfe4001_fini;
 
+        if (efx->phy_mode & PHY_MODE_SPECIAL) {
+                /* PHY won't generate a 156.25 MHz clock and MAC stats fetch
+                 * will fail. */
+                efx_stats_disable(efx);
+        }
         rc = sfe4001_poweron(efx);
         if (rc)
                 goto fail_ioexp;
@@ -372,17 +386,25 @@ static void sfn4111t_fini(struct efx_nic *efx)
         i2c_unregister_device(efx->board_info.hwmon_client);
 }
 
-static struct i2c_board_info sfn4111t_hwmon_info = {
+static struct i2c_board_info sfn4111t_a0_hwmon_info = {
         I2C_BOARD_INFO("max6647", 0x4e),
         .irq            = -1,
 };
 
+static struct i2c_board_info sfn4111t_r5_hwmon_info = {
+        I2C_BOARD_INFO("max6646", 0x4d),
+        .irq            = -1,
+};
+
 int sfn4111t_init(struct efx_nic *efx)
 {
         int rc;
 
         efx->board_info.hwmon_client =
-                i2c_new_device(&efx->i2c_adap, &sfn4111t_hwmon_info);
+                i2c_new_device(&efx->i2c_adap,
+                               (efx->board_info.minor < 5) ?
+                               &sfn4111t_a0_hwmon_info :
+                               &sfn4111t_r5_hwmon_info);
         if (!efx->board_info.hwmon_client)
                 return -EIO;
 
@@ -394,8 +416,10 @@ int sfn4111t_init(struct efx_nic *efx)
         if (rc)
                 goto fail_hwmon;
 
-        if (efx->phy_mode & PHY_MODE_SPECIAL)
+        if (efx->phy_mode & PHY_MODE_SPECIAL) {
+                efx_stats_disable(efx);
                 sfn4111t_reset(efx);
+        }
 
         return 0;
 
diff --git a/drivers/net/sfc/tenxpress.c b/drivers/net/sfc/tenxpress.c
index 9ecb77da954..f0efd246962 100644
--- a/drivers/net/sfc/tenxpress.c
+++ b/drivers/net/sfc/tenxpress.c
@@ -67,6 +67,8 @@
 #define PMA_PMD_EXT_CLK312_WIDTH 1
 #define PMA_PMD_EXT_LPOWER_LBN  12
 #define PMA_PMD_EXT_LPOWER_WIDTH 1
+#define PMA_PMD_EXT_ROBUST_LBN  14
+#define PMA_PMD_EXT_ROBUST_WIDTH 1
 #define PMA_PMD_EXT_SSR_LBN     15
 #define PMA_PMD_EXT_SSR_WIDTH   1
 
@@ -177,35 +179,24 @@
 #define C22EXT_STATUS_LINK_LBN  2
 #define C22EXT_STATUS_LINK_WIDTH 1
 
-#define C22EXT_MSTSLV_REG       49162
-#define C22EXT_MSTSLV_1000_HD_LBN 10
-#define C22EXT_MSTSLV_1000_HD_WIDTH 1
-#define C22EXT_MSTSLV_1000_FD_LBN 11
-#define C22EXT_MSTSLV_1000_FD_WIDTH 1
+#define C22EXT_MSTSLV_CTRL                      49161
+#define C22EXT_MSTSLV_CTRL_ADV_1000_HD_LBN      8
+#define C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN      9
+
+#define C22EXT_MSTSLV_STATUS                    49162
+#define C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN     10
+#define C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN     11
 
 /* Time to wait between powering down the LNPGA and turning off the power
  * rails */
 #define LNPGA_PDOWN_WAIT        (HZ / 5)
 
-static int crc_error_reset_threshold = 100;
-module_param(crc_error_reset_threshold, int, 0644);
-MODULE_PARM_DESC(crc_error_reset_threshold,
-                 "Max number of CRC errors before XAUI reset");
-
 struct tenxpress_phy_data {
         enum efx_loopback_mode loopback_mode;
-        atomic_t bad_crc_count;
         enum efx_phy_mode phy_mode;
         int bad_lp_tries;
 };
 
-void tenxpress_crc_err(struct efx_nic *efx)
-{
-        struct tenxpress_phy_data *phy_data = efx->phy_data;
-        if (phy_data != NULL)
-                atomic_inc(&phy_data->bad_crc_count);
-}
-
 static ssize_t show_phy_short_reach(struct device *dev,
                                     struct device_attribute *attr, char *buf)
 {
@@ -284,7 +275,9 @@ static int tenxpress_init(struct efx_nic *efx)
                                          PMA_PMD_XCONTROL_REG);
                 reg |= ((1 << PMA_PMD_EXT_GMII_EN_LBN) |
                         (1 << PMA_PMD_EXT_CLK_OUT_LBN) |
-                        (1 << PMA_PMD_EXT_CLK312_LBN));
+                        (1 << PMA_PMD_EXT_CLK312_LBN) |
+                        (1 << PMA_PMD_EXT_ROBUST_LBN));
+
                 mdio_clause45_write(efx, phy_id, MDIO_MMD_PMAPMD,
                                     PMA_PMD_XCONTROL_REG, reg);
                 mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
@@ -346,6 +339,7 @@ static int tenxpress_phy_init(struct efx_nic *efx)
         rc = tenxpress_init(efx);
         if (rc < 0)
                 goto fail;
+        mdio_clause45_set_pause(efx);
 
         if (efx->phy_type == PHY_TYPE_SFT9001B) {
                 rc = device_create_file(&efx->pci_dev->dev,
@@ -376,8 +370,8 @@ static int tenxpress_special_reset(struct efx_nic *efx)
 
         /* The XGMAC clock is driven from the SFC7101/SFT9001 312MHz clock, so
          * a special software reset can glitch the XGMAC sufficiently for stats
-         * requests to fail. Since we don't often special_reset, just lock. */
-        spin_lock(&efx->stats_lock);
+         * requests to fail. */
+        efx_stats_disable(efx);
 
         /* Initiate reset */
         reg = mdio_clause45_read(efx, efx->mii.phy_id,
@@ -392,17 +386,17 @@ static int tenxpress_special_reset(struct efx_nic *efx)
         rc = mdio_clause45_wait_reset_mmds(efx,
                                            TENXPRESS_REQUIRED_DEVS);
         if (rc < 0)
-                goto unlock;
+                goto out;
 
         /* Try and reconfigure the device */
         rc = tenxpress_init(efx);
         if (rc < 0)
-                goto unlock;
+                goto out;
 
         /* Wait for the XGXS state machine to churn */
         mdelay(10);
-unlock:
-        spin_unlock(&efx->stats_lock);
+out:
+        efx_stats_enable(efx);
         return rc;
 }
 
@@ -520,7 +514,7 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
 {
         struct tenxpress_phy_data *phy_data = efx->phy_data;
         struct ethtool_cmd ecmd;
-        bool phy_mode_change, loop_reset, loop_toggle, loopback;
+        bool phy_mode_change, loop_reset;
 
         if (efx->phy_mode & (PHY_MODE_OFF | PHY_MODE_SPECIAL)) {
                 phy_data->phy_mode = efx->phy_mode;
@@ -531,12 +525,10 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
 
         phy_mode_change = (efx->phy_mode == PHY_MODE_NORMAL &&
                            phy_data->phy_mode != PHY_MODE_NORMAL);
-        loopback = LOOPBACK_MASK(efx) & efx->phy_op->loopbacks;
-        loop_toggle = LOOPBACK_CHANGED(phy_data, efx, efx->phy_op->loopbacks);
         loop_reset = (LOOPBACK_OUT_OF(phy_data, efx, efx->phy_op->loopbacks) ||
                       LOOPBACK_CHANGED(phy_data, efx, 1 << LOOPBACK_GPHY));
 
-        if (loop_reset || loop_toggle || loopback || phy_mode_change) {
+        if (loop_reset || phy_mode_change) {
                 int rc;
 
                 efx->phy_op->get_settings(efx, &ecmd);
@@ -551,20 +543,6 @@ static void tenxpress_phy_reconfigure(struct efx_nic *efx)
                                 falcon_reset_xaui(efx);
                 }
 
-                if (efx->phy_type != PHY_TYPE_SFX7101) {
-                        /* Only change autoneg once, on coming out or
-                         * going into loopback */
-                        if (loop_toggle)
-                                ecmd.autoneg = !loopback;
-                        if (loopback) {
-                                ecmd.duplex = DUPLEX_FULL;
-                                if (efx->loopback_mode == LOOPBACK_GPHY)
-                                        ecmd.speed = SPEED_1000;
-                                else
-                                        ecmd.speed = SPEED_10000;
-                        }
-                }
-
                 rc = efx->phy_op->set_settings(efx, &ecmd);
                 WARN_ON(rc);
         }
@@ -623,13 +601,6 @@ static void tenxpress_phy_poll(struct efx_nic *efx)
 
         if (phy_data->phy_mode != PHY_MODE_NORMAL)
                 return;
-
-        if (EFX_WORKAROUND_10750(efx) &&
-            atomic_read(&phy_data->bad_crc_count) > crc_error_reset_threshold) {
-                EFX_ERR(efx, "Resetting XAUI due to too many CRC errors\n");
-                falcon_reset_xaui(efx);
-                atomic_set(&phy_data->bad_crc_count, 0);
-        }
 }
 
 static void tenxpress_phy_fini(struct efx_nic *efx)
@@ -772,107 +743,76 @@ reset:
         return rc;
 }
 
-static u32 tenxpress_get_xnp_lpa(struct efx_nic *efx)
+static void
+tenxpress_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
-        int phy = efx->mii.phy_id;
-        u32 lpa = 0;
+        int phy_id = efx->mii.phy_id;
+        u32 adv = 0, lpa = 0;
         int reg;
 
         if (efx->phy_type != PHY_TYPE_SFX7101) {
-                reg = mdio_clause45_read(efx, phy, MDIO_MMD_C22EXT,
-                                         C22EXT_MSTSLV_REG);
-                if (reg & (1 << C22EXT_MSTSLV_1000_HD_LBN))
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
+                                         C22EXT_MSTSLV_CTRL);
+                if (reg & (1 << C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN))
+                        adv |= ADVERTISED_1000baseT_Full;
+                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
+                                         C22EXT_MSTSLV_STATUS);
+                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_HD_LBN))
                         lpa |= ADVERTISED_1000baseT_Half;
-                if (reg & (1 << C22EXT_MSTSLV_1000_FD_LBN))
+                if (reg & (1 << C22EXT_MSTSLV_STATUS_LP_1000_FD_LBN))
                         lpa |= ADVERTISED_1000baseT_Full;
         }
-        reg = mdio_clause45_read(efx, phy, MDIO_MMD_AN, MDIO_AN_10GBT_STATUS);
+        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
+                                 MDIO_AN_10GBT_CTRL);
+        if (reg & (1 << MDIO_AN_10GBT_CTRL_ADV_10G_LBN))
+                adv |= ADVERTISED_10000baseT_Full;
+        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_AN,
+                                 MDIO_AN_10GBT_STATUS);
         if (reg & (1 << MDIO_AN_10GBT_STATUS_LP_10G_LBN))
                 lpa |= ADVERTISED_10000baseT_Full;
-        return lpa;
-}
 
-static void sfx7101_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
-{
-        mdio_clause45_get_settings_ext(efx, ecmd, ADVERTISED_10000baseT_Full,
-                                       tenxpress_get_xnp_lpa(efx));
-        ecmd->supported |= SUPPORTED_10000baseT_Full;
-        ecmd->advertising |= ADVERTISED_10000baseT_Full;
+        mdio_clause45_get_settings_ext(efx, ecmd, adv, lpa);
+
+        if (efx->phy_type != PHY_TYPE_SFX7101)
+                ecmd->supported |= (SUPPORTED_100baseT_Full |
+                                    SUPPORTED_1000baseT_Full);
+
+        /* In loopback, the PHY automatically brings up the correct interface,
+         * but doesn't advertise the correct speed. So override it */
+        if (efx->loopback_mode == LOOPBACK_GPHY)
+                ecmd->speed = SPEED_1000;
+        else if (LOOPBACK_MASK(efx) & efx->phy_op->loopbacks)
+                ecmd->speed = SPEED_10000;
 }
 
-static void sft9001_get_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+static int tenxpress_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
 {
-        int phy_id = efx->mii.phy_id;
-        u32 xnp_adv = 0;
-        int reg;
-
-        reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_PMAPMD,
-                                 PMA_PMD_SPEED_ENABLE_REG);
-        if (EFX_WORKAROUND_13204(efx) && (reg & (1 << PMA_PMD_100TX_ADV_LBN)))
-                xnp_adv |= ADVERTISED_100baseT_Full;
-        if (reg & (1 << PMA_PMD_1000T_ADV_LBN))
-                xnp_adv |= ADVERTISED_1000baseT_Full;
-        if (reg & (1 << PMA_PMD_10000T_ADV_LBN))
-                xnp_adv |= ADVERTISED_10000baseT_Full;
-
-        mdio_clause45_get_settings_ext(efx, ecmd, xnp_adv,
-                                       tenxpress_get_xnp_lpa(efx));
-
-        ecmd->supported |= (SUPPORTED_100baseT_Half |
-                            SUPPORTED_100baseT_Full |
-                            SUPPORTED_1000baseT_Full);
+        if (!ecmd->autoneg)
+                return -EINVAL;
 
-        /* Use the vendor defined C22ext register for duplex settings */
-        if (ecmd->speed != SPEED_10000 && !ecmd->autoneg) {
-                reg = mdio_clause45_read(efx, phy_id, MDIO_MMD_C22EXT,
-                                         GPHY_XCONTROL_REG);
-                ecmd->duplex = (reg & (1 << GPHY_DUPLEX_LBN) ?
-                                DUPLEX_FULL : DUPLEX_HALF);
-        }
+        return mdio_clause45_set_settings(efx, ecmd);
 }
 
-static int sft9001_set_settings(struct efx_nic *efx, struct ethtool_cmd *ecmd)
+static void sfx7101_set_npage_adv(struct efx_nic *efx, u32 advertising)
 {
-        int phy_id = efx->mii.phy_id;
-        int rc;
-
-        rc = mdio_clause45_set_settings(efx, ecmd);
-        if (rc)
-                return rc;
-
-        if (ecmd->speed != SPEED_10000 && !ecmd->autoneg)
-                mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
-                                       GPHY_XCONTROL_REG, GPHY_DUPLEX_LBN,
-                                       ecmd->duplex == DUPLEX_FULL);
-
-        return rc;
+        mdio_clause45_set_flag(efx, efx->mii.phy_id, MDIO_MMD_AN,
+                               MDIO_AN_10GBT_CTRL,
+                               MDIO_AN_10GBT_CTRL_ADV_10G_LBN,
+                               advertising & ADVERTISED_10000baseT_Full);
 }
 
-static bool sft9001_set_xnp_advertise(struct efx_nic *efx, u32 advertising)
+static void sft9001_set_npage_adv(struct efx_nic *efx, u32 advertising)
 {
-        int phy = efx->mii.phy_id;
-        int reg = mdio_clause45_read(efx, phy, MDIO_MMD_PMAPMD,
-                                     PMA_PMD_SPEED_ENABLE_REG);
-        bool enabled;
-
-        reg &= ~((1 << 2) | (1 << 3));
-        if (EFX_WORKAROUND_13204(efx) &&
-            (advertising & ADVERTISED_100baseT_Full))
-                reg |= 1 << PMA_PMD_100TX_ADV_LBN;
-        if (advertising & ADVERTISED_1000baseT_Full)
-                reg |= 1 << PMA_PMD_1000T_ADV_LBN;
-        if (advertising & ADVERTISED_10000baseT_Full)
-                reg |= 1 << PMA_PMD_10000T_ADV_LBN;
-        mdio_clause45_write(efx, phy, MDIO_MMD_PMAPMD,
-                            PMA_PMD_SPEED_ENABLE_REG, reg);
-
-        enabled = (advertising &
-                   (ADVERTISED_1000baseT_Half |
-                    ADVERTISED_1000baseT_Full |
-                    ADVERTISED_10000baseT_Full));
-        if (EFX_WORKAROUND_13204(efx))
-                enabled |= (advertising & ADVERTISED_100baseT_Full);
-        return enabled;
+        int phy_id = efx->mii.phy_id;
+
+        mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_C22EXT,
+                               C22EXT_MSTSLV_CTRL,
+                               C22EXT_MSTSLV_CTRL_ADV_1000_FD_LBN,
+                               advertising & ADVERTISED_1000baseT_Full);
+        mdio_clause45_set_flag(efx, phy_id, MDIO_MMD_AN,
+                               MDIO_AN_10GBT_CTRL,
+                               MDIO_AN_10GBT_CTRL_ADV_10G_LBN,
+                               advertising & ADVERTISED_10000baseT_Full);
 }
 
 struct efx_phy_operations falcon_sfx7101_phy_ops = {
@@ -882,8 +822,9 @@ struct efx_phy_operations falcon_sfx7101_phy_ops = {
         .poll             = tenxpress_phy_poll,
         .fini             = tenxpress_phy_fini,
         .clear_interrupt  = efx_port_dummy_op_void,
-        .get_settings     = sfx7101_get_settings,
-        .set_settings     = mdio_clause45_set_settings,
+        .get_settings     = tenxpress_get_settings,
+        .set_settings     = tenxpress_set_settings,
+        .set_npage_adv    = sfx7101_set_npage_adv,
         .num_tests        = ARRAY_SIZE(sfx7101_test_names),
         .test_names       = sfx7101_test_names,
         .run_tests        = sfx7101_run_tests,
@@ -898,9 +839,9 @@ struct efx_phy_operations falcon_sft9001_phy_ops = {
         .poll             = tenxpress_phy_poll,
         .fini             = tenxpress_phy_fini,
         .clear_interrupt  = efx_port_dummy_op_void,
-        .get_settings     = sft9001_get_settings,
-        .set_settings     = sft9001_set_settings,
-        .set_xnp_advertise = sft9001_set_xnp_advertise,
+        .get_settings     = tenxpress_get_settings,
+        .set_settings     = tenxpress_set_settings,
+        .set_npage_adv    = sft9001_set_npage_adv,
         .num_tests        = ARRAY_SIZE(sft9001_test_names),
         .test_names       = sft9001_test_names,
         .run_tests        = sft9001_run_tests,
diff --git a/drivers/net/sfc/workarounds.h b/drivers/net/sfc/workarounds.h
index 82e03e1d737..78de68f4a95 100644
--- a/drivers/net/sfc/workarounds.h
+++ b/drivers/net/sfc/workarounds.h
@@ -18,8 +18,8 @@
 #define EFX_WORKAROUND_ALWAYS(efx) 1
 #define EFX_WORKAROUND_FALCON_A(efx) (falcon_rev(efx) <= FALCON_REV_A1)
 #define EFX_WORKAROUND_10G(efx) EFX_IS10G(efx)
-#define EFX_WORKAROUND_SFX7101(efx) ((efx)->phy_type == PHY_TYPE_SFX7101)
-#define EFX_WORKAROUND_SFT9001A(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A)
+#define EFX_WORKAROUND_SFT9001(efx) ((efx)->phy_type == PHY_TYPE_SFT9001A || \
+                                     (efx)->phy_type == PHY_TYPE_SFT9001B)
 
 /* XAUI resets if link not detected */
 #define EFX_WORKAROUND_5147 EFX_WORKAROUND_ALWAYS
@@ -29,8 +29,6 @@
 #define EFX_WORKAROUND_7884 EFX_WORKAROUND_10G
 /* TX pkt parser problem with <= 16 byte TXes */
 #define EFX_WORKAROUND_9141 EFX_WORKAROUND_ALWAYS
-/* Low rate CRC errors require XAUI reset */
-#define EFX_WORKAROUND_10750 EFX_WORKAROUND_SFX7101
 /* TX_EV_PKT_ERR can be caused by a dangling TX descriptor
  * or a PCIe error (bug 11028) */
 #define EFX_WORKAROUND_10727 EFX_WORKAROUND_ALWAYS
@@ -55,8 +53,8 @@
 #define EFX_WORKAROUND_8071 EFX_WORKAROUND_FALCON_A
 
 /* Need to send XNP pages for 100BaseT */
-#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001A
-/* Need to keep AN enabled */
-#define EFX_WORKAROUND_13963 EFX_WORKAROUND_SFT9001A
+#define EFX_WORKAROUND_13204 EFX_WORKAROUND_SFT9001
+/* Don't restart AN in near-side loopback */
+#define EFX_WORKAROUND_15195 EFX_WORKAROUND_SFT9001
 
 #endif /* EFX_WORKAROUNDS_H */
diff --git a/drivers/net/skfp/skfddi.c b/drivers/net/skfp/skfddi.c
index 607efeaf0bc..9a00e5566af 100644
--- a/drivers/net/skfp/skfddi.c
+++ b/drivers/net/skfp/skfddi.c
@@ -1003,9 +1003,9 @@ static int skfp_ioctl(struct net_device *dev, struct ifreq *rq, int cmd)
                 break;
         case SKFP_CLR_STATS:    /* Zero out the driver statistics */
                 if (!capable(CAP_NET_ADMIN)) {
-                        memset(&lp->MacStat, 0, sizeof(lp->MacStat));
-                } else {
                         status = -EPERM;
+                } else {
+                        memset(&lp->MacStat, 0, sizeof(lp->MacStat));
                 }
                 break;
         default:
diff --git a/drivers/net/sky2.c b/drivers/net/sky2.c
index 3668e81e474..994703cc0db 100644
--- a/drivers/net/sky2.c
+++ b/drivers/net/sky2.c
@@ -1403,9 +1403,6 @@ static int sky2_up(struct net_device *dev)
 
         }
 
-        if (netif_msg_ifup(sky2))
-                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
-
         netif_carrier_off(dev);
 
         /* must be power of 2 */
@@ -1484,6 +1481,9 @@ static int sky2_up(struct net_device *dev)
         sky2_write32(hw, B0_IMSK, imask);
 
         sky2_set_multicast(dev);
+
+        if (netif_msg_ifup(sky2))
+                printk(KERN_INFO PFX "%s: enabling interface\n", dev->name);
         return 0;
 
 err_out:
diff --git a/drivers/net/smc911x.c b/drivers/net/smc911x.c
index bf3aa2a1eff..223cde0d43b 100644
--- a/drivers/net/smc911x.c
+++ b/drivers/net/smc911x.c
@@ -220,9 +220,9 @@ static void smc911x_reset(struct net_device *dev)
 
         /* make sure EEPROM has finished loading before setting GPIO_CFG */
         timeout=1000;
-        while ( timeout-- && (SMC_GET_E2P_CMD(lp) & E2P_CMD_EPC_BUSY_)) {
+        while (--timeout && (SMC_GET_E2P_CMD(lp) & E2P_CMD_EPC_BUSY_))
                 udelay(10);
-        }
+
         if (timeout == 0){
                 PRINTK("%s: smc911x_reset timeout waiting for EEPROM busy\n", dev->name);
                 return;
diff --git a/drivers/net/smsc911x.c b/drivers/net/smsc911x.c
index f513bdf1c88..783c1a7b869 100644
--- a/drivers/net/smsc911x.c
+++ b/drivers/net/smsc911x.c
@@ -953,7 +953,7 @@ smsc911x_rx_fastforward(struct smsc911x_data *pdata, unsigned int pktbytes)
                 do {
                         udelay(1);
                         val = smsc911x_reg_read(pdata, RX_DP_CTRL);
-                } while (timeout-- && (val & RX_DP_CTRL_RX_FFWD_));
+                } while (--timeout && (val & RX_DP_CTRL_RX_FFWD_));
 
                 if (unlikely(timeout == 0))
                         SMSC_WARNING(HW, "Timed out waiting for "
diff --git a/drivers/net/smsc9420.c b/drivers/net/smsc9420.c
index c14a4c6452c..a1e4b3895b3 100644
--- a/drivers/net/smsc9420.c
+++ b/drivers/net/smsc9420.c
@@ -498,7 +498,7 @@ static void smsc9420_check_mac_address(struct net_device *dev)
 static void smsc9420_stop_tx(struct smsc9420_pdata *pd)
 {
         u32 dmac_control, mac_cr, dma_intr_ena;
-        int timeOut = 1000;
+        int timeout = 1000;
 
         /* disable TX DMAC */
         dmac_control = smsc9420_reg_read(pd, DMAC_CONTROL);
@@ -506,13 +506,13 @@ static void smsc9420_stop_tx(struct smsc9420_pdata *pd)
         smsc9420_reg_write(pd, DMAC_CONTROL, dmac_control);
 
         /* Wait max 10ms for transmit process to stop */
-        while (timeOut--) {
+        while (--timeout) {
                 if (smsc9420_reg_read(pd, DMAC_STATUS) & DMAC_STS_TS_)
                         break;
                 udelay(10);
         }
 
-        if (!timeOut)
+        if (!timeout)
                 smsc_warn(IFDOWN, "TX DMAC failed to stop");
 
         /* ACK Tx DMAC stop bit */
@@ -596,7 +596,7 @@ static void smsc9420_free_rx_ring(struct smsc9420_pdata *pd)
 
 static void smsc9420_stop_rx(struct smsc9420_pdata *pd)
 {
-        int timeOut = 1000;
+        int timeout = 1000;
         u32 mac_cr, dmac_control, dma_intr_ena;
 
         /* mask RX DMAC interrupts */
@@ -617,13 +617,13 @@ static void smsc9420_stop_rx(struct smsc9420_pdata *pd)
         smsc9420_pci_flush_write(pd);
 
         /* wait up to 10ms for receive to stop */
-        while (timeOut--) {
+        while (--timeout) {
                 if (smsc9420_reg_read(pd, DMAC_STATUS) & DMAC_STS_RS_)
                         break;
                 udelay(10);
         }
 
-        if (!timeOut)
+        if (!timeout)
                 smsc_warn(IFDOWN, "RX DMAC did not stop! timeout.");
 
         /* ACK the Rx DMAC stop bit */
@@ -1378,6 +1378,7 @@ static int smsc9420_open(struct net_device *dev)
 
         /* test the IRQ connection to the ISR */
         smsc_dbg(IFUP, "Testing ISR using IRQ %d", dev->irq);
+        pd->software_irq_signal = false;
 
         spin_lock_irqsave(&pd->int_lock, flags);
         /* configure interrupt deassertion timer and enable interrupts */
@@ -1393,8 +1394,6 @@ static int smsc9420_open(struct net_device *dev)
         smsc9420_pci_flush_write(pd);
 
         timeout = 1000;
-        pd->software_irq_signal = false;
-        smp_wmb();
         while (timeout--) {
                 if (pd->software_irq_signal)
                         break;
diff --git a/drivers/net/sungem.c b/drivers/net/sungem.c
index 86c765d83de..49187634106 100644
--- a/drivers/net/sungem.c
+++ b/drivers/net/sungem.c
@@ -148,7 +148,7 @@ static u16 __phy_read(struct gem *gp, int phy_addr, int reg)
         cmd |= (MIF_FRAME_TAMSB);
         writel(cmd, gp->regs + MIF_FRAME);
 
-        while (limit--) {
+        while (--limit) {
                 cmd = readl(gp->regs + MIF_FRAME);
                 if (cmd & MIF_FRAME_TALSB)
                         break;
@@ -2221,6 +2221,8 @@ static int gem_do_start(struct net_device *dev)
 
         gp->running = 1;
 
+        napi_enable(&gp->napi);
+
         if (gp->lstate == link_up) {
                 netif_carrier_on(gp->dev);
                 gem_set_link_modes(gp);
@@ -2238,6 +2240,8 @@ static int gem_do_start(struct net_device *dev)
                 spin_lock_irqsave(&gp->lock, flags);
                 spin_lock(&gp->tx_lock);
 
+                napi_disable(&gp->napi);
+
                 gp->running =  0;
                 gem_reset(gp);
                 gem_clean_rings(gp);
@@ -2338,8 +2342,6 @@ static int gem_open(struct net_device *dev)
         if (!gp->asleep)
                 rc = gem_do_start(dev);
         gp->opened = (rc == 0);
-        if (gp->opened)
-                napi_enable(&gp->napi);
 
         mutex_unlock(&gp->pm_mutex);
 
@@ -2476,8 +2478,6 @@ static int gem_resume(struct pci_dev *pdev)
 
                 /* Re-attach net device */
                 netif_device_attach(dev);
-
-                napi_enable(&gp->napi);
         }
 
         spin_lock_irqsave(&gp->lock, flags);
diff --git a/drivers/net/sungem_phy.c b/drivers/net/sungem_phy.c
index 61843fd5752..78f8cee5fd7 100644
--- a/drivers/net/sungem_phy.c
+++ b/drivers/net/sungem_phy.c
@@ -79,7 +79,7 @@ static int reset_one_mii_phy(struct mii_phy* phy, int phy_id)
 
         udelay(100);
 
-        while (limit--) {
+        while (--limit) {
                 val = __phy_read(phy, phy_id, MII_BMCR);
                 if ((val & BMCR_RESET) == 0)
                         break;
diff --git a/drivers/net/sunhme.c b/drivers/net/sunhme.c
index 7a72a3112f0..cc4013be5e1 100644
--- a/drivers/net/sunhme.c
+++ b/drivers/net/sunhme.c
@@ -2629,6 +2629,14 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
         int i, qfe_slot = -1;
         int err = -ENODEV;
 
+        sbus_dp = to_of_device(op->dev.parent)->node;
+        if (is_qfe)
+                sbus_dp = to_of_device(op->dev.parent->parent)->node;
+
+        /* We can match PCI devices too, do not accept those here. */
+        if (strcmp(sbus_dp->name, "sbus"))
+                return err;
+
         if (is_qfe) {
                 qp = quattro_sbus_find(op);
                 if (qp == NULL)
@@ -2734,10 +2742,6 @@ static int __devinit happy_meal_sbus_probe_one(struct of_device *op, int is_qfe)
         if (qp != NULL)
                 hp->happy_flags |= HFLAG_QUATTRO;
 
-        sbus_dp = to_of_device(op->dev.parent)->node;
-        if (is_qfe)
-                sbus_dp = to_of_device(op->dev.parent->parent)->node;
-
         /* Get the supported DVMA burst sizes from our Happy SBUS. */
         hp->happy_bursts = of_getintprop_default(sbus_dp,
                                                  "burst-sizes", 0x00);
diff --git a/drivers/net/sunqe.c b/drivers/net/sunqe.c
index 6e8f377355f..fe0c3f24456 100644
--- a/drivers/net/sunqe.c
+++ b/drivers/net/sunqe.c
@@ -227,7 +227,7 @@ static int qe_init(struct sunqe *qep, int from_irq)
         if (!(sbus_readb(mregs + MREGS_PHYCONFIG) & MREGS_PHYCONFIG_LTESTDIS)) {
                 int tries = 50;
 
-                while (tries--) {
+                while (--tries) {
                         u8 tmp;
 
                         mdelay(5);
diff --git a/drivers/net/tsi108_eth.c b/drivers/net/tsi108_eth.c
index 75461dbd487..a9fd2b2ccaf 100644
--- a/drivers/net/tsi108_eth.c
+++ b/drivers/net/tsi108_eth.c
@@ -1237,7 +1237,7 @@ static void tsi108_init_phy(struct net_device *dev)
         spin_lock_irqsave(&phy_lock, flags);
 
         tsi108_write_mii(data, MII_BMCR, BMCR_RESET);
-        while (i--){
+        while (--i) {
                 if(!(tsi108_read_mii(data, MII_BMCR) & BMCR_RESET))
                         break;
                 udelay(10);
diff --git a/drivers/net/tulip/21142.c b/drivers/net/tulip/21142.c
index 1210fb3748a..db7d5e11855 100644
--- a/drivers/net/tulip/21142.c
+++ b/drivers/net/tulip/21142.c
@@ -9,6 +9,11 @@
 
         Please refer to Documentation/DocBook/tulip-user.{pdf,ps,html}
         for more information on this driver.
+
+        DC21143 manual "21143 PCI/CardBus 10/100Mb/s Ethernet LAN Controller
+        Hardware Reference Manual" is currently available at :
+        http://developer.intel.com/design/network/manuals/278074.htm
+
         Please submit bugs to http://bugzilla.kernel.org/ .
 */
 
@@ -32,7 +37,11 @@ void t21142_media_task(struct work_struct *work)
         int csr12 = ioread32(ioaddr + CSR12);
         int next_tick = 60*HZ;
         int new_csr6 = 0;
+        int csr14 = ioread32(ioaddr + CSR14);
 
+        /* CSR12[LS10,LS100] are not reliable during autonegotiation */
+        if ((csr14 & 0x80) && (csr12 & 0x7000) != 0x5000)
+                csr12 |= 6;
         if (tulip_debug > 2)
                 printk(KERN_INFO"%s: 21143 negotiation status %8.8x, %s.\n",
                            dev->name, csr12, medianame[dev->if_port]);
@@ -76,7 +85,7 @@ void t21142_media_task(struct work_struct *work)
                         new_csr6 = 0x83860000;
                         dev->if_port = 3;
                         iowrite32(0, ioaddr + CSR13);
-                        iowrite32(0x0003FF7F, ioaddr + CSR14);
+                        iowrite32(0x0003FFFF, ioaddr + CSR14);
                         iowrite16(8, ioaddr + CSR15);
                         iowrite32(1, ioaddr + CSR13);
                 }
@@ -132,10 +141,14 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
         struct tulip_private *tp = netdev_priv(dev);
         void __iomem *ioaddr = tp->base_addr;
         int csr12 = ioread32(ioaddr + CSR12);
+        int csr14 = ioread32(ioaddr + CSR14);
 
+        /* CSR12[LS10,LS100] are not reliable during autonegotiation */
+        if ((csr14 & 0x80) && (csr12 & 0x7000) != 0x5000)
+                csr12 |= 6;
         if (tulip_debug > 1)
                 printk(KERN_INFO"%s: 21143 link status interrupt %8.8x, CSR5 %x, "
-                           "%8.8x.\n", dev->name, csr12, csr5, ioread32(ioaddr + CSR14));
+                           "%8.8x.\n", dev->name, csr12, csr5, csr14);
 
         /* If NWay finished and we have a negotiated partner capability. */
         if (tp->nway  &&  !tp->nwayset  &&  (csr12 & 0x7000) == 0x5000) {
@@ -143,7 +156,9 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
                 int negotiated = tp->sym_advertise & (csr12 >> 16);
                 tp->lpar = csr12 >> 16;
                 tp->nwayset = 1;
-                if (negotiated & 0x0100)                dev->if_port = 5;
+                /* If partner cannot negotiate, it is 10Mbps Half Duplex */
+                if (!(csr12 & 0x8000))          dev->if_port = 0;
+                else if (negotiated & 0x0100)   dev->if_port = 5;
                 else if (negotiated & 0x0080)   dev->if_port = 3;
                 else if (negotiated & 0x0040)   dev->if_port = 4;
                 else if (negotiated & 0x0020)   dev->if_port = 0;
@@ -214,7 +229,7 @@ void t21142_lnk_change(struct net_device *dev, int csr5)
                         tp->timer.expires = RUN_AT(3*HZ);
                         add_timer(&tp->timer);
                 } else if (dev->if_port == 5)
-                        iowrite32(ioread32(ioaddr + CSR14) & ~0x080, ioaddr + CSR14);
+                        iowrite32(csr14 & ~0x080, ioaddr + CSR14);
         } else if (dev->if_port == 0  ||  dev->if_port == 4) {
                 if ((csr12 & 4) == 0)
                         printk(KERN_INFO"%s: 21143 10baseT link beat good.\n",
diff --git a/drivers/net/tulip/de2104x.c b/drivers/net/tulip/de2104x.c
index d5d53b633cf..d4c5ecc51f7 100644
--- a/drivers/net/tulip/de2104x.c
+++ b/drivers/net/tulip/de2104x.c
@@ -392,7 +392,7 @@ static void de_rx (struct de_private *de)
         unsigned drop = 0;
         int rc;
 
-        while (rx_work--) {
+        while (--rx_work) {
                 u32 status, len;
                 dma_addr_t mapping;
                 struct sk_buff *skb, *copy_skb;
@@ -464,13 +464,14 @@ static void de_rx (struct de_private *de)
                         drop = 1;
 
 rx_next:
-                de->rx_ring[rx_tail].opts1 = cpu_to_le32(DescOwn);
                 if (rx_tail == (DE_RX_RING_SIZE - 1))
                         de->rx_ring[rx_tail].opts2 =
                                 cpu_to_le32(RingEnd | de->rx_buf_sz);
                 else
                         de->rx_ring[rx_tail].opts2 = cpu_to_le32(de->rx_buf_sz);
                 de->rx_ring[rx_tail].addr1 = cpu_to_le32(mapping);
+                wmb();
+                de->rx_ring[rx_tail].opts1 = cpu_to_le32(DescOwn);
                 rx_tail = NEXT_RX(rx_tail);
         }
 
diff --git a/drivers/net/tun.c b/drivers/net/tun.c
index d7b81e4fdd5..09fea31d3e3 100644
--- a/drivers/net/tun.c
+++ b/drivers/net/tun.c
@@ -157,10 +157,16 @@ static int update_filter(struct tap_filter *filter, void __user *arg)
 
         nexact = n;
 
-        /* The rest is hashed */
+        /* Remaining multicast addresses are hashed,
+         * unicast will leave the filter disabled. */
         memset(filter->mask, 0, sizeof(filter->mask));
-        for (; n < uf.count; n++)
+        for (; n < uf.count; n++) {
+                if (!is_multicast_ether_addr(addr[n].u)) {
+                        err = 0; /* no filter */
+                        goto done;
+                }
                 addr_hash_set(filter->mask, addr[n].u);
+        }
 
         /* For ALLMULTI just set the mask to all ones.
          * This overrides the mask populated above. */
diff --git a/drivers/net/ucc_geth.c b/drivers/net/ucc_geth.c
index 11441225bf4..e87986867ba 100644
--- a/drivers/net/ucc_geth.c
+++ b/drivers/net/ucc_geth.c
@@ -1536,6 +1536,11 @@ static void adjust_link(struct net_device *dev)
 static int init_phy(struct net_device *dev)
 {
         struct ucc_geth_private *priv = netdev_priv(dev);
+        struct device_node *np = priv->node;
+        struct device_node *phy, *mdio;
+        const phandle *ph;
+        char bus_name[MII_BUS_ID_SIZE];
+        const unsigned int *id;
         struct phy_device *phydev;
         char phy_id[BUS_ID_SIZE];
 
@@ -1543,8 +1548,18 @@ static int init_phy(struct net_device *dev)
         priv->oldspeed = 0;
         priv->oldduplex = -1;
 
-        snprintf(phy_id, sizeof(phy_id), PHY_ID_FMT, priv->ug_info->mdio_bus,
-                 priv->ug_info->phy_address);
+        ph = of_get_property(np, "phy-handle", NULL);
+        phy = of_find_node_by_phandle(*ph);
+        mdio = of_get_parent(phy);
+
+        id = of_get_property(phy, "reg", NULL);
+
+        of_node_put(phy);
+        of_node_put(mdio);
+
+        uec_mdio_bus_name(bus_name, mdio);
+        snprintf(phy_id, sizeof(phy_id), "%s:%02x",
+                                bus_name, *id);
 
         phydev = phy_connect(dev, phy_id, &adjust_link, 0, priv->phy_interface);
 
@@ -3748,6 +3763,7 @@ static int ucc_geth_probe(struct of_device* ofdev, const struct of_device_id *ma
 
         ugeth->ug_info = ug_info;
         ugeth->dev = dev;
+        ugeth->node = np;
 
         return 0;
 }
diff --git a/drivers/net/ucc_geth.h b/drivers/net/ucc_geth.h
index 8f699cb773e..16cbe42ba43 100644
--- a/drivers/net/ucc_geth.h
+++ b/drivers/net/ucc_geth.h
@@ -1186,6 +1186,8 @@ struct ucc_geth_private {
         int oldspeed;
         int oldduplex;
         int oldlink;
+
+        struct device_node *node;
 };
 
 void uec_set_ethtool_ops(struct net_device *netdev);
diff --git a/drivers/net/ucc_geth_mii.c b/drivers/net/ucc_geth_mii.c
index c001d261366..54635911305 100644
--- a/drivers/net/ucc_geth_mii.c
+++ b/drivers/net/ucc_geth_mii.c
@@ -156,7 +156,7 @@ static int uec_mdio_probe(struct of_device *ofdev, const struct of_device_id *ma
         if (err)
                 goto reg_map_fail;
 
-        snprintf(new_bus->id, MII_BUS_ID_SIZE, "%x", res.start);
+        uec_mdio_bus_name(new_bus->id, np);
 
         new_bus->irq = kmalloc(32 * sizeof(int), GFP_KERNEL);
 
@@ -283,3 +283,13 @@ void uec_mdio_exit(void)
 {
         of_unregister_platform_driver(&uec_mdio_driver);
 }
+
+void uec_mdio_bus_name(char *name, struct device_node *np)
+{
+        const u32 *reg;
+
+        reg = of_get_property(np, "reg", NULL);
+
+        snprintf(name, MII_BUS_ID_SIZE, "%s@%x", np->name, reg ? *reg : 0);
+}
+
diff --git a/drivers/net/ucc_geth_mii.h b/drivers/net/ucc_geth_mii.h
index 1e45b2028a5..840cf80235b 100644
--- a/drivers/net/ucc_geth_mii.h
+++ b/drivers/net/ucc_geth_mii.h
@@ -97,4 +97,5 @@ int uec_mdio_read(struct mii_bus *bus, int mii_id, int regnum);
 int uec_mdio_write(struct mii_bus *bus, int mii_id, int regnum, u16 value);
 int __init uec_mdio_init(void);
 void uec_mdio_exit(void);
+void uec_mdio_bus_name(char *name, struct device_node *np);
 #endif                          /* __UEC_MII_H */
diff --git a/drivers/net/usb/hso.c b/drivers/net/usb/hso.c
index 0d0fa91c025..fe98acaead9 100644
--- a/drivers/net/usb/hso.c
+++ b/drivers/net/usb/hso.c
@@ -455,6 +455,7 @@ static const struct usb_device_id hso_ids[] = {
         {icon321_port_device(0x0af0, 0xd033)},  /* Icon-322 */
         {USB_DEVICE(0x0af0, 0x7301)},           /* GE40x */
         {USB_DEVICE(0x0af0, 0x7361)},           /* GE40x */
+        {USB_DEVICE(0x0af0, 0x7381)},           /* GE40x */
         {USB_DEVICE(0x0af0, 0x7401)},           /* GI 0401 */
         {USB_DEVICE(0x0af0, 0x7501)},           /* GTM 382 */
         {USB_DEVICE(0x0af0, 0x7601)},           /* GE40x */
@@ -462,7 +463,8 @@ static const struct usb_device_id hso_ids[] = {
         {USB_DEVICE(0x0af0, 0x7801)},
         {USB_DEVICE(0x0af0, 0x7901)},
         {USB_DEVICE(0x0af0, 0x7361)},
-        {icon321_port_device(0x0af0, 0xd051)},
+        {USB_DEVICE(0x0af0, 0xd057)},
+        {USB_DEVICE(0x0af0, 0xd055)},
         {}
 };
 MODULE_DEVICE_TABLE(usb, hso_ids);
diff --git a/drivers/net/virtio_net.c b/drivers/net/virtio_net.c
index 63ef2a8905f..c68808336c8 100644
--- a/drivers/net/virtio_net.c
+++ b/drivers/net/virtio_net.c
@@ -287,7 +287,7 @@ static void try_fill_recv_maxbufs(struct virtnet_info *vi)
                 skb_put(skb, MAX_PACKET_LEN);
 
                 hdr = skb_vnet_hdr(skb);
-                sg_init_one(sg, hdr, sizeof(*hdr));
+                sg_set_buf(sg, hdr, sizeof(*hdr));
 
                 if (vi->big_packets) {
                         for (i = 0; i < MAX_SKB_FRAGS; i++) {
@@ -488,9 +488,9 @@ static int xmit_skb(struct virtnet_info *vi, struct sk_buff *skb)
 
         /* Encode metadata header at front. */
         if (vi->mergeable_rx_bufs)
-                sg_init_one(sg, mhdr, sizeof(*mhdr));
+                sg_set_buf(sg, mhdr, sizeof(*mhdr));
         else
-                sg_init_one(sg, hdr, sizeof(*hdr));
+                sg_set_buf(sg, hdr, sizeof(*hdr));
 
         num = skb_to_sgvec(skb, sg+1, 0, skb->len) + 1;
 
diff --git a/drivers/net/wimax/i2400m/debugfs.c b/drivers/net/wimax/i2400m/debugfs.c
index 62663298597..9b81af3f80a 100644
--- a/drivers/net/wimax/i2400m/debugfs.c
+++ b/drivers/net/wimax/i2400m/debugfs.c
@@ -234,20 +234,6 @@ struct dentry *debugfs_create_i2400m_reset(
                                    &fops_i2400m_reset);
 }
 
-/*
- * Debug levels control; see debug.h
- */
-struct d_level D_LEVEL[] = {
-        D_SUBMODULE_DEFINE(control),
-        D_SUBMODULE_DEFINE(driver),
-        D_SUBMODULE_DEFINE(debugfs),
-        D_SUBMODULE_DEFINE(fw),
-        D_SUBMODULE_DEFINE(netdev),
-        D_SUBMODULE_DEFINE(rfkill),
-        D_SUBMODULE_DEFINE(rx),
-        D_SUBMODULE_DEFINE(tx),
-};
-size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
 
 #define __debugfs_register(prefix, name, parent)                        \
 do {                                                                    \
diff --git a/drivers/net/wimax/i2400m/driver.c b/drivers/net/wimax/i2400m/driver.c
index 5f98047e18c..e80a0b65a75 100644
--- a/drivers/net/wimax/i2400m/driver.c
+++ b/drivers/net/wimax/i2400m/driver.c
@@ -707,6 +707,22 @@ void i2400m_release(struct i2400m *i2400m)
 EXPORT_SYMBOL_GPL(i2400m_release);
 
 
+/*
+ * Debug levels control; see debug.h
+ */
+struct d_level D_LEVEL[] = {
+        D_SUBMODULE_DEFINE(control),
+        D_SUBMODULE_DEFINE(driver),
+        D_SUBMODULE_DEFINE(debugfs),
+        D_SUBMODULE_DEFINE(fw),
+        D_SUBMODULE_DEFINE(netdev),
+        D_SUBMODULE_DEFINE(rfkill),
+        D_SUBMODULE_DEFINE(rx),
+        D_SUBMODULE_DEFINE(tx),
+};
+size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
+
+
 static
 int __init i2400m_driver_init(void)
 {
diff --git a/drivers/net/wireless/arlan-main.c b/drivers/net/wireless/arlan-main.c
index bfca15da6f0..14c11656e82 100644
--- a/drivers/net/wireless/arlan-main.c
+++ b/drivers/net/wireless/arlan-main.c
@@ -1082,8 +1082,8 @@ static int __init arlan_probe_here(struct net_device *dev,
         if (arlan_check_fingerprint(memaddr))
                 return -ENODEV;
 
-        printk(KERN_NOTICE "%s: Arlan found at %x, \n ", dev->name, 
-               (int) virt_to_phys((void*)memaddr));
+        printk(KERN_NOTICE "%s: Arlan found at %llx, \n ", dev->name, 
+               (u64) virt_to_phys((void*)memaddr));
 
         ap->card = (void *) memaddr;
         dev->mem_start = memaddr;
diff --git a/drivers/net/wireless/ath5k/base.c b/drivers/net/wireless/ath5k/base.c
index 8ef87356e08..a533ed60bb4 100644
--- a/drivers/net/wireless/ath5k/base.c
+++ b/drivers/net/wireless/ath5k/base.c
@@ -1028,6 +1028,8 @@ ath5k_setup_bands(struct ieee80211_hw *hw)
  * it's done by reseting the chip.  To accomplish this we must
  * first cleanup any pending DMA, then restart stuff after a la
  * ath5k_init.
+ *
+ * Called with sc->lock.
  */
 static int
 ath5k_chan_set(struct ath5k_softc *sc, struct ieee80211_channel *chan)
@@ -2814,11 +2816,17 @@ ath5k_config(struct ieee80211_hw *hw, u32 changed)
 {
         struct ath5k_softc *sc = hw->priv;
         struct ieee80211_conf *conf = &hw->conf;
+        int ret;
+
+        mutex_lock(&sc->lock);
 
         sc->bintval = conf->beacon_int;
         sc->power_level = conf->power_level;
 
-        return ath5k_chan_set(sc, conf->channel);
+        ret = ath5k_chan_set(sc, conf->channel);
+
+        mutex_unlock(&sc->lock);
+        return ret;
 }
 
 static int
diff --git a/drivers/net/wireless/iwlwifi/iwl-agn.c b/drivers/net/wireless/iwlwifi/iwl-agn.c
index 0dc8eed1640..c01ea48da5f 100644
--- a/drivers/net/wireless/iwlwifi/iwl-agn.c
+++ b/drivers/net/wireless/iwlwifi/iwl-agn.c
@@ -1719,6 +1719,10 @@ static int iwl_read_ucode(struct iwl_priv *priv)
         priv->ucode_data_backup.len = data_size;
         iwl_alloc_fw_desc(priv->pci_dev, &priv->ucode_data_backup);
 
+        if (!priv->ucode_code.v_addr || !priv->ucode_data.v_addr ||
+            !priv->ucode_data_backup.v_addr)
+                goto err_pci_alloc;
+
         /* Initialization instructions and data */
         if (init_size && init_data_size) {
                 priv->ucode_init.len = init_size;
@@ -4038,6 +4042,7 @@ static int iwl_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 priv->is_open = 1;
         }
 
+        pci_save_state(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
@@ -4048,6 +4053,7 @@ static int iwl_pci_resume(struct pci_dev *pdev)
         struct iwl_priv *priv = pci_get_drvdata(pdev);
 
         pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
 
         if (priv->is_open)
                 iwl_mac_start(priv->hw);
diff --git a/drivers/net/wireless/iwlwifi/iwl-sta.c b/drivers/net/wireless/iwlwifi/iwl-sta.c
index 412f66bac1a..70a8b21ca39 100644
--- a/drivers/net/wireless/iwlwifi/iwl-sta.c
+++ b/drivers/net/wireless/iwlwifi/iwl-sta.c
@@ -480,6 +480,9 @@ void iwl_clear_stations_table(struct iwl_priv *priv)
         priv->num_stations = 0;
         memset(priv->stations, 0, sizeof(priv->stations));
 
+        /* clean ucode key table bit map */
+        priv->ucode_key_table = 0;
+
         spin_unlock_irqrestore(&priv->sta_lock, flags);
 }
 EXPORT_SYMBOL(iwl_clear_stations_table);
diff --git a/drivers/net/wireless/iwlwifi/iwl3945-base.c b/drivers/net/wireless/iwlwifi/iwl3945-base.c
index 95d01984c80..5b44d322b99 100644
--- a/drivers/net/wireless/iwlwifi/iwl3945-base.c
+++ b/drivers/net/wireless/iwlwifi/iwl3945-base.c
@@ -8143,6 +8143,7 @@ static int iwl3945_pci_suspend(struct pci_dev *pdev, pm_message_t state)
                 priv->is_open = 1;
         }
 
+        pci_save_state(pdev);
         pci_set_power_state(pdev, PCI_D3hot);
 
         return 0;
@@ -8153,6 +8154,7 @@ static int iwl3945_pci_resume(struct pci_dev *pdev)
         struct iwl3945_priv *priv = pci_get_drvdata(pdev);
 
         pci_set_power_state(pdev, PCI_D0);
+        pci_restore_state(pdev);
 
         if (priv->is_open)
                 iwl3945_mac_start(priv->hw);
diff --git a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
index 4e75e8e7fa9..78df281b297 100644
--- a/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
+++ b/drivers/net/wireless/rtl818x/rtl8187_rtl8225.c
@@ -285,7 +285,10 @@ static void rtl8225_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         ofdm_power = priv->channels[channel - 1].hw_value >> 4;
 
         cck_power = min(cck_power, (u8)11);
-        ofdm_power = min(ofdm_power, (u8)35);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
 
         rtl818x_iowrite8(priv, &priv->map->TX_GAIN_CCK,
                          rtl8225_tx_gain_cck_ofdm[cck_power / 6] >> 1);
@@ -536,7 +539,10 @@ static void rtl8225z2_rf_set_tx_power(struct ieee80211_hw *dev, int channel)
         cck_power += priv->txpwr_base & 0xF;
         cck_power = min(cck_power, (u8)35);
 
-        ofdm_power = min(ofdm_power, (u8)15);
+        if (ofdm_power > (u8)15)
+                ofdm_power = 25;
+        else
+                ofdm_power += 10;
         ofdm_power += priv->txpwr_base >> 4;
         ofdm_power = min(ofdm_power, (u8)35);
 
diff --git a/drivers/oprofile/buffer_sync.c b/drivers/oprofile/buffer_sync.c
index 9da5a4b8113..c3ea5fa7d05 100644
--- a/drivers/oprofile/buffer_sync.c
+++ b/drivers/oprofile/buffer_sync.c
@@ -38,7 +38,7 @@
 
 static LIST_HEAD(dying_tasks);
 static LIST_HEAD(dead_tasks);
-static cpumask_t marked_cpus = CPU_MASK_NONE;
+static cpumask_var_t marked_cpus;
 static DEFINE_SPINLOCK(task_mortuary);
 static void process_task_mortuary(void);
 
@@ -456,10 +456,10 @@ static void mark_done(int cpu)
 {
         int i;
 
-        cpu_set(cpu, marked_cpus);
+        cpumask_set_cpu(cpu, marked_cpus);
 
         for_each_online_cpu(i) {
-                if (!cpu_isset(i, marked_cpus))
+                if (!cpumask_test_cpu(i, marked_cpus))
                         return;
         }
 
@@ -468,7 +468,7 @@ static void mark_done(int cpu)
          */
         process_task_mortuary();
 
-        cpus_clear(marked_cpus);
+        cpumask_clear(marked_cpus);
 }
 
 
@@ -565,6 +565,20 @@ void sync_buffer(int cpu)
         mutex_unlock(&buffer_mutex);
 }
 
+int __init buffer_sync_init(void)
+{
+        if (!alloc_cpumask_var(&marked_cpus, GFP_KERNEL))
+                return -ENOMEM;
+
+        cpumask_clear(marked_cpus);
+                return 0;
+}
+
+void __exit buffer_sync_cleanup(void)
+{
+        free_cpumask_var(marked_cpus);
+}
+
 /* The function can be used to add a buffer worth of data directly to
  * the kernel buffer. The buffer is assumed to be a circular buffer.
  * Take the entries from index start and end at index end, wrapping
diff --git a/drivers/oprofile/buffer_sync.h b/drivers/oprofile/buffer_sync.h
index 3110732c183..0ebf5db6267 100644
--- a/drivers/oprofile/buffer_sync.h
+++ b/drivers/oprofile/buffer_sync.h
@@ -19,4 +19,8 @@ void sync_stop(void);
 /* sync the given CPU's buffer */
 void sync_buffer(int cpu);
 
+/* initialize/destroy the buffer system. */
+int buffer_sync_init(void);
+void buffer_sync_cleanup(void);
+
 #endif /* OPROFILE_BUFFER_SYNC_H */
diff --git a/drivers/oprofile/oprof.c b/drivers/oprofile/oprof.c
index 3cffce90f82..ced39f60229 100644
--- a/drivers/oprofile/oprof.c
+++ b/drivers/oprofile/oprof.c
@@ -183,6 +183,10 @@ static int __init oprofile_init(void)
 {
         int err;
 
+        err = buffer_sync_init();
+        if (err)
+                return err;
+
         err = oprofile_arch_init(&oprofile_ops);
 
         if (err < 0 || timer) {
@@ -191,8 +195,10 @@ static int __init oprofile_init(void)
         }
 
         err = oprofilefs_register();
-        if (err)
+        if (err) {
                 oprofile_arch_exit();
+                buffer_sync_cleanup();
+        }
 
         return err;
 }
@@ -202,6 +208,7 @@ static void __exit oprofile_exit(void)
 {
         oprofilefs_unregister();
         oprofile_arch_exit();
+        buffer_sync_cleanup();
 }
 
 
diff --git a/drivers/parport/parport_serial.c b/drivers/parport/parport_serial.c
index 101ed49a2d1..032db815b0f 100644
--- a/drivers/parport/parport_serial.c
+++ b/drivers/parport/parport_serial.c
@@ -64,6 +64,11 @@ struct parport_pc_pci {
 
 static int __devinit netmos_parallel_init(struct pci_dev *dev, struct parport_pc_pci *card, int autoirq, int autodma)
 {
+        /* the rule described below doesn't hold for this device */
+        if (dev->device == PCI_DEVICE_ID_NETMOS_9835 &&
+                        dev->subsystem_vendor == PCI_VENDOR_ID_IBM &&
+                        dev->subsystem_device == 0x0299)
+                return -ENODEV;
         /*
          * Netmos uses the subdevice ID to indicate the number of parallel
          * and serial ports.  The form is 0x00PS, where <P> is the number of
diff --git a/drivers/pci/dmar.c b/drivers/pci/dmar.c
index f5a662a50ac..519f5f91e76 100644
--- a/drivers/pci/dmar.c
+++ b/drivers/pci/dmar.c
@@ -42,6 +42,7 @@
 LIST_HEAD(dmar_drhd_units);
 
 static struct acpi_table_header * __initdata dmar_tbl;
+static acpi_size dmar_tbl_size;
 
 static void __init dmar_register_drhd_unit(struct dmar_drhd_unit *drhd)
 {
@@ -288,8 +289,9 @@ static int __init dmar_table_detect(void)
         acpi_status status = AE_OK;
 
         /* if we could find DMAR table, then there are DMAR devices */
-        status = acpi_get_table(ACPI_SIG_DMAR, 0,
-                                (struct acpi_table_header **)&dmar_tbl);
+        status = acpi_get_table_with_size(ACPI_SIG_DMAR, 0,
+                                (struct acpi_table_header **)&dmar_tbl,
+                                &dmar_tbl_size);
 
         if (ACPI_SUCCESS(status) && !dmar_tbl) {
                 printk (KERN_WARNING PREFIX "Unable to map DMAR\n");
@@ -481,6 +483,7 @@ void __init detect_intel_iommu(void)
                         iommu_detected = 1;
 #endif
         }
+        early_acpi_os_unmap_memory(dmar_tbl, dmar_tbl_size);
         dmar_tbl = NULL;
 }
 
diff --git a/drivers/pci/hotplug/Makefile b/drivers/pci/hotplug/Makefile
index e31fb91652c..2aa117c8cd8 100644
--- a/drivers/pci/hotplug/Makefile
+++ b/drivers/pci/hotplug/Makefile
@@ -5,11 +5,15 @@
 obj-$(CONFIG_HOTPLUG_PCI)               += pci_hotplug.o
 obj-$(CONFIG_HOTPLUG_PCI_COMPAQ)        += cpqphp.o
 obj-$(CONFIG_HOTPLUG_PCI_IBM)           += ibmphp.o
+
+# pciehp should be linked before acpiphp in order to allow the native driver
+# to attempt to bind first. We can then fall back to generic support.
+
+obj-$(CONFIG_HOTPLUG_PCI_PCIE)          += pciehp.o
 obj-$(CONFIG_HOTPLUG_PCI_ACPI)          += acpiphp.o
 obj-$(CONFIG_HOTPLUG_PCI_ACPI_IBM)      += acpiphp_ibm.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_ZT5550)   += cpcihp_zt5550.o
 obj-$(CONFIG_HOTPLUG_PCI_CPCI_GENERIC)  += cpcihp_generic.o
-obj-$(CONFIG_HOTPLUG_PCI_PCIE)          += pciehp.o
 obj-$(CONFIG_HOTPLUG_PCI_SHPC)          += shpchp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA)           += rpaphp.o
 obj-$(CONFIG_HOTPLUG_PCI_RPA_DLPAR)     += rpadlpar_io.o
diff --git a/drivers/pci/hotplug/fakephp.c b/drivers/pci/hotplug/fakephp.c
index b0e7de9e536..d8649e12729 100644
--- a/drivers/pci/hotplug/fakephp.c
+++ b/drivers/pci/hotplug/fakephp.c
@@ -195,13 +195,13 @@ static void remove_slot_worker(struct work_struct *work)
  * Tries hard not to re-enable already existing devices;
  * also handles scanning of subfunctions.
  */
-static void pci_rescan_slot(struct pci_dev *temp)
+static int pci_rescan_slot(struct pci_dev *temp)
 {
         struct pci_bus *bus = temp->bus;
         struct pci_dev *dev;
         int func;
-        int retval;
         u8 hdr_type;
+        int count = 0;
 
         if (!pci_read_config_byte(temp, PCI_HEADER_TYPE, &hdr_type)) {
                 temp->hdr_type = hdr_type & 0x7f;
@@ -213,17 +213,12 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                 dbg("New device on %s function %x:%x\n",
                                         bus->name, temp->devfn >> 3,
                                         temp->devfn & 7);
-                                retval = pci_bus_add_device(dev);
-                                if (retval)
-                                        dev_err(&dev->dev, "error adding "
-                                                "device, continuing.\n");
-                                else
-                                        add_slot(dev);
+                                count++;
                         }
                 }
                 /* multifunction device? */
                 if (!(hdr_type & 0x80))
-                        return;
+                        return count;
 
                 /* continue scanning for other functions */
                 for (func = 1, temp->devfn++; func < 8; func++, temp->devfn++) {
@@ -239,16 +234,13 @@ static void pci_rescan_slot(struct pci_dev *temp)
                                         dbg("New device on %s function %x:%x\n",
                                                 bus->name, temp->devfn >> 3,
                                                 temp->devfn & 7);
-                                        retval = pci_bus_add_device(dev);
-                                        if (retval)
-                                                dev_err(&dev->dev, "error adding "
-                                                        "device, continuing.\n");
-                                        else
-                                                add_slot(dev);
+                                        count++;
                                 }
                         }
                 }
         }
+
+        return count;
 }
 
 
@@ -262,6 +254,8 @@ static void pci_rescan_bus(const struct pci_bus *bus)
 {
         unsigned int devfn;
         struct pci_dev *dev;
+        int retval;
+        int found = 0;
         dev = alloc_pci_dev();
         if (!dev)
                 return;
@@ -270,7 +264,23 @@ static void pci_rescan_bus(const struct pci_bus *bus)
         dev->sysdata = bus->sysdata;
         for (devfn = 0; devfn < 0x100; devfn += 8) {
                 dev->devfn = devfn;
-                pci_rescan_slot(dev);
+                found += pci_rescan_slot(dev);
+        }
+
+        if (found) {
+                pci_bus_assign_resources(bus);
+                list_for_each_entry(dev, &bus->devices, bus_list) {
+                        /* Skip already-added devices */
+                        if (dev->is_added)
+                                        continue;
+                        retval = pci_bus_add_device(dev);
+                        if (retval)
+                                dev_err(&dev->dev,
+                                        "Error adding device, continuing\n");
+                        else
+                                add_slot(dev);
+                }
+                pci_bus_add_devices(bus);
         }
         kfree(dev);
 }
diff --git a/drivers/pci/intel-iommu.c b/drivers/pci/intel-iommu.c
index 3dfecb20d5e..f4b7c79023f 100644
--- a/drivers/pci/intel-iommu.c
+++ b/drivers/pci/intel-iommu.c
@@ -268,7 +268,12 @@ static long list_size;
 
 static void domain_remove_dev_info(struct dmar_domain *domain);
 
-int dmar_disabled;
+#ifdef CONFIG_DMAR_DEFAULT_ON
+int dmar_disabled = 0;
+#else
+int dmar_disabled = 1;
+#endif /*CONFIG_DMAR_DEFAULT_ON*/
+
 static int __initdata dmar_map_gfx = 1;
 static int dmar_forcedac;
 static int intel_iommu_strict;
@@ -284,9 +289,12 @@ static int __init intel_iommu_setup(char *str)
         if (!str)
                 return -EINVAL;
         while (*str) {
-                if (!strncmp(str, "off", 3)) {
+                if (!strncmp(str, "on", 2)) {
+                        dmar_disabled = 0;
+                        printk(KERN_INFO "Intel-IOMMU: enabled\n");
+                } else if (!strncmp(str, "off", 3)) {
                         dmar_disabled = 1;
-                        printk(KERN_INFO"Intel-IOMMU: disabled\n");
+                        printk(KERN_INFO "Intel-IOMMU: disabled\n");
                 } else if (!strncmp(str, "igfx_off", 8)) {
                         dmar_map_gfx = 0;
                         printk(KERN_INFO
diff --git a/drivers/pci/intr_remapping.c b/drivers/pci/intr_remapping.c
index f78371b2252..5a57753ea9f 100644
--- a/drivers/pci/intr_remapping.c
+++ b/drivers/pci/intr_remapping.c
@@ -6,6 +6,7 @@
 #include <linux/irq.h>
 #include <asm/io_apic.h>
 #include <asm/smp.h>
+#include <asm/cpu.h>
 #include <linux/intel-iommu.h>
 #include "intr_remapping.h"
 
diff --git a/drivers/pci/msi.c b/drivers/pci/msi.c
index 896a15d70f5..44f15ff70c1 100644
--- a/drivers/pci/msi.c
+++ b/drivers/pci/msi.c
@@ -103,6 +103,16 @@ static void msix_set_enable(struct pci_dev *dev, int enable)
         }
 }
 
+/*
+ * Essentially, this is ((1 << (1 << x)) - 1), but without the
+ * undefinedness of a << 32.
+ */
+static inline __attribute_const__ u32 msi_mask(unsigned x)
+{
+        static const u32 mask[] = { 1, 2, 4, 0xf, 0xff, 0xffff, 0xffffffff };
+        return mask[x];
+}
+
 static void msix_flush_writes(struct irq_desc *desc)
 {
         struct msi_desc *entry;
@@ -407,8 +417,7 @@ static int msi_capability_init(struct pci_dev *dev)
 
                 /* All MSIs are unmasked by default, Mask them all */
                 pci_read_config_dword(dev, base, &maskbits);
-                temp = (1 << multi_msi_capable(control));
-                temp = ((temp - 1) & ~temp);
+                temp = msi_mask((control & PCI_MSI_FLAGS_QMASK) >> 1);
                 maskbits |= temp;
                 pci_write_config_dword(dev, base, maskbits);
                 entry->msi_attrib.maskbits_mask = temp;
diff --git a/drivers/pci/pci-driver.c b/drivers/pci/pci-driver.c
index 9de07b75b99..93eac142358 100644
--- a/drivers/pci/pci-driver.c
+++ b/drivers/pci/pci-driver.c
@@ -355,6 +355,8 @@ static int pci_legacy_suspend(struct device *dev, pm_message_t state)
         int i = 0;
 
         if (drv && drv->suspend) {
+                pci_power_t prev = pci_dev->current_state;
+
                 pci_dev->state_saved = false;
 
                 i = drv->suspend(pci_dev, state);
@@ -365,8 +367,13 @@ static int pci_legacy_suspend(struct device *dev, pm_message_t state)
                 if (pci_dev->state_saved)
                         goto Fixup;
 
-                if (WARN_ON_ONCE(pci_dev->current_state != PCI_D0))
+                if (pci_dev->current_state != PCI_D0
+                    && pci_dev->current_state != PCI_UNKNOWN) {
+                        WARN_ONCE(pci_dev->current_state != prev,
+                                "PCI PM: Device state not saved by %pF\n",
+                                drv->suspend);
                         goto Fixup;
+                }
         }
 
         pci_save_state(pci_dev);
@@ -419,38 +426,24 @@ static int pci_legacy_resume(struct device *dev)
 static void pci_pm_default_resume_noirq(struct pci_dev *pci_dev)
 {
         pci_restore_standard_config(pci_dev);
+        pci_dev->state_saved = false;
         pci_fixup_device(pci_fixup_resume_early, pci_dev);
 }
 
-static int pci_pm_default_resume(struct pci_dev *pci_dev)
+static void pci_pm_default_resume(struct pci_dev *pci_dev)
 {
         pci_fixup_device(pci_fixup_resume, pci_dev);
 
         if (!pci_is_bridge(pci_dev))
                 pci_enable_wake(pci_dev, PCI_D0, false);
-
-        return pci_pm_reenable_device(pci_dev);
-}
-
-static void pci_pm_default_suspend_generic(struct pci_dev *pci_dev)
-{
-        /* If device is enabled at this point, disable it */
-        pci_disable_enabled_device(pci_dev);
-        /*
-         * Save state with interrupts enabled, because in principle the bus the
-         * device is on may be put into a low power state after this code runs.
-         */
-        pci_save_state(pci_dev);
 }
 
 static void pci_pm_default_suspend(struct pci_dev *pci_dev)
 {
-        pci_pm_default_suspend_generic(pci_dev);
-
+        /* Disable non-bridge devices without PM support */
         if (!pci_is_bridge(pci_dev))
-                pci_prepare_to_sleep(pci_dev);
-
-        pci_fixup_device(pci_fixup_suspend, pci_dev);
+                pci_disable_enabled_device(pci_dev);
+        pci_save_state(pci_dev);
 }
 
 static bool pci_has_legacy_pm_support(struct pci_dev *pci_dev)
@@ -495,21 +488,49 @@ static void pci_pm_complete(struct device *dev)
 static int pci_pm_suspend(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
-        int error = 0;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_suspend(dev, PMSG_SUSPEND);
 
-        if (drv && drv->pm && drv->pm->suspend) {
-                error = drv->pm->suspend(dev);
-                suspend_report_result(drv->pm->suspend, error);
+        if (!pm) {
+                pci_pm_default_suspend(pci_dev);
+                goto Fixup;
         }
 
-        if (!error)
-                pci_pm_default_suspend(pci_dev);
+        pci_dev->state_saved = false;
 
-        return error;
+        if (pm->suspend) {
+                pci_power_t prev = pci_dev->current_state;
+                int error;
+
+                error = pm->suspend(dev);
+                suspend_report_result(pm->suspend, error);
+                if (error)
+                        return error;
+
+                if (pci_dev->state_saved)
+                        goto Fixup;
+
+                if (pci_dev->current_state != PCI_D0
+                    && pci_dev->current_state != PCI_UNKNOWN) {
+                        WARN_ONCE(pci_dev->current_state != prev,
+                                "PCI PM: State of device not saved by %pF\n",
+                                pm->suspend);
+                        goto Fixup;
+                }
+        }
+
+        if (!pci_dev->state_saved) {
+                pci_save_state(pci_dev);
+                if (!pci_is_bridge(pci_dev))
+                        pci_prepare_to_sleep(pci_dev);
+        }
+
+ Fixup:
+        pci_fixup_device(pci_fixup_suspend, pci_dev);
+
+        return 0;
 }
 
 static int pci_pm_suspend_noirq(struct device *dev)
@@ -552,18 +573,29 @@ static int pci_pm_resume_noirq(struct device *dev)
 static int pci_pm_resume(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
+        /*
+         * This is necessary for the suspend error path in which resume is
+         * called without restoring the standard config registers of the device.
+         */
+        if (pci_dev->state_saved)
+                pci_restore_standard_config(pci_dev);
+
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume(dev);
 
-        error = pci_pm_default_resume(pci_dev);
+        pci_pm_default_resume(pci_dev);
 
-        if (!error && drv && drv->pm && drv->pm->resume)
-                error = drv->pm->resume(dev);
+        if (pm) {
+                if (pm->resume)
+                        error = pm->resume(dev);
+        } else {
+                pci_pm_reenable_device(pci_dev);
+        }
 
-        return error;
+        return 0;
 }
 
 #else /* !CONFIG_SUSPEND */
@@ -580,21 +612,31 @@ static int pci_pm_resume(struct device *dev)
 static int pci_pm_freeze(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
-        int error = 0;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_suspend(dev, PMSG_FREEZE);
 
-        if (drv && drv->pm && drv->pm->freeze) {
-                error = drv->pm->freeze(dev);
-                suspend_report_result(drv->pm->freeze, error);
+        if (!pm) {
+                pci_pm_default_suspend(pci_dev);
+                return 0;
+        }
+
+        pci_dev->state_saved = false;
+
+        if (pm->freeze) {
+                int error;
+
+                error = pm->freeze(dev);
+                suspend_report_result(pm->freeze, error);
+                if (error)
+                        return error;
         }
 
-        if (!error)
-                pci_pm_default_suspend_generic(pci_dev);
+        if (!pci_dev->state_saved)
+                pci_save_state(pci_dev);
 
-        return error;
+        return 0;
 }
 
 static int pci_pm_freeze_noirq(struct device *dev)
@@ -637,16 +679,18 @@ static int pci_pm_thaw_noirq(struct device *dev)
 static int pci_pm_thaw(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume(dev);
 
-        pci_pm_reenable_device(pci_dev);
-
-        if (drv && drv->pm && drv->pm->thaw)
-                error =  drv->pm->thaw(dev);
+        if (pm) {
+                if (pm->thaw)
+                        error = pm->thaw(dev);
+        } else {
+                pci_pm_reenable_device(pci_dev);
+        }
 
         return error;
 }
@@ -654,19 +698,29 @@ static int pci_pm_thaw(struct device *dev)
 static int pci_pm_poweroff(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_suspend(dev, PMSG_HIBERNATE);
 
-        if (drv && drv->pm && drv->pm->poweroff) {
-                error = drv->pm->poweroff(dev);
-                suspend_report_result(drv->pm->poweroff, error);
+        if (!pm) {
+                pci_pm_default_suspend(pci_dev);
+                goto Fixup;
         }
 
-        if (!error)
-                pci_pm_default_suspend(pci_dev);
+        pci_dev->state_saved = false;
+
+        if (pm->poweroff) {
+                error = pm->poweroff(dev);
+                suspend_report_result(pm->poweroff, error);
+        }
+
+        if (!pci_dev->state_saved && !pci_is_bridge(pci_dev))
+                pci_prepare_to_sleep(pci_dev);
+
+ Fixup:
+        pci_fixup_device(pci_fixup_suspend, pci_dev);
 
         return error;
 }
@@ -707,16 +761,27 @@ static int pci_pm_restore_noirq(struct device *dev)
 static int pci_pm_restore(struct device *dev)
 {
         struct pci_dev *pci_dev = to_pci_dev(dev);
-        struct device_driver *drv = dev->driver;
+        struct dev_pm_ops *pm = dev->driver ? dev->driver->pm : NULL;
         int error = 0;
 
+        /*
+         * This is necessary for the hibernation error path in which restore is
+         * called without restoring the standard config registers of the device.
+         */
+        if (pci_dev->state_saved)
+                pci_restore_standard_config(pci_dev);
+
         if (pci_has_legacy_pm_support(pci_dev))
                 return pci_legacy_resume(dev);
 
-        error = pci_pm_default_resume(pci_dev);
+        pci_pm_default_resume(pci_dev);
 
-        if (!error && drv && drv->pm && drv->pm->restore)
-                error = drv->pm->restore(dev);
+        if (pm) {
+                if (pm->restore)
+                        error = pm->restore(dev);
+        } else {
+                pci_pm_reenable_device(pci_dev);
+        }
 
         return error;
 }
diff --git a/drivers/pci/pci-sysfs.c b/drivers/pci/pci-sysfs.c
index db7ec14fa71..dfc4e0ddf24 100644
--- a/drivers/pci/pci-sysfs.c
+++ b/drivers/pci/pci-sysfs.c
@@ -768,8 +768,8 @@ pci_read_rom(struct kobject *kobj, struct bin_attribute *bin_attr,
                 return -EINVAL;
         
         rom = pci_map_rom(pdev, &size); /* size starts out as PCI window size */
-        if (!rom)
-                return 0;
+        if (!rom || !size)
+                return -EIO;
                 
         if (off >= size)
                 count = 0;
diff --git a/drivers/pci/pci.c b/drivers/pci/pci.c
index 17bd9325a24..e3efe6b19ee 100644
--- a/drivers/pci/pci.c
+++ b/drivers/pci/pci.c
@@ -1393,35 +1393,35 @@ int pci_restore_standard_config(struct pci_dev *dev)
         pci_power_t prev_state;
         int error;
 
-        pci_restore_state(dev);
         pci_update_current_state(dev, PCI_D0);
 
         prev_state = dev->current_state;
         if (prev_state == PCI_D0)
-                return 0;
+                goto Restore;
 
         error = pci_raw_set_power_state(dev, PCI_D0, false);
         if (error)
                 return error;
 
-        if (pci_is_bridge(dev)) {
-                if (prev_state > PCI_D1)
-                        mdelay(PCI_PM_BUS_WAIT);
-        } else {
-                switch(prev_state) {
-                case PCI_D3cold:
-                case PCI_D3hot:
-                        mdelay(pci_pm_d3_delay);
-                        break;
-                case PCI_D2:
-                        udelay(PCI_PM_D2_DELAY);
-                        break;
-                }
+        /*
+         * This assumes that we won't get a bus in B2 or B3 from the BIOS, but
+         * we've made this assumption forever and it appears to be universally
+         * satisfied.
+         */
+        switch(prev_state) {
+        case PCI_D3cold:
+        case PCI_D3hot:
+                mdelay(pci_pm_d3_delay);
+                break;
+        case PCI_D2:
+                udelay(PCI_PM_D2_DELAY);
+                break;
         }
 
-        dev->current_state = PCI_D0;
+        pci_update_current_state(dev, PCI_D0);
 
-        return 0;
+ Restore:
+        return dev->state_saved ? pci_restore_state(dev) : 0;
 }
 
 /**
diff --git a/drivers/pci/pcie/aspm.c b/drivers/pci/pcie/aspm.c
index 586b6f75910..b0367f168af 100644
--- a/drivers/pci/pcie/aspm.c
+++ b/drivers/pci/pcie/aspm.c
@@ -718,9 +718,9 @@ void pcie_aspm_exit_link_state(struct pci_dev *pdev)
 
         /*
          * All PCIe functions are in one slot, remove one function will remove
-         * the the whole slot, so just wait
+         * the whole slot, so just wait until we are the last function left.
          */
-        if (!list_empty(&parent->subordinate->devices))
+        if (!list_is_last(&pdev->bus_list, &parent->subordinate->devices))
                 goto out;
 
         /* All functions are removed, so just disable ASPM for the link */
diff --git a/drivers/pci/pcie/portdrv_pci.c b/drivers/pci/pcie/portdrv_pci.c
index 99a914a027f..f9b874eaeb9 100644
--- a/drivers/pci/pcie/portdrv_pci.c
+++ b/drivers/pci/pcie/portdrv_pci.c
@@ -55,25 +55,13 @@ static int pcie_portdrv_suspend(struct pci_dev *dev, pm_message_t state)
 
 }
 
-static int pcie_portdrv_suspend_late(struct pci_dev *dev, pm_message_t state)
-{
-        return pci_save_state(dev);
-}
-
-static int pcie_portdrv_resume_early(struct pci_dev *dev)
-{
-        return pci_restore_state(dev);
-}
-
 static int pcie_portdrv_resume(struct pci_dev *dev)
 {
-        pcie_portdrv_restore_config(dev);
+        pci_set_master(dev);
         return pcie_port_device_resume(dev);
 }
 #else
 #define pcie_portdrv_suspend NULL
-#define pcie_portdrv_suspend_late NULL
-#define pcie_portdrv_resume_early NULL
 #define pcie_portdrv_resume NULL
 #endif
 
@@ -292,8 +280,6 @@ static struct pci_driver pcie_portdriver = {
         .remove         = pcie_portdrv_remove,
 
         .suspend        = pcie_portdrv_suspend,
-        .suspend_late   = pcie_portdrv_suspend_late,
-        .resume_early   = pcie_portdrv_resume_early,
         .resume         = pcie_portdrv_resume,
 
         .err_handler    = &pcie_portdrv_err_handler,
diff --git a/drivers/pci/rom.c b/drivers/pci/rom.c
index 132a78159b6..29cbe47f219 100644
--- a/drivers/pci/rom.c
+++ b/drivers/pci/rom.c
@@ -63,7 +63,7 @@ void pci_disable_rom(struct pci_dev *pdev)
  * The PCI window size could be much larger than the
  * actual image size.
  */
-size_t pci_get_rom_size(void __iomem *rom, size_t size)
+size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size)
 {
         void __iomem *image;
         int last_image;
@@ -72,8 +72,10 @@ size_t pci_get_rom_size(void __iomem *rom, size_t size)
         do {
                 void __iomem *pds;
                 /* Standard PCI ROMs start out with these bytes 55 AA */
-                if (readb(image) != 0x55)
+                if (readb(image) != 0x55) {
+                        dev_err(&pdev->dev, "Invalid ROM contents\n");
                         break;
+                }
                 if (readb(image + 1) != 0xAA)
                         break;
                 /* get the PCI data structure and check its signature */
@@ -159,7 +161,7 @@ void __iomem *pci_map_rom(struct pci_dev *pdev, size_t *size)
          * size is much larger than the actual size of the ROM.
          * True size is important if the ROM is going to be copied.
          */
-        *size = pci_get_rom_size(rom, *size);
+        *size = pci_get_rom_size(pdev, rom, *size);
         return rom;
 }
 
diff --git a/drivers/platform/x86/Kconfig b/drivers/platform/x86/Kconfig
index 1a266d4ab5f..94363115a42 100644
--- a/drivers/platform/x86/Kconfig
+++ b/drivers/platform/x86/Kconfig
@@ -42,6 +42,7 @@ config ASUS_LAPTOP
         depends on LEDS_CLASS
         depends on NEW_LEDS
         depends on BACKLIGHT_CLASS_DEVICE
+        depends on INPUT
         ---help---
           This is the new Linux driver for Asus laptops. It may also support some
           MEDION, JVC or VICTOR laptops. It makes all the extra buttons generate
diff --git a/drivers/platform/x86/asus-laptop.c b/drivers/platform/x86/asus-laptop.c
index 8fb8b359104..56af6cf385b 100644
--- a/drivers/platform/x86/asus-laptop.c
+++ b/drivers/platform/x86/asus-laptop.c
@@ -46,6 +46,7 @@
 #include <acpi/acpi_drivers.h>
 #include <acpi/acpi_bus.h>
 #include <asm/uaccess.h>
+#include <linux/input.h>
 
 #define ASUS_LAPTOP_VERSION "0.42"
 
@@ -181,6 +182,8 @@ struct asus_hotk {
         u8 light_level;         //light sensor level
         u8 light_switch;        //light sensor switch value
         u16 event_count[128];   //count for each event TODO make this better
+        struct input_dev *inputdev;
+        u16 *keycode_map;
 };
 
 /*
@@ -250,6 +253,37 @@ ASUS_LED(rled, "record");
 ASUS_LED(pled, "phone");
 ASUS_LED(gled, "gaming");
 
+struct key_entry {
+        char type;
+        u8 code;
+        u16 keycode;
+};
+
+enum { KE_KEY, KE_END };
+
+static struct key_entry asus_keymap[] = {
+        {KE_KEY, 0x30, KEY_VOLUMEUP},
+        {KE_KEY, 0x31, KEY_VOLUMEDOWN},
+        {KE_KEY, 0x32, KEY_MUTE},
+        {KE_KEY, 0x33, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x34, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x40, KEY_PREVIOUSSONG},
+        {KE_KEY, 0x41, KEY_NEXTSONG},
+        {KE_KEY, 0x43, KEY_STOP},
+        {KE_KEY, 0x45, KEY_PLAYPAUSE},
+        {KE_KEY, 0x50, KEY_EMAIL},
+        {KE_KEY, 0x51, KEY_WWW},
+        {KE_KEY, 0x5C, BTN_EXTRA},  /* Performance */
+        {KE_KEY, 0x5D, KEY_WLAN},
+        {KE_KEY, 0x61, KEY_SWITCHVIDEOMODE},
+        {KE_KEY, 0x6B, BTN_TOUCH}, /* Lock Mouse */
+        {KE_KEY, 0x82, KEY_CAMERA},
+        {KE_KEY, 0x8A, KEY_TV},
+        {KE_KEY, 0x95, KEY_MEDIA},
+        {KE_KEY, 0x99, KEY_PHONE},
+        {KE_END, 0},
+};
+
 /*
  * This function evaluates an ACPI method, given an int as parameter, the
  * method is searched within the scope of the handle, can be NULL. The output
@@ -720,8 +754,68 @@ static ssize_t store_gps(struct device *dev, struct device_attribute *attr,
         return store_status(buf, count, NULL, GPS_ON);
 }
 
+/*
+ * Hotkey functions
+ */
+static struct key_entry *asus_get_entry_by_scancode(int code)
+{
+        struct key_entry *key;
+
+        for (key = asus_keymap; key->type != KE_END; key++)
+                if (code == key->code)
+                        return key;
+
+        return NULL;
+}
+
+static struct key_entry *asus_get_entry_by_keycode(int code)
+{
+        struct key_entry *key;
+
+        for (key = asus_keymap; key->type != KE_END; key++)
+                if (code == key->keycode && key->type == KE_KEY)
+                        return key;
+
+        return NULL;
+}
+
+static int asus_getkeycode(struct input_dev *dev, int scancode, int *keycode)
+{
+        struct key_entry *key = asus_get_entry_by_scancode(scancode);
+
+        if (key && key->type == KE_KEY) {
+                *keycode = key->keycode;
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
+static int asus_setkeycode(struct input_dev *dev, int scancode, int keycode)
+{
+        struct key_entry *key;
+        int old_keycode;
+
+        if (keycode < 0 || keycode > KEY_MAX)
+                return -EINVAL;
+
+        key = asus_get_entry_by_scancode(scancode);
+        if (key && key->type == KE_KEY) {
+                old_keycode = key->keycode;
+                key->keycode = keycode;
+                set_bit(keycode, dev->keybit);
+                if (!asus_get_entry_by_keycode(old_keycode))
+                        clear_bit(old_keycode, dev->keybit);
+                return 0;
+        }
+
+        return -EINVAL;
+}
+
 static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
 {
+        static struct key_entry *key;
+
         /* TODO Find a better way to handle events count. */
         if (!hotk)
                 return;
@@ -738,10 +832,24 @@ static void asus_hotk_notify(acpi_handle handle, u32 event, void *data)
                 lcd_blank(FB_BLANK_POWERDOWN);
         }
 
-        acpi_bus_generate_proc_event(hotk->device, event,
-                                hotk->event_count[event % 128]++);
-
-        return;
+        acpi_bus_generate_netlink_event(hotk->device->pnp.device_class,
+                                        dev_name(&hotk->device->dev), event,
+                                        hotk->event_count[event % 128]++);
+
+        if (hotk->inputdev) {
+                key = asus_get_entry_by_scancode(event);
+                if (!key)
+                        return ;
+
+                switch (key->type) {
+                case KE_KEY:
+                        input_report_key(hotk->inputdev, key->keycode, 1);
+                        input_sync(hotk->inputdev);
+                        input_report_key(hotk->inputdev, key->keycode, 0);
+                        input_sync(hotk->inputdev);
+                        break;
+                }
+        }
 }
 
 #define ASUS_CREATE_DEVICE_ATTR(_name)                                  \
@@ -959,6 +1067,38 @@ static int asus_hotk_get_info(void)
         return AE_OK;
 }
 
+static int asus_input_init(void)
+{
+        const struct key_entry *key;
+        int result;
+
+        hotk->inputdev = input_allocate_device();
+        if (!hotk->inputdev) {
+                printk(ASUS_INFO "Unable to allocate input device\n");
+                return 0;
+        }
+        hotk->inputdev->name = "Asus Laptop extra buttons";
+        hotk->inputdev->phys = ASUS_HOTK_FILE "/input0";
+        hotk->inputdev->id.bustype = BUS_HOST;
+        hotk->inputdev->getkeycode = asus_getkeycode;
+        hotk->inputdev->setkeycode = asus_setkeycode;
+
+        for (key = asus_keymap; key->type != KE_END; key++) {
+                switch (key->type) {
+                case KE_KEY:
+                        set_bit(EV_KEY, hotk->inputdev->evbit);
+                        set_bit(key->keycode, hotk->inputdev->keybit);
+                        break;
+                }
+        }
+        result = input_register_device(hotk->inputdev);
+        if (result) {
+                printk(ASUS_INFO "Unable to register input device\n");
+                input_free_device(hotk->inputdev);
+        }
+        return result;
+}
+
 static int asus_hotk_check(void)
 {
         int result = 0;
@@ -1044,7 +1184,7 @@ static int asus_hotk_add(struct acpi_device *device)
         /* GPS is on by default */
         write_status(NULL, 1, GPS_ON);
 
-      end:
+end:
         if (result) {
                 kfree(hotk->name);
                 kfree(hotk);
@@ -1091,10 +1231,17 @@ static void asus_led_exit(void)
         ASUS_LED_UNREGISTER(gled);
 }
 
+static void asus_input_exit(void)
+{
+        if (hotk->inputdev)
+                input_unregister_device(hotk->inputdev);
+}
+
 static void __exit asus_laptop_exit(void)
 {
         asus_backlight_exit();
         asus_led_exit();
+        asus_input_exit();
 
         acpi_bus_unregister_driver(&asus_hotk_driver);
         sysfs_remove_group(&asuspf_device->dev.kobj, &asuspf_attribute_group);
@@ -1216,6 +1363,10 @@ static int __init asus_laptop_init(void)
                 printk(ASUS_INFO "Brightness ignored, must be controlled by "
                        "ACPI video driver\n");
 
+        result = asus_input_init();
+        if (result)
+                goto fail_input;
+
         result = asus_led_init(dev);
         if (result)
                 goto fail_led;
@@ -1242,22 +1393,25 @@ static int __init asus_laptop_init(void)
 
         return 0;
 
-      fail_sysfs:
+fail_sysfs:
         platform_device_del(asuspf_device);
 
-      fail_platform_device2:
+fail_platform_device2:
         platform_device_put(asuspf_device);
 
-      fail_platform_device1:
+fail_platform_device1:
         platform_driver_unregister(&asuspf_driver);
 
-      fail_platform_driver:
+fail_platform_driver:
         asus_led_exit();
 
-      fail_led:
+fail_led:
+        asus_input_exit();
+
+fail_input:
         asus_backlight_exit();
 
-      fail_backlight:
+fail_backlight:
 
         return result;
 }
diff --git a/drivers/platform/x86/asus_acpi.c b/drivers/platform/x86/asus_acpi.c
index 1e74988c7b2..d63f26e666a 100644
--- a/drivers/platform/x86/asus_acpi.c
+++ b/drivers/platform/x86/asus_acpi.c
@@ -143,6 +143,7 @@ struct asus_hotk {
                                                          S1300N, S5200N*/
                 A4S,            /* Z81sp */
                 F3Sa,           /* (Centrino) */
+                R1F,
                 END_MODEL
         } model;                /* Models currently supported */
         u16 event_count[128];   /* Count for each event TODO make this better */
@@ -420,7 +421,18 @@ static struct model_data model_conf[END_MODEL] = {
                 .display_get    = "\\ADVG",
                 .display_set    = "SDSP",
         },
-
+        {
+                .name = "R1F",
+                .mt_bt_switch = "BLED",
+                .mt_mled = "MLED",
+                .mt_wled = "WLED",
+                .mt_lcd_switch = "\\Q10",
+                .lcd_status = "\\GP06",
+                .brightness_set = "SPLV",
+                .brightness_get = "GPLV",
+                .display_set = "SDSP",
+                .display_get = "\\INFB"
+        }
 };
 
 /* procdir we use */
@@ -1165,6 +1177,8 @@ static int asus_model_match(char *model)
                 return W3V;
         else if (strncmp(model, "W5A", 3) == 0)
                 return W5A;
+        else if (strncmp(model, "R1F", 3) == 0)
+                return R1F;
         else if (strncmp(model, "A4S", 3) == 0)
                 return A4S;
         else if (strncmp(model, "F3Sa", 4) == 0)
diff --git a/drivers/platform/x86/eeepc-laptop.c b/drivers/platform/x86/eeepc-laptop.c
index 9d93cb971e5..786ed8661cb 100644
--- a/drivers/platform/x86/eeepc-laptop.c
+++ b/drivers/platform/x86/eeepc-laptop.c
@@ -30,6 +30,7 @@
 #include <linux/uaccess.h>
 #include <linux/input.h>
 #include <linux/rfkill.h>
+#include <linux/pci.h>
 
 #define EEEPC_LAPTOP_VERSION    "0.1"
 
@@ -161,6 +162,10 @@ static struct key_entry eeepc_keymap[] = {
         {KE_KEY, 0x13, KEY_MUTE },
         {KE_KEY, 0x14, KEY_VOLUMEDOWN },
         {KE_KEY, 0x15, KEY_VOLUMEUP },
+        {KE_KEY, 0x1a, KEY_COFFEE },
+        {KE_KEY, 0x1b, KEY_ZOOM },
+        {KE_KEY, 0x1c, KEY_PROG2 },
+        {KE_KEY, 0x1d, KEY_PROG3 },
         {KE_KEY, 0x30, KEY_SWITCHVIDEOMODE },
         {KE_KEY, 0x31, KEY_SWITCHVIDEOMODE },
         {KE_KEY, 0x32, KEY_SWITCHVIDEOMODE },
@@ -510,7 +515,43 @@ static int eeepc_hotk_check(void)
 static void notify_brn(void)
 {
         struct backlight_device *bd = eeepc_backlight_device;
-        bd->props.brightness = read_brightness(bd);
+        if (bd)
+                bd->props.brightness = read_brightness(bd);
+}
+
+static void eeepc_rfkill_notify(acpi_handle handle, u32 event, void *data)
+{
+        struct pci_dev *dev;
+        struct pci_bus *bus = pci_find_bus(0, 1);
+
+        if (event != ACPI_NOTIFY_BUS_CHECK)
+                return;
+
+        if (!bus) {
+                printk(EEEPC_WARNING "Unable to find PCI bus 1?\n");
+                return;
+        }
+
+        if (get_acpi(CM_ASL_WLAN) == 1) {
+                dev = pci_get_slot(bus, 0);
+                if (dev) {
+                        /* Device already present */
+                        pci_dev_put(dev);
+                        return;
+                }
+                dev = pci_scan_single_device(bus, 0);
+                if (dev) {
+                        pci_bus_assign_resources(bus);
+                        if (pci_bus_add_device(dev))
+                                printk(EEEPC_ERR "Unable to hotplug wifi\n");
+                }
+        } else {
+                dev = pci_get_slot(bus, 0);
+                if (dev) {
+                        pci_remove_bus_device(dev);
+                        pci_dev_put(dev);
+                }
+        }
 }
 
 static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
@@ -520,8 +561,9 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
                 return;
         if (event >= NOTIFY_BRN_MIN && event <= NOTIFY_BRN_MAX)
                 notify_brn();
-        acpi_bus_generate_proc_event(ehotk->device, event,
-                                     ehotk->event_count[event % 128]++);
+        acpi_bus_generate_netlink_event(ehotk->device->pnp.device_class,
+                                        dev_name(&ehotk->device->dev), event,
+                                        ehotk->event_count[event % 128]++);
         if (ehotk->inputdev) {
                 key = eepc_get_entry_by_scancode(event);
                 if (key) {
@@ -539,6 +581,45 @@ static void eeepc_hotk_notify(acpi_handle handle, u32 event, void *data)
         }
 }
 
+static int eeepc_register_rfkill_notifier(char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, node, &handle);
+
+        if (ACPI_SUCCESS(status)) {
+                status = acpi_install_notify_handler(handle,
+                                                     ACPI_SYSTEM_NOTIFY,
+                                                     eeepc_rfkill_notify,
+                                                     NULL);
+                if (ACPI_FAILURE(status))
+                        printk(EEEPC_WARNING
+                               "Failed to register notify on %s\n", node);
+        } else
+                return -ENODEV;
+
+        return 0;
+}
+
+static void eeepc_unregister_rfkill_notifier(char *node)
+{
+        acpi_status status = AE_OK;
+        acpi_handle handle;
+
+        status = acpi_get_handle(NULL, node, &handle);
+
+        if (ACPI_SUCCESS(status)) {
+                status = acpi_remove_notify_handler(handle,
+                                                     ACPI_SYSTEM_NOTIFY,
+                                                     eeepc_rfkill_notify);
+                if (ACPI_FAILURE(status))
+                        printk(EEEPC_ERR
+                               "Error removing rfkill notify handler %s\n",
+                                node);
+        }
+}
+
 static int eeepc_hotk_add(struct acpi_device *device)
 {
         acpi_status status = AE_OK;
@@ -558,7 +639,7 @@ static int eeepc_hotk_add(struct acpi_device *device)
         ehotk->device = device;
         result = eeepc_hotk_check();
         if (result)
-                goto end;
+                goto ehotk_fail;
         status = acpi_install_notify_handler(ehotk->handle, ACPI_SYSTEM_NOTIFY,
                                              eeepc_hotk_notify, ehotk);
         if (ACPI_FAILURE(status))
@@ -569,18 +650,25 @@ static int eeepc_hotk_add(struct acpi_device *device)
                                                            RFKILL_TYPE_WLAN);
 
                 if (!ehotk->eeepc_wlan_rfkill)
-                        goto end;
+                        goto wlan_fail;
 
                 ehotk->eeepc_wlan_rfkill->name = "eeepc-wlan";
                 ehotk->eeepc_wlan_rfkill->toggle_radio = eeepc_wlan_rfkill_set;
                 ehotk->eeepc_wlan_rfkill->get_state = eeepc_wlan_rfkill_state;
-                if (get_acpi(CM_ASL_WLAN) == 1)
+                if (get_acpi(CM_ASL_WLAN) == 1) {
                         ehotk->eeepc_wlan_rfkill->state =
                                 RFKILL_STATE_UNBLOCKED;
-                else
+                        rfkill_set_default(RFKILL_TYPE_WLAN,
+                                           RFKILL_STATE_UNBLOCKED);
+                } else {
                         ehotk->eeepc_wlan_rfkill->state =
                                 RFKILL_STATE_SOFT_BLOCKED;
-                rfkill_register(ehotk->eeepc_wlan_rfkill);
+                        rfkill_set_default(RFKILL_TYPE_WLAN,
+                                           RFKILL_STATE_SOFT_BLOCKED);
+                }
+                result = rfkill_register(ehotk->eeepc_wlan_rfkill);
+                if (result)
+                        goto wlan_fail;
         }
 
         if (get_acpi(CM_ASL_BLUETOOTH) != -1) {
@@ -588,27 +676,47 @@ static int eeepc_hotk_add(struct acpi_device *device)
                         rfkill_allocate(&device->dev, RFKILL_TYPE_BLUETOOTH);
 
                 if (!ehotk->eeepc_bluetooth_rfkill)
-                        goto end;
+                        goto bluetooth_fail;
 
                 ehotk->eeepc_bluetooth_rfkill->name = "eeepc-bluetooth";
                 ehotk->eeepc_bluetooth_rfkill->toggle_radio =
                         eeepc_bluetooth_rfkill_set;
                 ehotk->eeepc_bluetooth_rfkill->get_state =
                         eeepc_bluetooth_rfkill_state;
-                if (get_acpi(CM_ASL_BLUETOOTH) == 1)
+                if (get_acpi(CM_ASL_BLUETOOTH) == 1) {
                         ehotk->eeepc_bluetooth_rfkill->state =
                                 RFKILL_STATE_UNBLOCKED;
-                else
+                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
+                                           RFKILL_STATE_UNBLOCKED);
+                } else {
                         ehotk->eeepc_bluetooth_rfkill->state =
                                 RFKILL_STATE_SOFT_BLOCKED;
-                rfkill_register(ehotk->eeepc_bluetooth_rfkill);
-        }
+                        rfkill_set_default(RFKILL_TYPE_BLUETOOTH,
+                                           RFKILL_STATE_SOFT_BLOCKED);
+                }
 
- end:
-        if (result) {
-                kfree(ehotk);
-                ehotk = NULL;
+                result = rfkill_register(ehotk->eeepc_bluetooth_rfkill);
+                if (result)
+                        goto bluetooth_fail;
         }
+
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_register_rfkill_notifier("\\_SB.PCI0.P0P7");
+
+        return 0;
+
+ bluetooth_fail:
+        if (ehotk->eeepc_bluetooth_rfkill)
+                rfkill_free(ehotk->eeepc_bluetooth_rfkill);
+        rfkill_unregister(ehotk->eeepc_wlan_rfkill);
+        ehotk->eeepc_wlan_rfkill = NULL;
+ wlan_fail:
+        if (ehotk->eeepc_wlan_rfkill)
+                rfkill_free(ehotk->eeepc_wlan_rfkill);
+ ehotk_fail:
+        kfree(ehotk);
+        ehotk = NULL;
+
         return result;
 }
 
@@ -622,6 +730,10 @@ static int eeepc_hotk_remove(struct acpi_device *device, int type)
                                             eeepc_hotk_notify);
         if (ACPI_FAILURE(status))
                 printk(EEEPC_ERR "Error removing notify handler\n");
+
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P6");
+        eeepc_unregister_rfkill_notifier("\\_SB.PCI0.P0P7");
+
         kfree(ehotk);
         return 0;
 }
@@ -737,13 +849,21 @@ static void eeepc_backlight_exit(void)
 {
         if (eeepc_backlight_device)
                 backlight_device_unregister(eeepc_backlight_device);
-        if (ehotk->inputdev)
-                input_unregister_device(ehotk->inputdev);
+        eeepc_backlight_device = NULL;
+}
+
+static void eeepc_rfkill_exit(void)
+{
         if (ehotk->eeepc_wlan_rfkill)
                 rfkill_unregister(ehotk->eeepc_wlan_rfkill);
         if (ehotk->eeepc_bluetooth_rfkill)
                 rfkill_unregister(ehotk->eeepc_bluetooth_rfkill);
-        eeepc_backlight_device = NULL;
+}
+
+static void eeepc_input_exit(void)
+{
+        if (ehotk->inputdev)
+                input_unregister_device(ehotk->inputdev);
 }
 
 static void eeepc_hwmon_exit(void)
@@ -762,6 +882,8 @@ static void eeepc_hwmon_exit(void)
 static void __exit eeepc_laptop_exit(void)
 {
         eeepc_backlight_exit();
+        eeepc_rfkill_exit();
+        eeepc_input_exit();
         eeepc_hwmon_exit();
         acpi_bus_unregister_driver(&eeepc_hotk_driver);
         sysfs_remove_group(&platform_device->dev.kobj,
@@ -865,6 +987,8 @@ fail_platform_driver:
 fail_hwmon:
         eeepc_backlight_exit();
 fail_backlight:
+        eeepc_input_exit();
+        eeepc_rfkill_exit();
         return result;
 }
 
diff --git a/drivers/platform/x86/hp-wmi.c b/drivers/platform/x86/hp-wmi.c
index de91ddab0a8..f41135f2fb2 100644
--- a/drivers/platform/x86/hp-wmi.c
+++ b/drivers/platform/x86/hp-wmi.c
@@ -463,9 +463,11 @@ static int __init hp_wmi_bios_setup(struct platform_device *device)
 
         return 0;
 register_wwan_err:
-        rfkill_unregister(bluetooth_rfkill);
+        if (bluetooth_rfkill)
+                rfkill_unregister(bluetooth_rfkill);
 register_bluetooth_error:
-        rfkill_unregister(wifi_rfkill);
+        if (wifi_rfkill)
+                rfkill_unregister(wifi_rfkill);
 add_sysfs_error:
         cleanup_sysfs(device);
         return err;
diff --git a/drivers/platform/x86/panasonic-laptop.c b/drivers/platform/x86/panasonic-laptop.c
index f30db367c82..c47a44dcb70 100644
--- a/drivers/platform/x86/panasonic-laptop.c
+++ b/drivers/platform/x86/panasonic-laptop.c
@@ -507,7 +507,7 @@ static void acpi_pcc_generate_keyinput(struct pcc_acpi *pcc)
 
         hkey_num = result & 0xf;
 
-        if (hkey_num < 0 || hkey_num > ARRAY_SIZE(pcc->keymap)) {
+        if (hkey_num < 0 || hkey_num >= ARRAY_SIZE(pcc->keymap)) {
                 ACPI_DEBUG_PRINT((ACPI_DB_ERROR,
                                   "hotkey number out of range: %d\n",
                                   hkey_num));
diff --git a/drivers/power/pcf50633-charger.c b/drivers/power/pcf50633-charger.c
index e988ec130fc..41aec2acbb9 100644
--- a/drivers/power/pcf50633-charger.c
+++ b/drivers/power/pcf50633-charger.c
@@ -199,7 +199,8 @@ static int adapter_get_property(struct power_supply *psy,
                         enum power_supply_property psp,
                         union power_supply_propval *val)
 {
-        struct pcf50633_mbc *mbc = container_of(psy, struct pcf50633_mbc, usb);
+        struct pcf50633_mbc *mbc = container_of(psy,
+                                struct pcf50633_mbc, adapter);
         int ret = 0;
 
         switch (psp) {
diff --git a/drivers/regulator/bq24022.c b/drivers/regulator/bq24022.c
index 366565aba86..c175e38a4cd 100644
--- a/drivers/regulator/bq24022.c
+++ b/drivers/regulator/bq24022.c
@@ -152,11 +152,7 @@ static void __exit bq24022_exit(void)
         platform_driver_unregister(&bq24022_driver);
 }
 
-/*
- * make sure this is probed before gpio_vbus and pda_power,
- * but after asic3 or other GPIO expander drivers.
- */
-subsys_initcall(bq24022_init);
+module_init(bq24022_init);
 module_exit(bq24022_exit);
 
 MODULE_AUTHOR("Philipp Zabel");
diff --git a/drivers/regulator/wm8350-regulator.c b/drivers/regulator/wm8350-regulator.c
index 7aa35248181..5056e23e441 100644
--- a/drivers/regulator/wm8350-regulator.c
+++ b/drivers/regulator/wm8350-regulator.c
@@ -1435,7 +1435,7 @@ int wm8350_register_led(struct wm8350 *wm8350, int lednum, int dcdc, int isink,
         struct platform_device *pdev;
         int ret;
 
-        if (lednum > ARRAY_SIZE(wm8350->pmic.led) || lednum < 0) {
+        if (lednum >= ARRAY_SIZE(wm8350->pmic.led) || lednum < 0) {
                 dev_err(wm8350->dev, "Invalid LED index %d\n", lednum);
                 return -ENODEV;
         }
diff --git a/drivers/rtc/Kconfig b/drivers/rtc/Kconfig
index cced4d10831..81450fbd8b1 100644
--- a/drivers/rtc/Kconfig
+++ b/drivers/rtc/Kconfig
@@ -241,6 +241,12 @@ config RTC_DRV_M41T80_WDT
           If you say Y here you will get support for the
           watchdog timer in the ST M41T60 and M41T80 RTC chips series.
 
+config RTC_DRV_DM355EVM
+        tristate "TI DaVinci DM355 EVM RTC"
+        depends on MFD_DM355EVM_MSP
+        help
+          Supports the RTC firmware in the MSP430 on the DM355 EVM.
+
 config RTC_DRV_TWL92330
         boolean "TI TWL92330/Menelaus"
         depends on MENELAUS
diff --git a/drivers/rtc/Makefile b/drivers/rtc/Makefile
index 6e28021abb9..0e697aa51ca 100644
--- a/drivers/rtc/Makefile
+++ b/drivers/rtc/Makefile
@@ -23,6 +23,7 @@ obj-$(CONFIG_RTC_DRV_AT91SAM9)	+= rtc-at91sam9.o
 obj-$(CONFIG_RTC_DRV_AU1XXX)    += rtc-au1xxx.o
 obj-$(CONFIG_RTC_DRV_BFIN)      += rtc-bfin.o
 obj-$(CONFIG_RTC_DRV_CMOS)      += rtc-cmos.o
+obj-$(CONFIG_RTC_DRV_DM355EVM)  += rtc-dm355evm.o
 obj-$(CONFIG_RTC_DRV_DS1216)    += rtc-ds1216.o
 obj-$(CONFIG_RTC_DRV_DS1286)    += rtc-ds1286.o
 obj-$(CONFIG_RTC_DRV_DS1302)    += rtc-ds1302.o
diff --git a/drivers/rtc/rtc-au1xxx.c b/drivers/rtc/rtc-au1xxx.c
index 8906a688e6a..979ed0406ce 100644
--- a/drivers/rtc/rtc-au1xxx.c
+++ b/drivers/rtc/rtc-au1xxx.c
@@ -81,7 +81,7 @@ static int __devinit au1xtoy_rtc_probe(struct platform_device *pdev)
         if (au_readl(SYS_TOYTRIM) != 32767) {
                 /* wait until hardware gives access to TRIM register */
                 t = 0x00100000;
-                while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_T0S) && t--)
+                while ((au_readl(SYS_COUNTER_CNTRL) & SYS_CNTRL_T0S) && --t)
                         msleep(1);
 
                 if (!t) {
diff --git a/drivers/rtc/rtc-dm355evm.c b/drivers/rtc/rtc-dm355evm.c
new file mode 100644
index 00000000000..58d4e18530d
--- /dev/null
+++ b/drivers/rtc/rtc-dm355evm.c
@@ -0,0 +1,175 @@
+/*
+ * rtc-dm355evm.c - access battery-backed counter in MSP430 firmware
+ *
+ * Copyright (c) 2008 by David Brownell
+ *
+ * This program is free software; you can redistribute it and/or
+ * modify it under the terms of the GNU General Public License
+ * as published by the Free Software Foundation; either version
+ * 2 of the License, or (at your option) any later version.
+ */
+#include <linux/kernel.h>
+#include <linux/init.h>
+#include <linux/rtc.h>
+#include <linux/platform_device.h>
+
+#include <linux/i2c/dm355evm_msp.h>
+
+
+/*
+ * The MSP430 firmware on the DM355 EVM uses a watch crystal to feed
+ * a 1 Hz counter.  When a backup battery is supplied, that makes a
+ * reasonable RTC for applications where alarms and non-NTP drift
+ * compensation aren't important.
+ *
+ * The only real glitch is the inability to read or write all four
+ * counter bytes atomically:  the count may increment in the middle
+ * of an operation, causing trouble when the LSB rolls over.
+ *
+ * This driver was tested with firmware revision A4.
+ */
+union evm_time {
+        u8      bytes[4];
+        u32     value;
+};
+
+static int dm355evm_rtc_read_time(struct device *dev, struct rtc_time *tm)
+{
+        union evm_time  time;
+        int             status;
+        int             tries = 0;
+
+        do {
+                /*
+                 * Read LSB(0) to MSB(3) bytes.  Defend against the counter
+                 * rolling over by re-reading until the value is stable,
+                 * and assuming the four reads take at most a few seconds.
+                 */
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_0);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[0] == status)
+                        break;
+                time.bytes[0] = status;
+
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_1);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[1] == status)
+                        break;
+                time.bytes[1] = status;
+
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_2);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[2] == status)
+                        break;
+                time.bytes[2] = status;
+
+                status = dm355evm_msp_read(DM355EVM_MSP_RTC_3);
+                if (status < 0)
+                        return status;
+                if (tries && time.bytes[3] == status)
+                        break;
+                time.bytes[3] = status;
+
+        } while (++tries < 5);
+
+        dev_dbg(dev, "read timestamp %08x\n", time.value);
+
+        rtc_time_to_tm(le32_to_cpu(time.value), tm);
+        return 0;
+}
+
+static int dm355evm_rtc_set_time(struct device *dev, struct rtc_time *tm)
+{
+        union evm_time  time;
+        unsigned long   value;
+        int             status;
+
+        rtc_tm_to_time(tm, &value);
+        time.value = cpu_to_le32(value);
+
+        dev_dbg(dev, "write timestamp %08x\n", time.value);
+
+        /*
+         * REVISIT handle non-atomic writes ... maybe just retry until
+         * byte[1] sticks (no rollover)?
+         */
+        status = dm355evm_msp_write(time.bytes[0], DM355EVM_MSP_RTC_0);
+        if (status < 0)
+                return status;
+
+        status = dm355evm_msp_write(time.bytes[1], DM355EVM_MSP_RTC_1);
+        if (status < 0)
+                return status;
+
+        status = dm355evm_msp_write(time.bytes[2], DM355EVM_MSP_RTC_2);
+        if (status < 0)
+                return status;
+
+        status = dm355evm_msp_write(time.bytes[3], DM355EVM_MSP_RTC_3);
+        if (status < 0)
+                return status;
+
+        return 0;
+}
+
+static struct rtc_class_ops dm355evm_rtc_ops = {
+        .read_time      = dm355evm_rtc_read_time,
+        .set_time       = dm355evm_rtc_set_time,
+};
+
+/*----------------------------------------------------------------------*/
+
+static int __devinit dm355evm_rtc_probe(struct platform_device *pdev)
+{
+        struct rtc_device *rtc;
+
+        rtc = rtc_device_register(pdev->name,
+                                  &pdev->dev, &dm355evm_rtc_ops, THIS_MODULE);
+        if (IS_ERR(rtc)) {
+                dev_err(&pdev->dev, "can't register RTC device, err %ld\n",
+                        PTR_ERR(rtc));
+                return PTR_ERR(rtc);
+        }
+        platform_set_drvdata(pdev, rtc);
+
+        return 0;
+}
+
+static int __devexit dm355evm_rtc_remove(struct platform_device *pdev)
+{
+        struct rtc_device *rtc = platform_get_drvdata(pdev);
+
+        rtc_device_unregister(rtc);
+        platform_set_drvdata(pdev, NULL);
+        return 0;
+}
+
+/*
+ * I2C is used to talk to the MSP430, but this platform device is
+ * exposed by an MFD driver that manages I2C communications.
+ */
+static struct platform_driver rtc_dm355evm_driver = {
+        .probe          = dm355evm_rtc_probe,
+        .remove         = __devexit_p(dm355evm_rtc_remove),
+        .driver         = {
+                .owner  = THIS_MODULE,
+                .name   = "rtc-dm355evm",
+        },
+};
+
+static int __init dm355evm_rtc_init(void)
+{
+        return platform_driver_register(&rtc_dm355evm_driver);
+}
+module_init(dm355evm_rtc_init);
+
+static void __exit dm355evm_rtc_exit(void)
+{
+        platform_driver_unregister(&rtc_dm355evm_driver);
+}
+module_exit(dm355evm_rtc_exit);
+
+MODULE_LICENSE("GPL");
diff --git a/drivers/rtc/rtc-ds1390.c b/drivers/rtc/rtc-ds1390.c
index e54b5c619bd..e01b955db07 100644
--- a/drivers/rtc/rtc-ds1390.c
+++ b/drivers/rtc/rtc-ds1390.c
@@ -122,7 +122,6 @@ static const struct rtc_class_ops ds1390_rtc_ops = {
 
 static int __devinit ds1390_probe(struct spi_device *spi)
 {
-        struct rtc_device *rtc;
         unsigned char tmp;
         struct ds1390 *chip;
         int res;
diff --git a/drivers/rtc/rtc-pxa.c b/drivers/rtc/rtc-pxa.c
index bd56a033bfd..bb8cc05605a 100644
--- a/drivers/rtc/rtc-pxa.c
+++ b/drivers/rtc/rtc-pxa.c
@@ -485,7 +485,7 @@ static void __exit pxa_rtc_exit(void)
 module_init(pxa_rtc_init);
 module_exit(pxa_rtc_exit);
 
-MODULE_AUTHOR("Robert Jarzmik");
+MODULE_AUTHOR("Robert Jarzmik <robert.jarzmik@free.fr>");
 MODULE_DESCRIPTION("PXA27x/PXA3xx Realtime Clock Driver (RTC)");
 MODULE_LICENSE("GPL");
 MODULE_ALIAS("platform:pxa-rtc");
diff --git a/drivers/s390/block/dasd.c b/drivers/s390/block/dasd.c
index bd591499414..08c23a92101 100644
--- a/drivers/s390/block/dasd.c
+++ b/drivers/s390/block/dasd.c
@@ -57,6 +57,8 @@ static void dasd_device_tasklet(struct dasd_device *);
 static void dasd_block_tasklet(struct dasd_block *);
 static void do_kick_device(struct work_struct *);
 static void dasd_return_cqr_cb(struct dasd_ccw_req *, void *);
+static void dasd_device_timeout(unsigned long);
+static void dasd_block_timeout(unsigned long);
 
 /*
  * SECTION: Operations on the device structure.
@@ -99,6 +101,8 @@ struct dasd_device *dasd_alloc_device(void)
                      (unsigned long) device);
         INIT_LIST_HEAD(&device->ccw_queue);
         init_timer(&device->timer);
+        device->timer.function = dasd_device_timeout;
+        device->timer.data = (unsigned long) device;
         INIT_WORK(&device->kick_work, do_kick_device);
         device->state = DASD_STATE_NEW;
         device->target = DASD_STATE_NEW;
@@ -138,6 +142,8 @@ struct dasd_block *dasd_alloc_block(void)
         INIT_LIST_HEAD(&block->ccw_queue);
         spin_lock_init(&block->queue_lock);
         init_timer(&block->timer);
+        block->timer.function = dasd_block_timeout;
+        block->timer.data = (unsigned long) block;
 
         return block;
 }
@@ -915,19 +921,10 @@ static void dasd_device_timeout(unsigned long ptr)
  */
 void dasd_device_set_timer(struct dasd_device *device, int expires)
 {
-        if (expires == 0) {
-                if (timer_pending(&device->timer))
-                        del_timer(&device->timer);
-                return;
-        }
-        if (timer_pending(&device->timer)) {
-                if (mod_timer(&device->timer, jiffies + expires))
-                        return;
-        }
-        device->timer.function = dasd_device_timeout;
-        device->timer.data = (unsigned long) device;
-        device->timer.expires = jiffies + expires;
-        add_timer(&device->timer);
+        if (expires == 0)
+                del_timer(&device->timer);
+        else
+                mod_timer(&device->timer, jiffies + expires);
 }
 
 /*
@@ -935,8 +932,7 @@ void dasd_device_set_timer(struct dasd_device *device, int expires)
  */
 void dasd_device_clear_timer(struct dasd_device *device)
 {
-        if (timer_pending(&device->timer))
-                del_timer(&device->timer);
+        del_timer(&device->timer);
 }
 
 static void dasd_handle_killed_request(struct ccw_device *cdev,
@@ -1586,19 +1582,10 @@ static void dasd_block_timeout(unsigned long ptr)
  */
 void dasd_block_set_timer(struct dasd_block *block, int expires)
 {
-        if (expires == 0) {
-                if (timer_pending(&block->timer))
-                        del_timer(&block->timer);
-                return;
-        }
-        if (timer_pending(&block->timer)) {
-                if (mod_timer(&block->timer, jiffies + expires))
-                        return;
-        }
-        block->timer.function = dasd_block_timeout;
-        block->timer.data = (unsigned long) block;
-        block->timer.expires = jiffies + expires;
-        add_timer(&block->timer);
+        if (expires == 0)
+                del_timer(&block->timer);
+        else
+                mod_timer(&block->timer, jiffies + expires);
 }
 
 /*
@@ -1606,8 +1593,7 @@ void dasd_block_set_timer(struct dasd_block *block, int expires)
  */
 void dasd_block_clear_timer(struct dasd_block *block)
 {
-        if (timer_pending(&block->timer))
-                del_timer(&block->timer);
+        del_timer(&block->timer);
 }
 
 /*
diff --git a/drivers/s390/block/dasd_devmap.c b/drivers/s390/block/dasd_devmap.c
index 300e28a531f..34339902efb 100644
--- a/drivers/s390/block/dasd_devmap.c
+++ b/drivers/s390/block/dasd_devmap.c
@@ -677,7 +677,7 @@ static ssize_t dasd_ff_show(struct device *dev, struct device_attribute *attr,
         struct dasd_devmap *devmap;
         int ff_flag;
 
-        devmap = dasd_find_busid(dev->bus_id);
+        devmap = dasd_find_busid(dev_name(dev));
         if (!IS_ERR(devmap))
                 ff_flag = (devmap->features & DASD_FEATURE_FAILFAST) != 0;
         else
diff --git a/drivers/serial/jsm/jsm_tty.c b/drivers/serial/jsm/jsm_tty.c
index 3547558d2ca..324c74d2f66 100644
--- a/drivers/serial/jsm/jsm_tty.c
+++ b/drivers/serial/jsm/jsm_tty.c
@@ -161,6 +161,11 @@ static void jsm_tty_stop_rx(struct uart_port *port)
         channel->ch_bd->bd_ops->disable_receiver(channel);
 }
 
+static void jsm_tty_enable_ms(struct uart_port *port)
+{
+        /* Nothing needed */
+}
+
 static void jsm_tty_break(struct uart_port *port, int break_state)
 {
         unsigned long lock_flags;
@@ -345,6 +350,7 @@ static struct uart_ops jsm_ops = {
         .start_tx       = jsm_tty_start_tx,
         .send_xchar     = jsm_tty_send_xchar,
         .stop_rx        = jsm_tty_stop_rx,
+        .enable_ms      = jsm_tty_enable_ms,
         .break_ctl      = jsm_tty_break,
         .startup        = jsm_tty_open,
         .shutdown       = jsm_tty_close,
diff --git a/drivers/staging/android/Kconfig b/drivers/staging/android/Kconfig
index 6b996db0dd6..604bd1e0d54 100644
--- a/drivers/staging/android/Kconfig
+++ b/drivers/staging/android/Kconfig
@@ -27,6 +27,7 @@ menuconfig ANDROID_RAM_CONSOLE_ERROR_CORRECTION
         bool "Android RAM Console Enable error correction"
         default n
         depends on ANDROID_RAM_CONSOLE
+        depends on !ANDROID_RAM_CONSOLE_EARLY_INIT
         select REED_SOLOMON
         select REED_SOLOMON_ENC8
         select REED_SOLOMON_DEC8
diff --git a/drivers/staging/android/ram_console.c b/drivers/staging/android/ram_console.c
index bf006857a87..643ac5ce381 100644
--- a/drivers/staging/android/ram_console.c
+++ b/drivers/staging/android/ram_console.c
@@ -224,9 +224,23 @@ static int __init ram_console_init(struct ram_console_buffer *buffer,
         ram_console_buffer_size =
                 buffer_size - sizeof(struct ram_console_buffer);
 
+        if (ram_console_buffer_size > buffer_size) {
+                pr_err("ram_console: buffer %p, invalid size %d, datasize %d\n",
+                       buffer, buffer_size, ram_console_buffer_size);
+                return 0;
+        }
+
 #ifdef CONFIG_ANDROID_RAM_CONSOLE_ERROR_CORRECTION
         ram_console_buffer_size -= (DIV_ROUND_UP(ram_console_buffer_size,
                                                 ECC_BLOCK_SIZE) + 1) * ECC_SIZE;
+
+        if (ram_console_buffer_size > buffer_size) {
+                pr_err("ram_console: buffer %p, invalid size %d, "
+                       "non-ecc datasize %d\n",
+                       buffer, buffer_size, ram_console_buffer_size);
+                return 0;
+        }
+
         ram_console_par_buffer = buffer->data + ram_console_buffer_size;
 
 
diff --git a/drivers/staging/android/timed_gpio.c b/drivers/staging/android/timed_gpio.c
index 903270cbbe0..33daff0481d 100644
--- a/drivers/staging/android/timed_gpio.c
+++ b/drivers/staging/android/timed_gpio.c
@@ -50,7 +50,7 @@ static ssize_t gpio_enable_show(struct device *dev, struct device_attribute *att
         if (hrtimer_active(&gpio_data->timer)) {
                 ktime_t r = hrtimer_get_remaining(&gpio_data->timer);
                 struct timeval t = ktime_to_timeval(r);
-                remaining = t.tv_sec * 1000 + t.tv_usec;
+                remaining = t.tv_sec * 1000 + t.tv_usec / 1000;
         } else
                 remaining = 0;
 
diff --git a/drivers/staging/at76_usb/Kconfig b/drivers/staging/at76_usb/Kconfig
index 4c0e55e1544..8606f962162 100644
--- a/drivers/staging/at76_usb/Kconfig
+++ b/drivers/staging/at76_usb/Kconfig
@@ -1,6 +1,6 @@
 config USB_ATMEL
         tristate "Atmel at76c503/at76c505/at76c505a USB cards"
-        depends on MAC80211 && WLAN_80211 && USB
+        depends on WLAN_80211 && USB
         default N
         select FW_LOADER
         ---help---
diff --git a/drivers/staging/at76_usb/at76_usb.c b/drivers/staging/at76_usb/at76_usb.c
index 185533e5476..c8e4d31c7df 100644
--- a/drivers/staging/at76_usb/at76_usb.c
+++ b/drivers/staging/at76_usb/at76_usb.c
@@ -6,7 +6,6 @@
  * Copyright (c) 2004 Nick Jones
  * Copyright (c) 2004 Balint Seeber <n0_5p4m_p13453@hotmail.com>
  * Copyright (c) 2007 Guido Guenther <agx@sigxcpu.org>
- * Copyright (c) 2007 Kalle Valo <kalle.valo@iki.fi>
  *
  * This program is free software; you can redistribute it and/or
  * modify it under the terms of the GNU General Public License as
@@ -17,13 +16,6 @@
  * Atmel AT76C503A/505/505A.
  *
  * Some iw_handler code was taken from airo.c, (C) 1999 Benjamin Reed
- *
- * TODO for the mac80211 port:
- * o adhoc support
- * o RTS/CTS support
- * o Power Save Mode support
- * o support for short/long preambles
- * o export variables through debugfs/sysfs
  */
 
 #include <linux/init.h>
@@ -44,7 +36,7 @@
 #include <net/ieee80211_radiotap.h>
 #include <linux/firmware.h>
 #include <linux/leds.h>
-#include <net/mac80211.h>
+#include <net/ieee80211.h>
 
 #include "at76_usb.h"
 
@@ -84,43 +76,31 @@
 #define DBG_WE_EVENTS           0x08000000      /* dump wireless events */
 #define DBG_FW                  0x10000000      /* firmware download */
 #define DBG_DFU                 0x20000000      /* device firmware upgrade */
-#define DBG_CMD                 0x40000000
-#define DBG_MAC80211            0x80000000
 
 #define DBG_DEFAULTS            0
 
 /* Use our own dbg macro */
 #define at76_dbg(bits, format, arg...) \
-do {    \
-        if (at76_debug & (bits))        \
-                printk(KERN_DEBUG DRIVER_NAME ": " format "\n" , ## arg); \
-} while (0)
-
-#define at76_dbg_dump(bits, buf, len, format, arg...)   \
-do {    \
-        if (at76_debug & (bits)) {      \
+        do { \
+                if (at76_debug & (bits)) \
                 printk(KERN_DEBUG DRIVER_NAME ": " format "\n" , ## arg); \
-                print_hex_dump_bytes("", DUMP_PREFIX_OFFSET, buf, len); \
-                }                                                       \
-} while (0)
+        } while (0)
 
 static int at76_debug = DBG_DEFAULTS;
 
-#define FIRMWARE_IS_WPA(ver) ((ver.major == 1) && (ver.minor == 103))
-
 /* Protect against concurrent firmware loading and parsing */
 static struct mutex fw_mutex;
 
 static struct fwentry firmwares[] = {
-        [0] = { "" },
-        [BOARD_503_ISL3861] = { "atmel_at76c503-i3861.bin" },
-        [BOARD_503_ISL3863] = { "atmel_at76c503-i3863.bin" },
-        [BOARD_503] = { "atmel_at76c503-rfmd.bin" },
-        [BOARD_503_ACC] = { "atmel_at76c503-rfmd-acc.bin" },
-        [BOARD_505] = { "atmel_at76c505-rfmd.bin" },
-        [BOARD_505_2958] = { "atmel_at76c505-rfmd2958.bin" },
-        [BOARD_505A] = { "atmel_at76c505a-rfmd2958.bin" },
-        [BOARD_505AMX] = { "atmel_at76c505amx-rfmd.bin" },
+        [0] = {""},
+        [BOARD_503_ISL3861] = {"atmel_at76c503-i3861.bin"},
+        [BOARD_503_ISL3863] = {"atmel_at76c503-i3863.bin"},
+        [BOARD_503] = {"atmel_at76c503-rfmd.bin"},
+        [BOARD_503_ACC] = {"atmel_at76c503-rfmd-acc.bin"},
+        [BOARD_505] = {"atmel_at76c505-rfmd.bin"},
+        [BOARD_505_2958] = {"atmel_at76c505-rfmd2958.bin"},
+        [BOARD_505A] = {"atmel_at76c505a-rfmd2958.bin"},
+        [BOARD_505AMX] = {"atmel_at76c505amx-rfmd.bin"},
 };
 
 #define USB_DEVICE_DATA(__ops)  .driver_info = (kernel_ulong_t)(__ops)
@@ -130,133 +110,135 @@ static struct usb_device_id dev_table[] = {
          * at76c503-i3861
          */
         /* Generic AT76C503/3861 device */
-        { USB_DEVICE(0x03eb, 0x7603), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x03eb, 0x7603), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Linksys WUSB11 v2.1/v2.6 */
-        { USB_DEVICE(0x066b, 0x2211), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x066b, 0x2211), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Netgear MA101 rev. A */
-        { USB_DEVICE(0x0864, 0x4100), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0864, 0x4100), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Tekram U300C / Allnet ALL0193 */
-        { USB_DEVICE(0x0b3b, 0x1612), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0b3b, 0x1612), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* HP HN210W J7801A */
-        { USB_DEVICE(0x03f0, 0x011c), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x03f0, 0x011c), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Sitecom/Z-Com/Zyxel M4Y-750 */
-        { USB_DEVICE(0x0cde, 0x0001), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0cde, 0x0001), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Dynalink/Askey WLL013 (intersil) */
-        { USB_DEVICE(0x069a, 0x0320), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x069a, 0x0320), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* EZ connect 11Mpbs Wireless USB Adapter SMC2662W v1 */
-        { USB_DEVICE(0x0d5c, 0xa001), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0d5c, 0xa001), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* BenQ AWL300 */
-        { USB_DEVICE(0x04a5, 0x9000), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x04a5, 0x9000), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Addtron AWU-120, Compex WLU11 */
-        { USB_DEVICE(0x05dd, 0xff31), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x05dd, 0xff31), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Intel AP310 AnyPoint II USB */
-        { USB_DEVICE(0x8086, 0x0200), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x8086, 0x0200), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Dynalink L11U */
-        { USB_DEVICE(0x0d8e, 0x7100), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0d8e, 0x7100), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* Arescom WL-210, FCC id 07J-GL2411USB */
-        { USB_DEVICE(0x0d8e, 0x7110), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x0d8e, 0x7110), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* I-O DATA WN-B11/USB */
-        { USB_DEVICE(0x04bb, 0x0919), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x04bb, 0x0919), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /* BT Voyager 1010 */
-        { USB_DEVICE(0x069a, 0x0821), USB_DEVICE_DATA(BOARD_503_ISL3861) },
+        {USB_DEVICE(0x069a, 0x0821), USB_DEVICE_DATA(BOARD_503_ISL3861)},
         /*
          * at76c503-i3863
          */
         /* Generic AT76C503/3863 device */
-        { USB_DEVICE(0x03eb, 0x7604), USB_DEVICE_DATA(BOARD_503_ISL3863) },
+        {USB_DEVICE(0x03eb, 0x7604), USB_DEVICE_DATA(BOARD_503_ISL3863)},
         /* Samsung SWL-2100U */
-        { USB_DEVICE(0x055d, 0xa000), USB_DEVICE_DATA(BOARD_503_ISL3863) },
+        {USB_DEVICE(0x055d, 0xa000), USB_DEVICE_DATA(BOARD_503_ISL3863)},
         /*
          * at76c503-rfmd
          */
         /* Generic AT76C503/RFMD device */
-        { USB_DEVICE(0x03eb, 0x7605), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x03eb, 0x7605), USB_DEVICE_DATA(BOARD_503)},
         /* Dynalink/Askey WLL013 (rfmd) */
-        { USB_DEVICE(0x069a, 0x0321), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x069a, 0x0321), USB_DEVICE_DATA(BOARD_503)},
         /* Linksys WUSB11 v2.6 */
-        { USB_DEVICE(0x077b, 0x2219), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x077b, 0x2219), USB_DEVICE_DATA(BOARD_503)},
         /* Network Everywhere NWU11B */
-        { USB_DEVICE(0x077b, 0x2227), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x077b, 0x2227), USB_DEVICE_DATA(BOARD_503)},
         /* Netgear MA101 rev. B */
-        { USB_DEVICE(0x0864, 0x4102), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x0864, 0x4102), USB_DEVICE_DATA(BOARD_503)},
         /* D-Link DWL-120 rev. E */
-        { USB_DEVICE(0x2001, 0x3200), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x2001, 0x3200), USB_DEVICE_DATA(BOARD_503)},
         /* Actiontec 802UAT1, HWU01150-01UK */
-        { USB_DEVICE(0x1668, 0x7605), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1668, 0x7605), USB_DEVICE_DATA(BOARD_503)},
         /* AirVast W-Buddie WN210 */
-        { USB_DEVICE(0x03eb, 0x4102), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x03eb, 0x4102), USB_DEVICE_DATA(BOARD_503)},
         /* Dick Smith Electronics XH1153 802.11b USB adapter */
-        { USB_DEVICE(0x1371, 0x5743), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1371, 0x5743), USB_DEVICE_DATA(BOARD_503)},
         /* CNet CNUSB611 */
-        { USB_DEVICE(0x1371, 0x0001), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1371, 0x0001), USB_DEVICE_DATA(BOARD_503)},
         /* FiberLine FL-WL200U */
-        { USB_DEVICE(0x1371, 0x0002), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1371, 0x0002), USB_DEVICE_DATA(BOARD_503)},
         /* BenQ AWL400 USB stick */
-        { USB_DEVICE(0x04a5, 0x9001), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x04a5, 0x9001), USB_DEVICE_DATA(BOARD_503)},
         /* 3Com 3CRSHEW696 */
-        { USB_DEVICE(0x0506, 0x0a01), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x0506, 0x0a01), USB_DEVICE_DATA(BOARD_503)},
         /* Siemens Santis ADSL WLAN USB adapter WLL 013 */
-        { USB_DEVICE(0x0681, 0x001b), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x0681, 0x001b), USB_DEVICE_DATA(BOARD_503)},
         /* Belkin F5D6050, version 2 */
-        { USB_DEVICE(0x050d, 0x0050), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x050d, 0x0050), USB_DEVICE_DATA(BOARD_503)},
         /* iBlitzz, BWU613 (not *B or *SB) */
-        { USB_DEVICE(0x07b8, 0xb000), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x07b8, 0xb000), USB_DEVICE_DATA(BOARD_503)},
         /* Gigabyte GN-WLBM101 */
-        { USB_DEVICE(0x1044, 0x8003), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x1044, 0x8003), USB_DEVICE_DATA(BOARD_503)},
         /* Planex GW-US11S */
-        { USB_DEVICE(0x2019, 0x3220), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x2019, 0x3220), USB_DEVICE_DATA(BOARD_503)},
         /* Internal WLAN adapter in h5[4,5]xx series iPAQs */
-        { USB_DEVICE(0x049f, 0x0032), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x049f, 0x0032), USB_DEVICE_DATA(BOARD_503)},
         /* Corega Wireless LAN USB-11 mini */
-        { USB_DEVICE(0x07aa, 0x0011), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x07aa, 0x0011), USB_DEVICE_DATA(BOARD_503)},
         /* Corega Wireless LAN USB-11 mini2 */
-        { USB_DEVICE(0x07aa, 0x0018), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x07aa, 0x0018), USB_DEVICE_DATA(BOARD_503)},
         /* Uniden PCW100 */
-        { USB_DEVICE(0x05dd, 0xff35), USB_DEVICE_DATA(BOARD_503) },
+        {USB_DEVICE(0x05dd, 0xff35), USB_DEVICE_DATA(BOARD_503)},
         /*
          * at76c503-rfmd-acc
          */
         /* SMC2664W */
-        { USB_DEVICE(0x083a, 0x3501), USB_DEVICE_DATA(BOARD_503_ACC) },
+        {USB_DEVICE(0x083a, 0x3501), USB_DEVICE_DATA(BOARD_503_ACC)},
         /* Belkin F5D6050, SMC2662W v2, SMC2662W-AR */
-        { USB_DEVICE(0x0d5c, 0xa002), USB_DEVICE_DATA(BOARD_503_ACC) },
+        {USB_DEVICE(0x0d5c, 0xa002), USB_DEVICE_DATA(BOARD_503_ACC)},
         /*
          * at76c505-rfmd
          */
         /* Generic AT76C505/RFMD */
-        { USB_DEVICE(0x03eb, 0x7606), USB_DEVICE_DATA(BOARD_505) },
+        {USB_DEVICE(0x03eb, 0x7606), USB_DEVICE_DATA(BOARD_505)},
         /*
          * at76c505-rfmd2958
          */
         /* Generic AT76C505/RFMD, OvisLink WL-1130USB */
-        { USB_DEVICE(0x03eb, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x03eb, 0x7613), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Fiberline FL-WL240U */
-        { USB_DEVICE(0x1371, 0x0014), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x1371, 0x0014), USB_DEVICE_DATA(BOARD_505_2958)},
         /* CNet CNUSB-611G */
-        { USB_DEVICE(0x1371, 0x0013), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x1371, 0x0013), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Linksys WUSB11 v2.8 */
-        { USB_DEVICE(0x1915, 0x2233), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x1915, 0x2233), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Xterasys XN-2122B, IBlitzz BWU613B/BWU613SB */
-        { USB_DEVICE(0x12fd, 0x1001), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x12fd, 0x1001), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Corega WLAN USB Stick 11 */
-        { USB_DEVICE(0x07aa, 0x7613), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x07aa, 0x7613), USB_DEVICE_DATA(BOARD_505_2958)},
         /* Microstar MSI Box MS6978 */
-        { USB_DEVICE(0x0db0, 0x1020), USB_DEVICE_DATA(BOARD_505_2958) },
+        {USB_DEVICE(0x0db0, 0x1020), USB_DEVICE_DATA(BOARD_505_2958)},
         /*
          * at76c505a-rfmd2958
          */
         /* Generic AT76C505A device */
-        { USB_DEVICE(0x03eb, 0x7614), USB_DEVICE_DATA(BOARD_505A) },
+        {USB_DEVICE(0x03eb, 0x7614), USB_DEVICE_DATA(BOARD_505A)},
         /* Generic AT76C505AS device */
-        { USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A) },
+        {USB_DEVICE(0x03eb, 0x7617), USB_DEVICE_DATA(BOARD_505A)},
         /* Siemens Gigaset USB WLAN Adapter 11 */
-        { USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A) },
+        {USB_DEVICE(0x1690, 0x0701), USB_DEVICE_DATA(BOARD_505A)},
+        /* OQO Model 01+ Internal Wi-Fi */
+        {USB_DEVICE(0x1557, 0x0002), USB_DEVICE_DATA(BOARD_505A)},
         /*
          * at76c505amx-rfmd
          */
         /* Generic AT76C505AMX device */
-        { USB_DEVICE(0x03eb, 0x7615), USB_DEVICE_DATA(BOARD_505AMX) },
-        { }
+        {USB_DEVICE(0x03eb, 0x7615), USB_DEVICE_DATA(BOARD_505AMX)},
+        {}
 };
 
 MODULE_DEVICE_TABLE(usb, dev_table);
@@ -264,8 +246,26 @@ MODULE_DEVICE_TABLE(usb, dev_table);
 /* Supported rates of this hardware, bit 7 marks basic rates */
 static const u8 hw_rates[] = { 0x82, 0x84, 0x0b, 0x16 };
 
+/* Frequency of each channel in MHz */
+static const long channel_frequency[] = {
+        2412, 2417, 2422, 2427, 2432, 2437, 2442,
+        2447, 2452, 2457, 2462, 2467, 2472, 2484
+};
+
+#define NUM_CHANNELS ARRAY_SIZE(channel_frequency)
+
 static const char *const preambles[] = { "long", "short", "auto" };
 
+static const char *const mac_states[] = {
+        [MAC_INIT] = "INIT",
+        [MAC_SCANNING] = "SCANNING",
+        [MAC_AUTH] = "AUTH",
+        [MAC_ASSOC] = "ASSOC",
+        [MAC_JOINING] = "JOINING",
+        [MAC_CONNECTED] = "CONNECTED",
+        [MAC_OWN_IBSS] = "OWN_IBSS"
+};
+
 /* Firmware download */
 /* DFU states */
 #define STATE_IDLE                      0x00
@@ -300,30 +300,17 @@ struct dfu_status {
 
 static inline int at76_is_intersil(enum board_type board)
 {
-        if (board == BOARD_503_ISL3861 || board == BOARD_503_ISL3863)
-                return 1;
-        return 0;
+        return (board == BOARD_503_ISL3861 || board == BOARD_503_ISL3863);
 }
 
 static inline int at76_is_503rfmd(enum board_type board)
 {
-        if (board == BOARD_503 || board == BOARD_503_ACC)
-                return 1;
-        return 0;
-}
-
-static inline int at76_is_505(enum board_type board)
-{
-        if (board == BOARD_505 || board == BOARD_505_2958)
-                return 1;
-        return 0;
+        return (board == BOARD_503 || board == BOARD_503_ACC);
 }
 
 static inline int at76_is_505a(enum board_type board)
 {
-        if (board == BOARD_505A || board == BOARD_505AMX)
-                return 1;
-        return 0;
+        return (board == BOARD_505A || board == BOARD_505AMX);
 }
 
 /* Load a block of the first (internal) part of the firmware */
@@ -504,6 +491,41 @@ exit:
         return ret;
 }
 
+/* Report that the scan results are ready */
+static inline void at76_iwevent_scan_complete(struct net_device *netdev)
+{
+        union iwreq_data wrqu;
+        wrqu.data.length = 0;
+        wrqu.data.flags = 0;
+        wireless_send_event(netdev, SIOCGIWSCAN, &wrqu, NULL);
+        at76_dbg(DBG_WE_EVENTS, "%s: SIOCGIWSCAN sent", netdev->name);
+}
+
+static inline void at76_iwevent_bss_connect(struct net_device *netdev,
+                                            u8 *bssid)
+{
+        union iwreq_data wrqu;
+        wrqu.data.length = 0;
+        wrqu.data.flags = 0;
+        memcpy(wrqu.ap_addr.sa_data, bssid, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(netdev, SIOCGIWAP, &wrqu, NULL);
+        at76_dbg(DBG_WE_EVENTS, "%s: %s: SIOCGIWAP sent", netdev->name,
+                 __func__);
+}
+
+static inline void at76_iwevent_bss_disconnect(struct net_device *netdev)
+{
+        union iwreq_data wrqu;
+        wrqu.data.length = 0;
+        wrqu.data.flags = 0;
+        memset(wrqu.ap_addr.sa_data, 0, ETH_ALEN);
+        wrqu.ap_addr.sa_family = ARPHRD_ETHER;
+        wireless_send_event(netdev, SIOCGIWAP, &wrqu, NULL);
+        at76_dbg(DBG_WE_EVENTS, "%s: %s: SIOCGIWAP sent", netdev->name,
+                 __func__);
+}
+
 #define HEX2STR_BUFFERS 4
 #define HEX2STR_MAX_LEN 64
 #define BIN2HEX(x) ((x) < 10 ? '0' + (x) : (x) + 'A' - 10)
@@ -575,6 +597,37 @@ static void at76_ledtrig_tx_activity(void)
                 mod_timer(&ledtrig_tx_timer, jiffies + HZ / 4);
 }
 
+/* Check if the given ssid is hidden */
+static inline int at76_is_hidden_ssid(u8 *ssid, int length)
+{
+        static const u8 zeros[32];
+
+        if (length == 0)
+                return 1;
+
+        if (length == 1 && ssid[0] == ' ')
+                return 1;
+
+        return (memcmp(ssid, zeros, length) == 0);
+}
+
+static inline void at76_free_bss_list(struct at76_priv *priv)
+{
+        struct list_head *next, *ptr;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        priv->curr_bss = NULL;
+
+        list_for_each_safe(ptr, next, &priv->bss_list) {
+                list_del(ptr);
+                kfree(list_entry(ptr, struct bss_info, list));
+        }
+
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+}
+
 static int at76_remap(struct usb_device *udev)
 {
         int ret;
@@ -598,7 +651,7 @@ static int at76_get_op_mode(struct usb_device *udev)
                 return -ENOMEM;
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x33,
                               USB_TYPE_VENDOR | USB_DIR_IN |
-                              USB_RECIP_INTERFACE, 0x01, 0, &op_mode, 1,
+                              USB_RECIP_INTERFACE, 0x01, 0, op_mode, 1,
                               USB_CTRL_GET_TIMEOUT);
         saved = *op_mode;
         kfree(op_mode);
@@ -676,7 +729,7 @@ exit:
         kfree(hwcfg);
         if (ret < 0)
                 printk(KERN_ERR "%s: cannot get HW Config (error %d)\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -685,15 +738,15 @@ static struct reg_domain const *at76_get_reg_domain(u16 code)
 {
         int i;
         static struct reg_domain const fd_tab[] = {
-                { 0x10, "FCC (USA)", 0x7ff },   /* ch 1-11 */
-                { 0x20, "IC (Canada)", 0x7ff }, /* ch 1-11 */
-                { 0x30, "ETSI (most of Europe)", 0x1fff },      /* ch 1-13 */
-                { 0x31, "Spain", 0x600 },       /* ch 10-11 */
-                { 0x32, "France", 0x1e00 },     /* ch 10-13 */
-                { 0x40, "MKK (Japan)", 0x2000 },        /* ch 14 */
-                { 0x41, "MKK1 (Japan)", 0x3fff },       /* ch 1-14 */
-                { 0x50, "Israel", 0x3fc },      /* ch 3-9 */
-                { 0x00, "<unknown>", 0xffffffff }       /* ch 1-32 */
+                {0x10, "FCC (USA)", 0x7ff},     /* ch 1-11 */
+                {0x20, "IC (Canada)", 0x7ff},   /* ch 1-11 */
+                {0x30, "ETSI (most of Europe)", 0x1fff},        /* ch 1-13 */
+                {0x31, "Spain", 0x600}, /* ch 10-11 */
+                {0x32, "France", 0x1e00},       /* ch 10-13 */
+                {0x40, "MKK (Japan)", 0x2000},  /* ch 14 */
+                {0x41, "MKK1 (Japan)", 0x3fff}, /* ch 1-14 */
+                {0x50, "Israel", 0x3fc},        /* ch 3-9 */
+                {0x00, "<unknown>", 0xffffffff} /* ch 1-32 */
         };
 
         /* Last entry is fallback for unknown domain code */
@@ -731,7 +784,7 @@ static inline int at76_get_cmd_status(struct usb_device *udev, u8 cmd)
         ret = usb_control_msg(udev, usb_rcvctrlpipe(udev, 0), 0x22,
                               USB_TYPE_VENDOR | USB_DIR_IN |
                               USB_RECIP_INTERFACE, cmd, 0, stat_buf,
-                              sizeof(stat_buf), USB_CTRL_GET_TIMEOUT);
+                              40, USB_CTRL_GET_TIMEOUT);
         if (ret >= 0)
                 ret = stat_buf[5];
         kfree(stat_buf);
@@ -739,24 +792,6 @@ static inline int at76_get_cmd_status(struct usb_device *udev, u8 cmd)
         return ret;
 }
 
-#define MAKE_CMD_CASE(c) case (c): return #c
-
-static const char *at76_get_cmd_string(u8 cmd_status)
-{
-        switch (cmd_status) {
-                MAKE_CMD_CASE(CMD_SET_MIB);
-                MAKE_CMD_CASE(CMD_GET_MIB);
-                MAKE_CMD_CASE(CMD_SCAN);
-                MAKE_CMD_CASE(CMD_JOIN);
-                MAKE_CMD_CASE(CMD_START_IBSS);
-                MAKE_CMD_CASE(CMD_RADIO_ON);
-                MAKE_CMD_CASE(CMD_RADIO_OFF);
-                MAKE_CMD_CASE(CMD_STARTUP);
-        }
-
-        return "UNKNOWN";
-}
-
 static int at76_set_card_command(struct usb_device *udev, u8 cmd, void *buf,
                                  int buf_size)
 {
@@ -772,10 +807,6 @@ static int at76_set_card_command(struct usb_device *udev, u8 cmd, void *buf,
         cmd_buf->size = cpu_to_le16(buf_size);
         memcpy(cmd_buf->data, buf, buf_size);
 
-        at76_dbg_dump(DBG_CMD, cmd_buf, sizeof(struct at76_command) + buf_size,
-                      "issuing command %s (0x%02x)",
-                      at76_get_cmd_string(cmd), cmd);
-
         ret = usb_control_msg(udev, usb_sndctrlpipe(udev, 0), 0x0e,
                               USB_TYPE_VENDOR | USB_DIR_OUT | USB_RECIP_DEVICE,
                               0, 0, cmd_buf,
@@ -813,13 +844,13 @@ static int at76_wait_completion(struct at76_priv *priv, int cmd)
                 status = at76_get_cmd_status(priv->udev, cmd);
                 if (status < 0) {
                         printk(KERN_ERR "%s: at76_get_cmd_status failed: %d\n",
-                               wiphy_name(priv->hw->wiphy), status);
+                               priv->netdev->name, status);
                         break;
                 }
 
                 at76_dbg(DBG_WAIT_COMPLETE,
                          "%s: Waiting on cmd %d, status = %d (%s)",
-                         wiphy_name(priv->hw->wiphy), cmd, status,
+                         priv->netdev->name, cmd, status,
                          at76_get_cmd_status_string(status));
 
                 if (status != CMD_STATUS_IN_PROGRESS
@@ -830,7 +861,7 @@ static int at76_wait_completion(struct at76_priv *priv, int cmd)
                 if (time_after(jiffies, timeout)) {
                         printk(KERN_ERR
                                "%s: completion timeout for command %d\n",
-                               wiphy_name(priv->hw->wiphy), cmd);
+                               priv->netdev->name, cmd);
                         status = -ETIMEDOUT;
                         break;
                 }
@@ -853,7 +884,7 @@ static int at76_set_mib(struct at76_priv *priv, struct set_mib_buffer *buf)
         if (ret != CMD_STATUS_COMPLETE) {
                 printk(KERN_INFO
                        "%s: set_mib: at76_wait_completion failed "
-                       "with %d\n", wiphy_name(priv->hw->wiphy), ret);
+                       "with %d\n", priv->netdev->name, ret);
                 ret = -EIO;
         }
 
@@ -874,7 +905,7 @@ static int at76_set_radio(struct at76_priv *priv, int enable)
         ret = at76_set_card_command(priv->udev, cmd, NULL, 0);
         if (ret < 0)
                 printk(KERN_ERR "%s: at76_set_card_command(%d) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), cmd, ret);
+                       priv->netdev->name, cmd, ret);
         else
                 ret = 1;
 
@@ -895,7 +926,44 @@ static int at76_set_pm_mode(struct at76_priv *priv)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (pm_mode) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
+
+        return ret;
+}
+
+/* Set the association id for power save mode */
+static int at76_set_associd(struct at76_priv *priv, u16 id)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 2;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, station_id);
+        priv->mib_buf.data.word = cpu_to_le16(id);
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (associd) failed: %d\n",
+                       priv->netdev->name, ret);
+
+        return ret;
+}
+
+/* Set the listen interval for power save mode */
+static int at76_set_listen_interval(struct at76_priv *priv, u16 interval)
+{
+        int ret = 0;
+
+        priv->mib_buf.type = MIB_MAC;
+        priv->mib_buf.size = 2;
+        priv->mib_buf.index = offsetof(struct mib_mac, listen_interval);
+        priv->mib_buf.data.word = cpu_to_le16(interval);
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR
+                       "%s: set_mib (listen_interval) failed: %d\n",
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -912,7 +980,7 @@ static int at76_set_preamble(struct at76_priv *priv, u8 type)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (preamble) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -929,7 +997,7 @@ static int at76_set_frag(struct at76_priv *priv, u16 size)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (frag threshold) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -946,7 +1014,7 @@ static int at76_set_rts(struct at76_priv *priv, u16 size)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (rts) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -963,41 +1031,24 @@ static int at76_set_autorate_fallback(struct at76_priv *priv, int onoff)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (autorate fallback) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         return ret;
 }
 
-static int at76_set_tkip_bssid(struct at76_priv *priv, const void *addr)
+static int at76_add_mac_address(struct at76_priv *priv, void *addr)
 {
         int ret = 0;
 
-        priv->mib_buf.type = MIB_MAC_ENCRYPTION;
+        priv->mib_buf.type = MIB_MAC_ADDR;
         priv->mib_buf.size = ETH_ALEN;
-        priv->mib_buf.index = offsetof(struct mib_mac_encryption, tkip_bssid);
+        priv->mib_buf.index = offsetof(struct mib_mac_addr, mac_addr);
         memcpy(priv->mib_buf.data.addr, addr, ETH_ALEN);
 
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
-                printk(KERN_ERR "%s: set_mib (MAC_ENCRYPTION, tkip_bssid) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-
-        return ret;
-}
-
-static int at76_reset_rsc(struct at76_priv *priv)
-{
-        int ret = 0;
-
-        priv->mib_buf.type = MIB_MAC_ENCRYPTION;
-        priv->mib_buf.size = 4 * 8;
-        priv->mib_buf.index = offsetof(struct mib_mac_encryption, key_rsc);
-        memset(priv->mib_buf.data.data, 0 , priv->mib_buf.size);
-
-        ret = at76_set_mib(priv, &priv->mib_buf);
-        if (ret < 0)
-                printk(KERN_ERR "%s: set_mib (MAC_ENCRYPTION, key_rsc) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                printk(KERN_ERR "%s: set_mib (MAC_ADDR, mac_addr) failed: %d\n",
+                       priv->netdev->name, ret);
 
         return ret;
 }
@@ -1016,16 +1067,16 @@ static void at76_dump_mib_mac_addr(struct at76_priv *priv)
                            sizeof(struct mib_mac_addr));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC_ADDR) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: mac_addr %s res 0x%x 0x%x",
-                 wiphy_name(priv->hw->wiphy),
+                 priv->netdev->name,
                  mac2str(m->mac_addr), m->res[0], m->res[1]);
         for (i = 0; i < ARRAY_SIZE(m->group_addr); i++)
                 at76_dbg(DBG_MIB, "%s: MIB MAC_ADDR: group addr %d: %s, "
-                         "status %d", wiphy_name(priv->hw->wiphy), i,
+                         "status %d", priv->netdev->name, i,
                          mac2str(m->group_addr[i]), m->group_addr_status[i]);
 exit:
         kfree(m);
@@ -1045,13 +1096,13 @@ static void at76_dump_mib_mac_wep(struct at76_priv *priv)
                            sizeof(struct mib_mac_wep));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC_WEP) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB MAC_WEP: priv_invoked %u def_key_id %u "
                  "key_len %u excl_unencr %u wep_icv_err %u wep_excluded %u "
-                 "encr_level %u key %d", wiphy_name(priv->hw->wiphy),
+                 "encr_level %u key %d", priv->netdev->name,
                  m->privacy_invoked, m->wep_default_key_id,
                  m->wep_key_mapping_len, m->exclude_unencrypted,
                  le32_to_cpu(m->wep_icv_error_count),
@@ -1063,55 +1114,12 @@ static void at76_dump_mib_mac_wep(struct at76_priv *priv)
 
         for (i = 0; i < WEP_KEYS; i++)
                 at76_dbg(DBG_MIB, "%s: MIB MAC_WEP: key %d: %s",
-                         wiphy_name(priv->hw->wiphy), i,
+                         priv->netdev->name, i,
                          hex2str(m->wep_default_keyvalue[i], key_len));
 exit:
         kfree(m);
 }
 
-static void at76_dump_mib_mac_encryption(struct at76_priv *priv)
-{
-        int i;
-        int ret;
-        /*int key_len;*/
-        struct mib_mac_encryption *m;
-
-        m = kmalloc(sizeof(struct mib_mac_encryption), GFP_KERNEL);
-        if (!m)
-                return;
-
-        ret = at76_get_mib(priv->udev, MIB_MAC_ENCRYPTION, m,
-                           sizeof(struct mib_mac_encryption));
-        if (ret < 0) {
-                dev_err(&priv->udev->dev,
-                        "%s: at76_get_mib (MAC_ENCRYPTION) failed: %d\n",
-                        wiphy_name(priv->hw->wiphy), ret);
-                goto exit;
-        }
-
-        at76_dbg(DBG_MIB,
-                 "%s: MIB MAC_ENCRYPTION: tkip_bssid %s priv_invoked %u "
-                 "ciph_key_id %u grp_key_id %u excl_unencr %u "
-                 "ckip_key_perm %u wep_icv_err %u wep_excluded %u",
-                 wiphy_name(priv->hw->wiphy), mac2str(m->tkip_bssid),
-                 m->privacy_invoked, m->cipher_default_key_id,
-                 m->cipher_default_group_key_id, m->exclude_unencrypted,
-                 m->ckip_key_permutation,
-                 le32_to_cpu(m->wep_icv_error_count),
-                 le32_to_cpu(m->wep_excluded_count));
-
-        /*key_len = (m->encryption_level == 1) ?
-            WEP_SMALL_KEY_LEN : WEP_LARGE_KEY_LEN;*/
-
-        for (i = 0; i < CIPHER_KEYS; i++)
-                at76_dbg(DBG_MIB, "%s: MIB MAC_ENCRYPTION: key %d: %s",
-                         wiphy_name(priv->hw->wiphy), i,
-                         hex2str(m->cipher_default_keyvalue[i],
-                                 CIPHER_KEY_LEN));
-exit:
-        kfree(m);
-}
-
 static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
 {
         int ret;
@@ -1125,7 +1133,7 @@ static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
                            sizeof(struct mib_mac_mgmt));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC_MGMT) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
@@ -1136,7 +1144,7 @@ static void at76_dump_mib_mac_mgmt(struct at76_priv *priv)
                  "pm_mode %d ibss_change %d res %d "
                  "multi_domain_capability_implemented %d "
                  "international_roaming %d country_string %.3s",
-                 wiphy_name(priv->hw->wiphy), le16_to_cpu(m->beacon_period),
+                 priv->netdev->name, le16_to_cpu(m->beacon_period),
                  le16_to_cpu(m->CFP_max_duration),
                  le16_to_cpu(m->medium_occupancy_limit),
                  le16_to_cpu(m->station_id), le16_to_cpu(m->ATIM_window),
@@ -1161,7 +1169,7 @@ static void at76_dump_mib_mac(struct at76_priv *priv)
         ret = at76_get_mib(priv->udev, MIB_MAC, m, sizeof(struct mib_mac));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MAC) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
@@ -1171,8 +1179,7 @@ static void at76_dump_mib_mac(struct at76_priv *priv)
                  "scan_type %d scan_channel %d probe_delay %u "
                  "min_channel_time %d max_channel_time %d listen_int %d "
                  "desired_ssid %s desired_bssid %s desired_bsstype %d",
-                 wiphy_name(priv->hw->wiphy),
-                 le32_to_cpu(m->max_tx_msdu_lifetime),
+                 priv->netdev->name, le32_to_cpu(m->max_tx_msdu_lifetime),
                  le32_to_cpu(m->max_rx_lifetime),
                  le16_to_cpu(m->frag_threshold), le16_to_cpu(m->rts_threshold),
                  le16_to_cpu(m->cwmin), le16_to_cpu(m->cwmax),
@@ -1198,7 +1205,7 @@ static void at76_dump_mib_phy(struct at76_priv *priv)
         ret = at76_get_mib(priv->udev, MIB_PHY, m, sizeof(struct mib_phy));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (PHY) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
@@ -1207,7 +1214,7 @@ static void at76_dump_mib_phy(struct at76_priv *priv)
                  "mpdu_max_length %d cca_mode_supported %d operation_rate_set "
                  "0x%x 0x%x 0x%x 0x%x channel_id %d current_cca_mode %d "
                  "phy_type %d current_reg_domain %d",
-                 wiphy_name(priv->hw->wiphy), le32_to_cpu(m->ed_threshold),
+                 priv->netdev->name, le32_to_cpu(m->ed_threshold),
                  le16_to_cpu(m->slot_time), le16_to_cpu(m->sifs_time),
                  le16_to_cpu(m->preamble_length),
                  le16_to_cpu(m->plcp_header_length),
@@ -1231,14 +1238,13 @@ static void at76_dump_mib_local(struct at76_priv *priv)
         ret = at76_get_mib(priv->udev, MIB_LOCAL, m, sizeof(struct mib_local));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (LOCAL) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB LOCAL: beacon_enable %d "
                  "txautorate_fallback %d ssid_size %d promiscuous_mode %d "
-                 "preamble_type %d", wiphy_name(priv->hw->wiphy),
-                 m->beacon_enable,
+                 "preamble_type %d", priv->netdev->name, m->beacon_enable,
                  m->txautorate_fallback, m->ssid_size, m->promiscuous_mode,
                  m->preamble_type);
 exit:
@@ -1257,21 +1263,118 @@ static void at76_dump_mib_mdomain(struct at76_priv *priv)
                            sizeof(struct mib_mdomain));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_get_mib (MDOMAIN) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 goto exit;
         }
 
         at76_dbg(DBG_MIB, "%s: MIB MDOMAIN: channel_list %s",
-                 wiphy_name(priv->hw->wiphy),
+                 priv->netdev->name,
                  hex2str(m->channel_list, sizeof(m->channel_list)));
 
         at76_dbg(DBG_MIB, "%s: MIB MDOMAIN: tx_powerlevel %s",
-                 wiphy_name(priv->hw->wiphy),
+                 priv->netdev->name,
                  hex2str(m->tx_powerlevel, sizeof(m->tx_powerlevel)));
 exit:
         kfree(m);
 }
 
+static int at76_get_current_bssid(struct at76_priv *priv)
+{
+        int ret = 0;
+        struct mib_mac_mgmt *mac_mgmt =
+            kmalloc(sizeof(struct mib_mac_mgmt), GFP_KERNEL);
+
+        if (!mac_mgmt) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_MGMT, mac_mgmt,
+                           sizeof(struct mib_mac_mgmt));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib failed: %d\n",
+                       priv->netdev->name, ret);
+                goto error;
+        }
+        memcpy(priv->bssid, mac_mgmt->current_bssid, ETH_ALEN);
+        printk(KERN_INFO "%s: using BSSID %s\n", priv->netdev->name,
+               mac2str(priv->bssid));
+error:
+        kfree(mac_mgmt);
+exit:
+        return ret;
+}
+
+static int at76_get_current_channel(struct at76_priv *priv)
+{
+        int ret = 0;
+        struct mib_phy *phy = kmalloc(sizeof(struct mib_phy), GFP_KERNEL);
+
+        if (!phy) {
+                ret = -ENOMEM;
+                goto exit;
+        }
+        ret = at76_get_mib(priv->udev, MIB_PHY, phy, sizeof(struct mib_phy));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib(MIB_PHY) failed: %d\n",
+                       priv->netdev->name, ret);
+                goto error;
+        }
+        priv->channel = phy->channel_id;
+error:
+        kfree(phy);
+exit:
+        return ret;
+}
+
+/**
+ * at76_start_scan - start a scan
+ *
+ * @use_essid - use the configured ESSID in non passive mode
+ */
+static int at76_start_scan(struct at76_priv *priv, int use_essid)
+{
+        struct at76_req_scan scan;
+
+        memset(&scan, 0, sizeof(struct at76_req_scan));
+        memset(scan.bssid, 0xff, ETH_ALEN);
+
+        if (use_essid) {
+                memcpy(scan.essid, priv->essid, IW_ESSID_MAX_SIZE);
+                scan.essid_size = priv->essid_size;
+        } else
+                scan.essid_size = 0;
+
+        /* jal: why should we start at a certain channel? we do scan the whole
+           range allowed by reg domain. */
+        scan.channel = priv->channel;
+
+        /* atmelwlandriver differs between scan type 0 and 1 (active/passive)
+           For ad-hoc mode, it uses type 0 only. */
+        scan.scan_type = priv->scan_mode;
+
+        /* INFO: For probe_delay, not multiplying by 1024 as this will be
+           slightly less than min_channel_time
+           (per spec: probe delay < min. channel time) */
+        scan.min_channel_time = cpu_to_le16(priv->scan_min_time);
+        scan.max_channel_time = cpu_to_le16(priv->scan_max_time);
+        scan.probe_delay = cpu_to_le16(priv->scan_min_time * 1000);
+        scan.international_scan = 0;
+
+        /* other values are set to 0 for type 0 */
+
+        at76_dbg(DBG_PROGRESS, "%s: start_scan (use_essid = %d, intl = %d, "
+                 "channel = %d, probe_delay = %d, scan_min_time = %d, "
+                 "scan_max_time = %d)",
+                 priv->netdev->name, use_essid,
+                 scan.international_scan, scan.channel,
+                 le16_to_cpu(scan.probe_delay),
+                 le16_to_cpu(scan.min_channel_time),
+                 le16_to_cpu(scan.max_channel_time));
+
+        return at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
+}
+
 /* Enable monitor mode */
 static int at76_start_monitor(struct at76_priv *priv)
 {
@@ -1292,6 +1395,86 @@ static int at76_start_monitor(struct at76_priv *priv)
         return ret;
 }
 
+static int at76_start_ibss(struct at76_priv *priv)
+{
+        struct at76_req_ibss bss;
+        int ret;
+
+        WARN_ON(priv->mac_state != MAC_OWN_IBSS);
+        if (priv->mac_state != MAC_OWN_IBSS)
+                return -EBUSY;
+
+        memset(&bss, 0, sizeof(struct at76_req_ibss));
+        memset(bss.bssid, 0xff, ETH_ALEN);
+        memcpy(bss.essid, priv->essid, IW_ESSID_MAX_SIZE);
+        bss.essid_size = priv->essid_size;
+        bss.bss_type = ADHOC_MODE;
+        bss.channel = priv->channel;
+
+        ret = at76_set_card_command(priv->udev, CMD_START_IBSS, &bss,
+                                    sizeof(struct at76_req_ibss));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: start_ibss failed: %d\n",
+                       priv->netdev->name, ret);
+                return ret;
+        }
+
+        ret = at76_wait_completion(priv, CMD_START_IBSS);
+        if (ret != CMD_STATUS_COMPLETE) {
+                printk(KERN_ERR "%s: start_ibss failed to complete, %d\n",
+                       priv->netdev->name, ret);
+                return ret;
+        }
+
+        ret = at76_get_current_bssid(priv);
+        if (ret < 0)
+                return ret;
+
+        ret = at76_get_current_channel(priv);
+        if (ret < 0)
+                return ret;
+
+        /* not sure what this is good for ??? */
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, ibss_change);
+        priv->mib_buf.data.byte = 0;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: set_mib (ibss change ok) failed: %d\n",
+                       priv->netdev->name, ret);
+                return ret;
+        }
+
+        netif_carrier_on(priv->netdev);
+        netif_start_queue(priv->netdev);
+        return 0;
+}
+
+/* Request card to join BSS in managed or ad-hoc mode */
+static int at76_join_bss(struct at76_priv *priv, struct bss_info *ptr)
+{
+        struct at76_req_join join;
+
+        BUG_ON(!ptr);
+
+        memset(&join, 0, sizeof(struct at76_req_join));
+        memcpy(join.bssid, ptr->bssid, ETH_ALEN);
+        memcpy(join.essid, ptr->ssid, ptr->ssid_len);
+        join.essid_size = ptr->ssid_len;
+        join.bss_type = (priv->iw_mode == IW_MODE_ADHOC ? 1 : 2);
+        join.channel = ptr->channel;
+        join.timeout = cpu_to_le16(2000);
+
+        at76_dbg(DBG_PROGRESS,
+                 "%s join addr %s ssid %s type %d ch %d timeout %d",
+                 priv->netdev->name, mac2str(join.bssid), join.essid,
+                 join.bss_type, join.channel, le16_to_cpu(join.timeout));
+        return at76_set_card_command(priv->udev, CMD_JOIN, &join,
+                                     sizeof(struct at76_req_join));
+}
+
 /* Calculate padding from txbuf->wlength (which excludes the USB TX header),
    likely to compensate a flaw in the AT76C503A USB part ... */
 static inline int at76_calc_padding(int wlen)
@@ -1310,6 +1493,14 @@ static inline int at76_calc_padding(int wlen)
         return 0;
 }
 
+/* We are doing a lot of things here in an interrupt. Need
+   a bh handler (Watching TV with a TV card is probably
+   a good test: if you see flickers, we are doing too much.
+   Currently I do see flickers... even with our tasklet :-( )
+   Maybe because the bttv driver and usb-uhci use the same interrupt
+*/
+/* Or maybe because our BH handler is preempting bttv's BH handler.. BHs don't
+ * solve everything.. (alex) */
 static void at76_rx_callback(struct urb *urb)
 {
         struct at76_priv *priv = urb->context;
@@ -1319,6 +1510,1758 @@ static void at76_rx_callback(struct urb *urb)
         return;
 }
 
+static void at76_tx_callback(struct urb *urb)
+{
+        struct at76_priv *priv = urb->context;
+        struct net_device_stats *stats = &priv->stats;
+        unsigned long flags;
+        struct at76_tx_buffer *mgmt_buf;
+        int ret;
+
+        switch (urb->status) {
+        case 0:
+                stats->tx_packets++;
+                break;
+        case -ENOENT:
+        case -ECONNRESET:
+                /* urb has been unlinked */
+                return;
+        default:
+                at76_dbg(DBG_URB, "%s - nonzero tx status received: %d",
+                         __func__, urb->status);
+                stats->tx_errors++;
+                break;
+        }
+
+        spin_lock_irqsave(&priv->mgmt_spinlock, flags);
+        mgmt_buf = priv->next_mgmt_bulk;
+        priv->next_mgmt_bulk = NULL;
+        spin_unlock_irqrestore(&priv->mgmt_spinlock, flags);
+
+        if (!mgmt_buf) {
+                netif_wake_queue(priv->netdev);
+                return;
+        }
+
+        /* we don't copy the padding bytes, but add them
+           to the length */
+        memcpy(priv->bulk_out_buffer, mgmt_buf,
+               le16_to_cpu(mgmt_buf->wlength) + AT76_TX_HDRLEN);
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe,
+                          priv->bulk_out_buffer,
+                          le16_to_cpu(mgmt_buf->wlength) + mgmt_buf->padding +
+                          AT76_TX_HDRLEN, at76_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret)
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       priv->netdev->name, ret);
+
+        kfree(mgmt_buf);
+}
+
+/* Send a management frame on bulk-out.  txbuf->wlength must be set */
+static int at76_tx_mgmt(struct at76_priv *priv, struct at76_tx_buffer *txbuf)
+{
+        unsigned long flags;
+        int ret;
+        int urb_status;
+        void *oldbuf = NULL;
+
+        netif_carrier_off(priv->netdev);        /* stop netdev watchdog */
+        netif_stop_queue(priv->netdev); /* stop tx data packets */
+
+        spin_lock_irqsave(&priv->mgmt_spinlock, flags);
+
+        urb_status = priv->tx_urb->status;
+        if (urb_status == -EINPROGRESS) {
+                /* cannot transmit now, put in the queue */
+                oldbuf = priv->next_mgmt_bulk;
+                priv->next_mgmt_bulk = txbuf;
+        }
+        spin_unlock_irqrestore(&priv->mgmt_spinlock, flags);
+
+        if (oldbuf) {
+                /* a data/mgmt tx is already pending in the URB -
+                   if this is no error in some situations we must
+                   implement a queue or silently modify the old msg */
+                printk(KERN_ERR "%s: removed pending mgmt buffer %s\n",
+                       priv->netdev->name, hex2str(oldbuf, 64));
+                kfree(oldbuf);
+                return 0;
+        }
+
+        txbuf->tx_rate = TX_RATE_1MBIT;
+        txbuf->padding = at76_calc_padding(le16_to_cpu(txbuf->wlength));
+        memset(txbuf->reserved, 0, sizeof(txbuf->reserved));
+
+        if (priv->next_mgmt_bulk)
+                printk(KERN_ERR "%s: URB status %d, but mgmt is pending\n",
+                       priv->netdev->name, urb_status);
+
+        at76_dbg(DBG_TX_MGMT,
+                 "%s: tx mgmt: wlen %d tx_rate %d pad %d %s",
+                 priv->netdev->name, le16_to_cpu(txbuf->wlength),
+                 txbuf->tx_rate, txbuf->padding,
+                 hex2str(txbuf->packet, le16_to_cpu(txbuf->wlength)));
+
+        /* txbuf was not consumed above -> send mgmt msg immediately */
+        memcpy(priv->bulk_out_buffer, txbuf,
+               le16_to_cpu(txbuf->wlength) + AT76_TX_HDRLEN);
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe,
+                          priv->bulk_out_buffer,
+                          le16_to_cpu(txbuf->wlength) + txbuf->padding +
+                          AT76_TX_HDRLEN, at76_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret)
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       priv->netdev->name, ret);
+
+        kfree(txbuf);
+
+        return ret;
+}
+
+/* Go to the next information element */
+static inline void next_ie(struct ieee80211_info_element **ie)
+{
+        *ie = (struct ieee80211_info_element *)(&(*ie)->data[(*ie)->len]);
+}
+
+/* Challenge is the challenge string (in TLV format)
+   we got with seq_nr 2 for shared secret authentication only and
+   send in seq_nr 3 WEP encrypted to prove we have the correct WEP key;
+   otherwise it is NULL */
+static int at76_auth_req(struct at76_priv *priv, struct bss_info *bss,
+                         int seq_nr, struct ieee80211_info_element *challenge)
+{
+        struct at76_tx_buffer *tx_buffer;
+        struct ieee80211_hdr_3addr *mgmt;
+        struct ieee80211_auth *req;
+        int buf_len = (seq_nr != 3 ? AUTH_FRAME_SIZE :
+                       AUTH_FRAME_SIZE + 1 + 1 + challenge->len);
+
+        BUG_ON(!bss);
+        BUG_ON(seq_nr == 3 && !challenge);
+        tx_buffer = kmalloc(buf_len + MAX_PADDING_SIZE, GFP_ATOMIC);
+        if (!tx_buffer)
+                return -ENOMEM;
+
+        req = (struct ieee80211_auth *)tx_buffer->packet;
+        mgmt = &req->header;
+
+        /* make wireless header */
+        /* first auth msg is not encrypted, only the second (seq_nr == 3) */
+        mgmt->frame_ctl =
+            cpu_to_le16(IEEE80211_FTYPE_MGMT | IEEE80211_STYPE_AUTH |
+                        (seq_nr == 3 ? IEEE80211_FCTL_PROTECTED : 0));
+
+        mgmt->duration_id = cpu_to_le16(0x8000);
+        memcpy(mgmt->addr1, bss->bssid, ETH_ALEN);
+        memcpy(mgmt->addr2, priv->netdev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->addr3, bss->bssid, ETH_ALEN);
+        mgmt->seq_ctl = cpu_to_le16(0);
+
+        req->algorithm = cpu_to_le16(priv->auth_mode);
+        req->transaction = cpu_to_le16(seq_nr);
+        req->status = cpu_to_le16(0);
+
+        if (seq_nr == 3)
+                memcpy(req->info_element, challenge, 1 + 1 + challenge->len);
+
+        /* init. at76_priv tx header */
+        tx_buffer->wlength = cpu_to_le16(buf_len - AT76_TX_HDRLEN);
+        at76_dbg(DBG_TX_MGMT, "%s: AuthReq bssid %s alg %d seq_nr %d",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(req->algorithm), le16_to_cpu(req->transaction));
+        if (seq_nr == 3)
+                at76_dbg(DBG_TX_MGMT, "%s: AuthReq challenge: %s ...",
+                         priv->netdev->name, hex2str(req->info_element, 18));
+
+        /* either send immediately (if no data tx is pending
+           or put it in pending list */
+        return at76_tx_mgmt(priv, tx_buffer);
+}
+
+static int at76_assoc_req(struct at76_priv *priv, struct bss_info *bss)
+{
+        struct at76_tx_buffer *tx_buffer;
+        struct ieee80211_hdr_3addr *mgmt;
+        struct ieee80211_assoc_request *req;
+        struct ieee80211_info_element *ie;
+        char *essid;
+        int essid_len;
+        u16 capa;
+
+        BUG_ON(!bss);
+
+        tx_buffer = kmalloc(ASSOCREQ_MAX_SIZE + MAX_PADDING_SIZE, GFP_ATOMIC);
+        if (!tx_buffer)
+                return -ENOMEM;
+
+        req = (struct ieee80211_assoc_request *)tx_buffer->packet;
+        mgmt = &req->header;
+        ie = req->info_element;
+
+        /* make wireless header */
+        mgmt->frame_ctl = cpu_to_le16(IEEE80211_FTYPE_MGMT |
+                                      IEEE80211_STYPE_ASSOC_REQ);
+
+        mgmt->duration_id = cpu_to_le16(0x8000);
+        memcpy(mgmt->addr1, bss->bssid, ETH_ALEN);
+        memcpy(mgmt->addr2, priv->netdev->dev_addr, ETH_ALEN);
+        memcpy(mgmt->addr3, bss->bssid, ETH_ALEN);
+        mgmt->seq_ctl = cpu_to_le16(0);
+
+        /* we must set the Privacy bit in the capabilities to assure an
+           Agere-based AP with optional WEP transmits encrypted frames
+           to us.  AP only set the Privacy bit in their capabilities
+           if WEP is mandatory in the BSS! */
+        capa = bss->capa;
+        if (priv->wep_enabled)
+                capa |= WLAN_CAPABILITY_PRIVACY;
+        if (priv->preamble_type != PREAMBLE_TYPE_LONG)
+                capa |= WLAN_CAPABILITY_SHORT_PREAMBLE;
+        req->capability = cpu_to_le16(capa);
+
+        req->listen_interval = cpu_to_le16(2 * bss->beacon_interval);
+
+        /* write TLV data elements */
+
+        ie->id = MFIE_TYPE_SSID;
+        ie->len = bss->ssid_len;
+        memcpy(ie->data, bss->ssid, bss->ssid_len);
+        next_ie(&ie);
+
+        ie->id = MFIE_TYPE_RATES;
+        ie->len = sizeof(hw_rates);
+        memcpy(ie->data, hw_rates, sizeof(hw_rates));
+        next_ie(&ie);           /* ie points behind the supp_rates field */
+
+        /* init. at76_priv tx header */
+        tx_buffer->wlength = cpu_to_le16((u8 *)ie - (u8 *)mgmt);
+
+        ie = req->info_element;
+        essid = ie->data;
+        essid_len = min_t(int, IW_ESSID_MAX_SIZE, ie->len);
+
+        next_ie(&ie);           /* points to IE of rates now */
+        at76_dbg(DBG_TX_MGMT,
+                 "%s: AssocReq bssid %s capa 0x%04x ssid %.*s rates %s",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(req->capability), essid_len, essid,
+                 hex2str(ie->data, ie->len));
+
+        /* either send immediately (if no data tx is pending
+           or put it in pending list */
+        return at76_tx_mgmt(priv, tx_buffer);
+}
+
+/* We got to check the bss_list for old entries */
+static void at76_bss_list_timeout(unsigned long par)
+{
+        struct at76_priv *priv = (struct at76_priv *)par;
+        unsigned long flags;
+        struct list_head *lptr, *nptr;
+        struct bss_info *ptr;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        list_for_each_safe(lptr, nptr, &priv->bss_list) {
+
+                ptr = list_entry(lptr, struct bss_info, list);
+
+                if (ptr != priv->curr_bss
+                    && time_after(jiffies, ptr->last_rx + BSS_LIST_TIMEOUT)) {
+                        at76_dbg(DBG_BSS_TABLE_RM,
+                                 "%s: bss_list: removing old BSS %s ch %d",
+                                 priv->netdev->name, mac2str(ptr->bssid),
+                                 ptr->channel);
+                        list_del(&ptr->list);
+                        kfree(ptr);
+                }
+        }
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+        /* restart the timer */
+        mod_timer(&priv->bss_list_timer, jiffies + BSS_LIST_TIMEOUT);
+}
+
+static inline void at76_set_mac_state(struct at76_priv *priv,
+                                      enum mac_state mac_state)
+{
+        at76_dbg(DBG_MAC_STATE, "%s state: %s", priv->netdev->name,
+                 mac_states[mac_state]);
+        priv->mac_state = mac_state;
+}
+
+static void at76_dump_bss_table(struct at76_priv *priv)
+{
+        struct bss_info *ptr;
+        unsigned long flags;
+        struct list_head *lptr;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        at76_dbg(DBG_BSS_TABLE, "%s BSS table (curr=%p):", priv->netdev->name,
+                 priv->curr_bss);
+
+        list_for_each(lptr, &priv->bss_list) {
+                ptr = list_entry(lptr, struct bss_info, list);
+                at76_dbg(DBG_BSS_TABLE, "0x%p: bssid %s channel %d ssid %.*s "
+                         "(%s) capa 0x%04x rates %s rssi %d link %d noise %d",
+                         ptr, mac2str(ptr->bssid), ptr->channel, ptr->ssid_len,
+                         ptr->ssid, hex2str(ptr->ssid, ptr->ssid_len),
+                         ptr->capa, hex2str(ptr->rates, ptr->rates_len),
+                         ptr->rssi, ptr->link_qual, ptr->noise_level);
+        }
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+}
+
+/* Called upon successful association to mark interface as connected */
+static void at76_work_assoc_done(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_assoc_done);
+
+        mutex_lock(&priv->mtx);
+
+        WARN_ON(priv->mac_state != MAC_ASSOC);
+        WARN_ON(!priv->curr_bss);
+        if (priv->mac_state != MAC_ASSOC || !priv->curr_bss)
+                goto exit;
+
+        if (priv->iw_mode == IW_MODE_INFRA) {
+                if (priv->pm_mode != AT76_PM_OFF) {
+                        /* calculate the listen interval in units of
+                           beacon intervals of the curr_bss */
+                        u32 pm_period_beacon = (priv->pm_period >> 10) /
+                            priv->curr_bss->beacon_interval;
+
+                        pm_period_beacon = max(pm_period_beacon, 2u);
+                        pm_period_beacon = min(pm_period_beacon, 0xffffu);
+
+                        at76_dbg(DBG_PM,
+                                 "%s: pm_mode %d assoc id 0x%x listen int %d",
+                                 priv->netdev->name, priv->pm_mode,
+                                 priv->assoc_id, pm_period_beacon);
+
+                        at76_set_associd(priv, priv->assoc_id);
+                        at76_set_listen_interval(priv, (u16)pm_period_beacon);
+                }
+                schedule_delayed_work(&priv->dwork_beacon, BEACON_TIMEOUT);
+        }
+        at76_set_pm_mode(priv);
+
+        netif_carrier_on(priv->netdev);
+        netif_wake_queue(priv->netdev);
+        at76_set_mac_state(priv, MAC_CONNECTED);
+        at76_iwevent_bss_connect(priv->netdev, priv->curr_bss->bssid);
+        at76_dbg(DBG_PROGRESS, "%s: connected to BSSID %s",
+                 priv->netdev->name, mac2str(priv->curr_bss->bssid));
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* We only store the new mac address in netdev struct,
+   it gets set when the netdev is opened. */
+static int at76_set_mac_address(struct net_device *netdev, void *addr)
+{
+        struct sockaddr *mac = addr;
+        memcpy(netdev->dev_addr, mac->sa_data, ETH_ALEN);
+        return 1;
+}
+
+static struct net_device_stats *at76_get_stats(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        return &priv->stats;
+}
+
+static struct iw_statistics *at76_get_wireless_stats(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "RETURN qual %d level %d noise %d updated %d",
+                 priv->wstats.qual.qual, priv->wstats.qual.level,
+                 priv->wstats.qual.noise, priv->wstats.qual.updated);
+
+        return &priv->wstats;
+}
+
+static void at76_set_multicast(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int promisc;
+
+        promisc = ((netdev->flags & IFF_PROMISC) != 0);
+        if (promisc != priv->promisc) {
+                /* This gets called in interrupt, must reschedule */
+                priv->promisc = promisc;
+                schedule_work(&priv->work_set_promisc);
+        }
+}
+
+/* Stop all network activity, flush all pending tasks */
+static void at76_quiesce(struct at76_priv *priv)
+{
+        unsigned long flags;
+
+        netif_stop_queue(priv->netdev);
+        netif_carrier_off(priv->netdev);
+
+        at76_set_mac_state(priv, MAC_INIT);
+
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
+        cancel_delayed_work(&priv->dwork_restart);
+
+        spin_lock_irqsave(&priv->mgmt_spinlock, flags);
+        kfree(priv->next_mgmt_bulk);
+        priv->next_mgmt_bulk = NULL;
+        spin_unlock_irqrestore(&priv->mgmt_spinlock, flags);
+}
+
+/*******************************************************************************
+ * at76_priv implementations of iw_handler functions:
+ */
+static int at76_iw_handler_commit(struct net_device *netdev,
+                                  struct iw_request_info *info,
+                                  void *null, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s %s: restarting the device", netdev->name,
+                 __func__);
+
+        if (priv->mac_state != MAC_INIT)
+                at76_quiesce(priv);
+
+        /* Wait half second before the restart to process subsequent
+         * requests from the same iwconfig in a single restart */
+        schedule_delayed_work(&priv->dwork_restart, HZ / 2);
+
+        return 0;
+}
+
+static int at76_iw_handler_get_name(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    char *name, char *extra)
+{
+        strcpy(name, "IEEE 802.11b");
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWNAME - name %s", netdev->name, name);
+        return 0;
+}
+
+static int at76_iw_handler_set_freq(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_freq *freq, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int chan = -1;
+        int ret = -EIWCOMMIT;
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWFREQ - freq.m %d freq.e %d",
+                 netdev->name, freq->m, freq->e);
+
+        if ((freq->e == 0) && (freq->m <= 1000))
+                /* Setting by channel number */
+                chan = freq->m;
+        else {
+                /* Setting by frequency - search the table */
+                int mult = 1;
+                int i;
+
+                for (i = 0; i < (6 - freq->e); i++)
+                        mult *= 10;
+
+                for (i = 0; i < NUM_CHANNELS; i++) {
+                        if (freq->m == (channel_frequency[i] * mult))
+                                chan = i + 1;
+                }
+        }
+
+        if (chan < 1 || !priv->domain)
+                /* non-positive channels are invalid
+                 * we need a domain info to set the channel
+                 * either that or an invalid frequency was
+                 * provided by the user */
+                ret = -EINVAL;
+        else if (!(priv->domain->channel_map & (1 << (chan - 1)))) {
+                printk(KERN_INFO "%s: channel %d not allowed for domain %s\n",
+                       priv->netdev->name, chan, priv->domain->name);
+                ret = -EINVAL;
+        }
+
+        if (ret == -EIWCOMMIT) {
+                priv->channel = chan;
+                at76_dbg(DBG_IOCTL, "%s: SIOCSIWFREQ - ch %d", netdev->name,
+                         chan);
+        }
+
+        return ret;
+}
+
+static int at76_iw_handler_get_freq(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_freq *freq, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        freq->m = priv->channel;
+        freq->e = 0;
+
+        if (priv->channel)
+                at76_dbg(DBG_IOCTL, "%s: SIOCGIWFREQ - freq %ld x 10e%d",
+                         netdev->name, channel_frequency[priv->channel - 1], 6);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWFREQ - ch %d", netdev->name,
+                 priv->channel);
+
+        return 0;
+}
+
+static int at76_iw_handler_set_mode(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    __u32 *mode, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWMODE - %d", netdev->name, *mode);
+
+        if ((*mode != IW_MODE_ADHOC) && (*mode != IW_MODE_INFRA) &&
+            (*mode != IW_MODE_MONITOR))
+                return -EINVAL;
+
+        priv->iw_mode = *mode;
+        if (priv->iw_mode != IW_MODE_INFRA)
+                priv->pm_mode = AT76_PM_OFF;
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_mode(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    __u32 *mode, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        *mode = priv->iw_mode;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWMODE - %d", netdev->name, *mode);
+
+        return 0;
+}
+
+static int at76_iw_handler_get_range(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_point *data, char *extra)
+{
+        /* inspired by atmel.c */
+        struct at76_priv *priv = netdev_priv(netdev);
+        struct iw_range *range = (struct iw_range *)extra;
+        int i;
+
+        data->length = sizeof(struct iw_range);
+        memset(range, 0, sizeof(struct iw_range));
+
+        /* TODO: range->throughput = xxxxxx; */
+
+        range->min_nwid = 0x0000;
+        range->max_nwid = 0x0000;
+
+        /* this driver doesn't maintain sensitivity information */
+        range->sensitivity = 0;
+
+        range->max_qual.qual = 100;
+        range->max_qual.level = 100;
+        range->max_qual.noise = 0;
+        range->max_qual.updated = IW_QUAL_NOISE_INVALID;
+
+        range->avg_qual.qual = 50;
+        range->avg_qual.level = 50;
+        range->avg_qual.noise = 0;
+        range->avg_qual.updated = IW_QUAL_NOISE_INVALID;
+
+        range->bitrate[0] = 1000000;
+        range->bitrate[1] = 2000000;
+        range->bitrate[2] = 5500000;
+        range->bitrate[3] = 11000000;
+        range->num_bitrates = 4;
+
+        range->min_rts = 0;
+        range->max_rts = MAX_RTS_THRESHOLD;
+
+        range->min_frag = MIN_FRAG_THRESHOLD;
+        range->max_frag = MAX_FRAG_THRESHOLD;
+
+        range->pmp_flags = IW_POWER_PERIOD;
+        range->pmt_flags = IW_POWER_ON;
+        range->pm_capa = IW_POWER_PERIOD | IW_POWER_ALL_R;
+
+        range->encoding_size[0] = WEP_SMALL_KEY_LEN;
+        range->encoding_size[1] = WEP_LARGE_KEY_LEN;
+        range->num_encoding_sizes = 2;
+        range->max_encoding_tokens = WEP_KEYS;
+
+        /* both WL-240U and Linksys WUSB11 v2.6 specify 15 dBm as output power
+           - take this for all (ignore antenna gains) */
+        range->txpower[0] = 15;
+        range->num_txpower = 1;
+        range->txpower_capa = IW_TXPOW_DBM;
+
+        range->we_version_source = WIRELESS_EXT;
+        range->we_version_compiled = WIRELESS_EXT;
+
+        /* same as the values used in atmel.c */
+        range->retry_capa = IW_RETRY_LIMIT;
+        range->retry_flags = IW_RETRY_LIMIT;
+        range->r_time_flags = 0;
+        range->min_retry = 1;
+        range->max_retry = 255;
+
+        range->num_channels = NUM_CHANNELS;
+        range->num_frequency = 0;
+
+        for (i = 0; i < NUM_CHANNELS; i++) {
+                /* test if channel map bit is raised */
+                if (priv->domain->channel_map & (0x1 << i)) {
+                        range->num_frequency += 1;
+
+                        range->freq[i].i = i + 1;
+                        range->freq[i].m = channel_frequency[i] * 100000;
+                        range->freq[i].e = 1;   /* freq * 10^1 */
+                }
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRANGE", netdev->name);
+
+        return 0;
+}
+
+static int at76_iw_handler_set_spy(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWSPY - number of addresses %d",
+                 netdev->name, data->length);
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_set_spy(priv->netdev, info, (union iwreq_data *)data,
+                                 extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        return ret;
+}
+
+static int at76_iw_handler_get_spy(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_point *data, char *extra)
+{
+
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_get_spy(priv->netdev, info,
+                                 (union iwreq_data *)data, extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWSPY - number of addresses %d",
+                 netdev->name, data->length);
+
+        return ret;
+}
+
+static int at76_iw_handler_set_thrspy(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWTHRSPY - number of addresses %d)",
+                 netdev->name, data->length);
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_set_thrspy(netdev, info, (union iwreq_data *)data,
+                                    extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        return ret;
+}
+
+static int at76_iw_handler_get_thrspy(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret;
+
+        spin_lock_bh(&priv->spy_spinlock);
+        ret = iw_handler_get_thrspy(netdev, info, (union iwreq_data *)data,
+                                    extra);
+        spin_unlock_bh(&priv->spy_spinlock);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWTHRSPY - number of addresses %d)",
+                 netdev->name, data->length);
+
+        return ret;
+}
+
+static int at76_iw_handler_set_wap(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct sockaddr *ap_addr, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWAP - wap/bssid %s", netdev->name,
+                 mac2str(ap_addr->sa_data));
+
+        /* if the incoming address == ff:ff:ff:ff:ff:ff, the user has
+           chosen any or auto AP preference */
+        if (is_broadcast_ether_addr(ap_addr->sa_data)
+            || is_zero_ether_addr(ap_addr->sa_data))
+                priv->wanted_bssid_valid = 0;
+        else {
+                /* user wants to set a preferred AP address */
+                priv->wanted_bssid_valid = 1;
+                memcpy(priv->wanted_bssid, ap_addr->sa_data, ETH_ALEN);
+        }
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_wap(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct sockaddr *ap_addr, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        ap_addr->sa_family = ARPHRD_ETHER;
+        memcpy(ap_addr->sa_data, priv->bssid, ETH_ALEN);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWAP - wap/bssid %s", netdev->name,
+                 mac2str(ap_addr->sa_data));
+
+        return 0;
+}
+
+static int at76_iw_handler_set_scan(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWSCAN", netdev->name);
+
+        if (mutex_lock_interruptible(&priv->mtx))
+                return -EINTR;
+
+        if (!netif_running(netdev)) {
+                ret = -ENETDOWN;
+                goto exit;
+        }
+
+        /* jal: we don't allow "iwlist ethX scan" while we are
+           in monitor mode */
+        if (priv->iw_mode == IW_MODE_MONITOR) {
+                ret = -EBUSY;
+                goto exit;
+        }
+
+        /* Discard old scan results */
+        if ((jiffies - priv->last_scan) > (20 * HZ))
+                priv->scan_state = SCAN_IDLE;
+        priv->last_scan = jiffies;
+
+        /* Initiate a scan command */
+        if (priv->scan_state == SCAN_IN_PROGRESS) {
+                ret = -EBUSY;
+                goto exit;
+        }
+
+        priv->scan_state = SCAN_IN_PROGRESS;
+
+        at76_quiesce(priv);
+
+        /* Try to do passive or active scan if WE asks as. */
+        if (wrqu->data.length
+            && wrqu->data.length == sizeof(struct iw_scan_req)) {
+                struct iw_scan_req *req = (struct iw_scan_req *)extra;
+
+                if (req->scan_type == IW_SCAN_TYPE_PASSIVE)
+                        priv->scan_mode = SCAN_TYPE_PASSIVE;
+                else if (req->scan_type == IW_SCAN_TYPE_ACTIVE)
+                        priv->scan_mode = SCAN_TYPE_ACTIVE;
+
+                /* Sanity check values? */
+                if (req->min_channel_time > 0)
+                        priv->scan_min_time = req->min_channel_time;
+
+                if (req->max_channel_time > 0)
+                        priv->scan_max_time = req->max_channel_time;
+        }
+
+        /* change to scanning state */
+        at76_set_mac_state(priv, MAC_SCANNING);
+        schedule_work(&priv->work_start_scan);
+
+exit:
+        mutex_unlock(&priv->mtx);
+        return ret;
+}
+
+static int at76_iw_handler_get_scan(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        unsigned long flags;
+        struct list_head *lptr, *nptr;
+        struct bss_info *curr_bss;
+        struct iw_event *iwe = kmalloc(sizeof(struct iw_event), GFP_KERNEL);
+        char *curr_val, *curr_pos = extra;
+        int i;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWSCAN", netdev->name);
+
+        if (!iwe)
+                return -ENOMEM;
+
+        if (priv->scan_state != SCAN_COMPLETED) {
+                /* scan not yet finished */
+                kfree(iwe);
+                return -EAGAIN;
+        }
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+
+        list_for_each_safe(lptr, nptr, &priv->bss_list) {
+                curr_bss = list_entry(lptr, struct bss_info, list);
+
+                iwe->cmd = SIOCGIWAP;
+                iwe->u.ap_addr.sa_family = ARPHRD_ETHER;
+                memcpy(iwe->u.ap_addr.sa_data, curr_bss->bssid, 6);
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_ADDR_LEN);
+
+                iwe->u.data.length = curr_bss->ssid_len;
+                iwe->cmd = SIOCGIWESSID;
+                iwe->u.data.flags = 1;
+
+                curr_pos = iwe_stream_add_point(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                curr_bss->ssid);
+
+                iwe->cmd = SIOCGIWMODE;
+                iwe->u.mode = (curr_bss->capa & WLAN_CAPABILITY_IBSS) ?
+                    IW_MODE_ADHOC :
+                    (curr_bss->capa & WLAN_CAPABILITY_ESS) ?
+                    IW_MODE_MASTER : IW_MODE_AUTO;
+                /* IW_MODE_AUTO = 0 which I thought is
+                 * the most logical value to return in this case */
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_UINT_LEN);
+
+                iwe->cmd = SIOCGIWFREQ;
+                iwe->u.freq.m = curr_bss->channel;
+                iwe->u.freq.e = 0;
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_FREQ_LEN);
+
+                iwe->cmd = SIOCGIWENCODE;
+                if (curr_bss->capa & WLAN_CAPABILITY_PRIVACY)
+                        iwe->u.data.flags = IW_ENCODE_ENABLED | IW_ENCODE_NOKEY;
+                else
+                        iwe->u.data.flags = IW_ENCODE_DISABLED;
+
+                iwe->u.data.length = 0;
+                curr_pos = iwe_stream_add_point(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                NULL);
+
+                /* Add quality statistics */
+                iwe->cmd = IWEVQUAL;
+                iwe->u.qual.noise = 0;
+                iwe->u.qual.updated =
+                    IW_QUAL_NOISE_INVALID | IW_QUAL_LEVEL_UPDATED;
+                iwe->u.qual.level = (curr_bss->rssi * 100 / 42);
+                if (iwe->u.qual.level > 100)
+                        iwe->u.qual.level = 100;
+                if (at76_is_intersil(priv->board_type))
+                        iwe->u.qual.qual = curr_bss->link_qual;
+                else {
+                        iwe->u.qual.qual = 0;
+                        iwe->u.qual.updated |= IW_QUAL_QUAL_INVALID;
+                }
+                /* Add new value to event */
+                curr_pos = iwe_stream_add_event(info, curr_pos,
+                                                extra + IW_SCAN_MAX_DATA, iwe,
+                                                IW_EV_QUAL_LEN);
+
+                /* Rate: stuffing multiple values in a single event requires
+                 * a bit more of magic - Jean II */
+                curr_val = curr_pos + IW_EV_LCP_LEN;
+
+                iwe->cmd = SIOCGIWRATE;
+                /* Those two flags are ignored... */
+                iwe->u.bitrate.fixed = 0;
+                iwe->u.bitrate.disabled = 0;
+                /* Max 8 values */
+                for (i = 0; i < curr_bss->rates_len; i++) {
+                        /* Bit rate given in 500 kb/s units (+ 0x80) */
+                        iwe->u.bitrate.value =
+                            ((curr_bss->rates[i] & 0x7f) * 500000);
+                        /* Add new value to event */
+                        curr_val = iwe_stream_add_value(info, curr_pos,
+                                                        curr_val,
+                                                        extra +
+                                                        IW_SCAN_MAX_DATA, iwe,
+                                                        IW_EV_PARAM_LEN);
+                }
+
+                /* Check if we added any event */
+                if ((curr_val - curr_pos) > IW_EV_LCP_LEN)
+                        curr_pos = curr_val;
+
+                /* more information may be sent back using IWECUSTOM */
+
+        }
+
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+
+        data->length = (curr_pos - extra);
+        data->flags = 0;
+
+        kfree(iwe);
+        return 0;
+}
+
+static int at76_iw_handler_set_essid(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWESSID - %s", netdev->name, extra);
+
+        if (data->flags) {
+                memcpy(priv->essid, extra, data->length);
+                priv->essid_size = data->length;
+        } else
+                priv->essid_size = 0;   /* Use any SSID */
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_essid(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_point *data, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        if (priv->essid_size) {
+                /* not the ANY ssid in priv->essid */
+                data->flags = 1;
+                data->length = priv->essid_size;
+                memcpy(extra, priv->essid, data->length);
+        } else {
+                /* the ANY ssid was specified */
+                if (priv->mac_state == MAC_CONNECTED && priv->curr_bss) {
+                        /* report the SSID we have found */
+                        data->flags = 1;
+                        data->length = priv->curr_bss->ssid_len;
+                        memcpy(extra, priv->curr_bss->ssid, data->length);
+                } else {
+                        /* report ANY back */
+                        data->flags = 0;
+                        data->length = 0;
+                }
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWESSID - %.*s", netdev->name,
+                 data->length, extra);
+
+        return 0;
+}
+
+static int at76_iw_handler_set_rate(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *bitrate, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWRATE - %d", netdev->name,
+                 bitrate->value);
+
+        switch (bitrate->value) {
+        case -1:
+                priv->txrate = TX_RATE_AUTO;
+                break;          /* auto rate */
+        case 1000000:
+                priv->txrate = TX_RATE_1MBIT;
+                break;
+        case 2000000:
+                priv->txrate = TX_RATE_2MBIT;
+                break;
+        case 5500000:
+                priv->txrate = TX_RATE_5_5MBIT;
+                break;
+        case 11000000:
+                priv->txrate = TX_RATE_11MBIT;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        return ret;
+}
+
+static int at76_iw_handler_get_rate(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *bitrate, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        switch (priv->txrate) {
+                /* return max rate if RATE_AUTO */
+        case TX_RATE_AUTO:
+                bitrate->value = 11000000;
+                break;
+        case TX_RATE_1MBIT:
+                bitrate->value = 1000000;
+                break;
+        case TX_RATE_2MBIT:
+                bitrate->value = 2000000;
+                break;
+        case TX_RATE_5_5MBIT:
+                bitrate->value = 5500000;
+                break;
+        case TX_RATE_11MBIT:
+                bitrate->value = 11000000;
+                break;
+        default:
+                ret = -EINVAL;
+        }
+
+        bitrate->fixed = (priv->txrate != TX_RATE_AUTO);
+        bitrate->disabled = 0;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRATE - %d", netdev->name,
+                 bitrate->value);
+
+        return ret;
+}
+
+static int at76_iw_handler_set_rts(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_param *rts, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+        int rthr = rts->value;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWRTS - value %d disabled %s",
+                 netdev->name, rts->value, (rts->disabled) ? "true" : "false");
+
+        if (rts->disabled)
+                rthr = MAX_RTS_THRESHOLD;
+
+        if ((rthr < 0) || (rthr > MAX_RTS_THRESHOLD))
+                ret = -EINVAL;
+        else
+                priv->rts_threshold = rthr;
+
+        return ret;
+}
+
+static int at76_iw_handler_get_rts(struct net_device *netdev,
+                                   struct iw_request_info *info,
+                                   struct iw_param *rts, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        rts->value = priv->rts_threshold;
+        rts->disabled = (rts->value >= MAX_RTS_THRESHOLD);
+        rts->fixed = 1;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRTS - value %d disabled %s",
+                 netdev->name, rts->value, (rts->disabled) ? "true" : "false");
+
+        return 0;
+}
+
+static int at76_iw_handler_set_frag(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *frag, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+        int fthr = frag->value;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWFRAG - value %d, disabled %s",
+                 netdev->name, frag->value,
+                 (frag->disabled) ? "true" : "false");
+
+        if (frag->disabled)
+                fthr = MAX_FRAG_THRESHOLD;
+
+        if ((fthr < MIN_FRAG_THRESHOLD) || (fthr > MAX_FRAG_THRESHOLD))
+                ret = -EINVAL;
+        else
+                priv->frag_threshold = fthr & ~0x1;     /* get an even value */
+
+        return ret;
+}
+
+static int at76_iw_handler_get_frag(struct net_device *netdev,
+                                    struct iw_request_info *info,
+                                    struct iw_param *frag, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        frag->value = priv->frag_threshold;
+        frag->disabled = (frag->value >= MAX_FRAG_THRESHOLD);
+        frag->fixed = 1;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWFRAG - value %d, disabled %s",
+                 netdev->name, frag->value,
+                 (frag->disabled) ? "true" : "false");
+
+        return 0;
+}
+
+static int at76_iw_handler_get_txpow(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *power, char *extra)
+{
+        power->value = 15;
+        power->fixed = 1;       /* No power control */
+        power->disabled = 0;
+        power->flags = IW_TXPOW_DBM;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWTXPOW - txpow %d dBm", netdev->name,
+                 power->value);
+
+        return 0;
+}
+
+/* jal: short retry is handled by the firmware (at least 0.90.x),
+   while long retry is not (?) */
+static int at76_iw_handler_set_retry(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *retry, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWRETRY disabled %d flags 0x%x val %d",
+                 netdev->name, retry->disabled, retry->flags, retry->value);
+
+        if (!retry->disabled && (retry->flags & IW_RETRY_LIMIT)) {
+                if ((retry->flags & IW_RETRY_MIN) ||
+                    !(retry->flags & IW_RETRY_MAX))
+                        priv->short_retry_limit = retry->value;
+                else
+                        ret = -EINVAL;
+        } else
+                ret = -EINVAL;
+
+        return ret;
+}
+
+/* Adapted (ripped) from atmel.c */
+static int at76_iw_handler_get_retry(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *retry, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWRETRY", netdev->name);
+
+        retry->disabled = 0;    /* Can't be disabled */
+        retry->flags = IW_RETRY_LIMIT;
+        retry->value = priv->short_retry_limit;
+
+        return 0;
+}
+
+static int at76_iw_handler_set_encode(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *encoding, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int index = (encoding->flags & IW_ENCODE_INDEX) - 1;
+        int len = encoding->length;
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCSIWENCODE - enc.flags %08x "
+                 "pointer %p len %d", netdev->name, encoding->flags,
+                 encoding->pointer, encoding->length);
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCSIWENCODE - old wepstate: enabled %s key_id %d "
+                 "auth_mode %s", netdev->name,
+                 (priv->wep_enabled) ? "true" : "false", priv->wep_key_id,
+                 (priv->auth_mode ==
+                  WLAN_AUTH_SHARED_KEY) ? "restricted" : "open");
+
+        /* take the old default key if index is invalid */
+        if ((index < 0) || (index >= WEP_KEYS))
+                index = priv->wep_key_id;
+
+        if (len > 0) {
+                if (len > WEP_LARGE_KEY_LEN)
+                        len = WEP_LARGE_KEY_LEN;
+
+                memset(priv->wep_keys[index], 0, WEP_KEY_LEN);
+                memcpy(priv->wep_keys[index], extra, len);
+                priv->wep_keys_len[index] = (len <= WEP_SMALL_KEY_LEN) ?
+                    WEP_SMALL_KEY_LEN : WEP_LARGE_KEY_LEN;
+                priv->wep_enabled = 1;
+        }
+
+        priv->wep_key_id = index;
+        priv->wep_enabled = ((encoding->flags & IW_ENCODE_DISABLED) == 0);
+
+        if (encoding->flags & IW_ENCODE_RESTRICTED)
+                priv->auth_mode = WLAN_AUTH_SHARED_KEY;
+        if (encoding->flags & IW_ENCODE_OPEN)
+                priv->auth_mode = WLAN_AUTH_OPEN;
+
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCSIWENCODE - new wepstate: enabled %s key_id %d "
+                 "key_len %d auth_mode %s", netdev->name,
+                 (priv->wep_enabled) ? "true" : "false", priv->wep_key_id + 1,
+                 priv->wep_keys_len[priv->wep_key_id],
+                 (priv->auth_mode ==
+                  WLAN_AUTH_SHARED_KEY) ? "restricted" : "open");
+
+        return -EIWCOMMIT;
+}
+
+static int at76_iw_handler_get_encode(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      struct iw_point *encoding, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int index = (encoding->flags & IW_ENCODE_INDEX) - 1;
+
+        if ((index < 0) || (index >= WEP_KEYS))
+                index = priv->wep_key_id;
+
+        encoding->flags =
+            (priv->auth_mode == WLAN_AUTH_SHARED_KEY) ?
+            IW_ENCODE_RESTRICTED : IW_ENCODE_OPEN;
+
+        if (!priv->wep_enabled)
+                encoding->flags |= IW_ENCODE_DISABLED;
+
+        if (encoding->pointer) {
+                encoding->length = priv->wep_keys_len[index];
+
+                memcpy(extra, priv->wep_keys[index], priv->wep_keys_len[index]);
+
+                encoding->flags |= (index + 1);
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWENCODE - enc.flags %08x "
+                 "pointer %p len %d", netdev->name, encoding->flags,
+                 encoding->pointer, encoding->length);
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCGIWENCODE - wepstate: enabled %s key_id %d "
+                 "key_len %d auth_mode %s", netdev->name,
+                 (priv->wep_enabled) ? "true" : "false", priv->wep_key_id + 1,
+                 priv->wep_keys_len[priv->wep_key_id],
+                 (priv->auth_mode ==
+                  WLAN_AUTH_SHARED_KEY) ? "restricted" : "open");
+
+        return 0;
+}
+
+static int at76_iw_handler_set_power(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *prq, char *extra)
+{
+        int err = -EIWCOMMIT;
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_IOCTL,
+                 "%s: SIOCSIWPOWER - disabled %s flags 0x%x value 0x%x",
+                 netdev->name, (prq->disabled) ? "true" : "false", prq->flags,
+                 prq->value);
+
+        if (prq->disabled)
+                priv->pm_mode = AT76_PM_OFF;
+        else {
+                switch (prq->flags & IW_POWER_MODE) {
+                case IW_POWER_ALL_R:
+                case IW_POWER_ON:
+                        break;
+                default:
+                        err = -EINVAL;
+                        goto exit;
+                }
+                if (prq->flags & IW_POWER_PERIOD)
+                        priv->pm_period = prq->value;
+
+                if (prq->flags & IW_POWER_TIMEOUT) {
+                        err = -EINVAL;
+                        goto exit;
+                }
+                priv->pm_mode = AT76_PM_ON;
+        }
+exit:
+        return err;
+}
+
+static int at76_iw_handler_get_power(struct net_device *netdev,
+                                     struct iw_request_info *info,
+                                     struct iw_param *power, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        power->disabled = (priv->pm_mode == AT76_PM_OFF);
+        if (!power->disabled) {
+                power->flags = IW_POWER_PERIOD | IW_POWER_ALL_R;
+                power->value = priv->pm_period;
+        }
+
+        at76_dbg(DBG_IOCTL, "%s: SIOCGIWPOWER - %s flags 0x%x value 0x%x",
+                 netdev->name, power->disabled ? "disabled" : "enabled",
+                 power->flags, power->value);
+
+        return 0;
+}
+
+/*******************************************************************************
+ * Private IOCTLS
+ */
+static int at76_iw_set_short_preamble(struct net_device *netdev,
+                                      struct iw_request_info *info, char *name,
+                                      char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int val = *((int *)name);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_SHORT_PREAMBLE, %d",
+                 netdev->name, val);
+
+        if (val < PREAMBLE_TYPE_LONG || val > PREAMBLE_TYPE_AUTO)
+                ret = -EINVAL;
+        else
+                priv->preamble_type = val;
+
+        return ret;
+}
+
+static int at76_iw_get_short_preamble(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        snprintf(wrqu->name, sizeof(wrqu->name), "%s (%d)",
+                 preambles[priv->preamble_type], priv->preamble_type);
+        return 0;
+}
+
+static int at76_iw_set_debug(struct net_device *netdev,
+                             struct iw_request_info *info,
+                             struct iw_point *data, char *extra)
+{
+        char *ptr;
+        u32 val;
+
+        if (data->length > 0) {
+                val = simple_strtol(extra, &ptr, 0);
+
+                if (ptr == extra)
+                        val = DBG_DEFAULTS;
+
+                at76_dbg(DBG_IOCTL, "%s: AT76_SET_DEBUG input %d: %s -> 0x%x",
+                         netdev->name, data->length, extra, val);
+        } else
+                val = DBG_DEFAULTS;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_DEBUG, old 0x%x, new 0x%x",
+                 netdev->name, at76_debug, val);
+
+        /* jal: some more output to pin down lockups */
+        at76_dbg(DBG_IOCTL, "%s: netif running %d queue_stopped %d "
+                 "carrier_ok %d", netdev->name, netif_running(netdev),
+                 netif_queue_stopped(netdev), netif_carrier_ok(netdev));
+
+        at76_debug = val;
+
+        return 0;
+}
+
+static int at76_iw_get_debug(struct net_device *netdev,
+                             struct iw_request_info *info,
+                             union iwreq_data *wrqu, char *extra)
+{
+        snprintf(wrqu->name, sizeof(wrqu->name), "0x%08x", at76_debug);
+        return 0;
+}
+
+static int at76_iw_set_powersave_mode(struct net_device *netdev,
+                                      struct iw_request_info *info, char *name,
+                                      char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int val = *((int *)name);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_POWERSAVE_MODE, %d (%s)",
+                 netdev->name, val,
+                 val == AT76_PM_OFF ? "active" : val == AT76_PM_ON ? "save" :
+                 val == AT76_PM_SMART ? "smart save" : "<invalid>");
+        if (val < AT76_PM_OFF || val > AT76_PM_SMART)
+                ret = -EINVAL;
+        else
+                priv->pm_mode = val;
+
+        return ret;
+}
+
+static int at76_iw_get_powersave_mode(struct net_device *netdev,
+                                      struct iw_request_info *info,
+                                      union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int *param = (int *)extra;
+
+        param[0] = priv->pm_mode;
+        return 0;
+}
+
+static int at76_iw_set_scan_times(struct net_device *netdev,
+                                  struct iw_request_info *info, char *name,
+                                  char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int mint = *((int *)name);
+        int maxt = *((int *)name + 1);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_SCAN_TIMES - min %d max %d",
+                 netdev->name, mint, maxt);
+        if (mint <= 0 || maxt <= 0 || mint > maxt)
+                ret = -EINVAL;
+        else {
+                priv->scan_min_time = mint;
+                priv->scan_max_time = maxt;
+        }
+
+        return ret;
+}
+
+static int at76_iw_get_scan_times(struct net_device *netdev,
+                                  struct iw_request_info *info,
+                                  union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int *param = (int *)extra;
+
+        param[0] = priv->scan_min_time;
+        param[1] = priv->scan_max_time;
+        return 0;
+}
+
+static int at76_iw_set_scan_mode(struct net_device *netdev,
+                                 struct iw_request_info *info, char *name,
+                                 char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int val = *((int *)name);
+        int ret = -EIWCOMMIT;
+
+        at76_dbg(DBG_IOCTL, "%s: AT76_SET_SCAN_MODE - mode %s",
+                 netdev->name, (val = SCAN_TYPE_ACTIVE) ? "active" :
+                 (val = SCAN_TYPE_PASSIVE) ? "passive" : "<invalid>");
+
+        if (val != SCAN_TYPE_ACTIVE && val != SCAN_TYPE_PASSIVE)
+                ret = -EINVAL;
+        else
+                priv->scan_mode = val;
+
+        return ret;
+}
+
+static int at76_iw_get_scan_mode(struct net_device *netdev,
+                                 struct iw_request_info *info,
+                                 union iwreq_data *wrqu, char *extra)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int *param = (int *)extra;
+
+        param[0] = priv->scan_mode;
+        return 0;
+}
+
+#define AT76_SET_HANDLER(h, f) [h - SIOCIWFIRST] = (iw_handler) f
+
+/* Standard wireless handlers */
+static const iw_handler at76_handlers[] = {
+        AT76_SET_HANDLER(SIOCSIWCOMMIT, at76_iw_handler_commit),
+        AT76_SET_HANDLER(SIOCGIWNAME, at76_iw_handler_get_name),
+        AT76_SET_HANDLER(SIOCSIWFREQ, at76_iw_handler_set_freq),
+        AT76_SET_HANDLER(SIOCGIWFREQ, at76_iw_handler_get_freq),
+        AT76_SET_HANDLER(SIOCSIWMODE, at76_iw_handler_set_mode),
+        AT76_SET_HANDLER(SIOCGIWMODE, at76_iw_handler_get_mode),
+        AT76_SET_HANDLER(SIOCGIWRANGE, at76_iw_handler_get_range),
+        AT76_SET_HANDLER(SIOCSIWSPY, at76_iw_handler_set_spy),
+        AT76_SET_HANDLER(SIOCGIWSPY, at76_iw_handler_get_spy),
+        AT76_SET_HANDLER(SIOCSIWTHRSPY, at76_iw_handler_set_thrspy),
+        AT76_SET_HANDLER(SIOCGIWTHRSPY, at76_iw_handler_get_thrspy),
+        AT76_SET_HANDLER(SIOCSIWAP, at76_iw_handler_set_wap),
+        AT76_SET_HANDLER(SIOCGIWAP, at76_iw_handler_get_wap),
+        AT76_SET_HANDLER(SIOCSIWSCAN, at76_iw_handler_set_scan),
+        AT76_SET_HANDLER(SIOCGIWSCAN, at76_iw_handler_get_scan),
+        AT76_SET_HANDLER(SIOCSIWESSID, at76_iw_handler_set_essid),
+        AT76_SET_HANDLER(SIOCGIWESSID, at76_iw_handler_get_essid),
+        AT76_SET_HANDLER(SIOCSIWRATE, at76_iw_handler_set_rate),
+        AT76_SET_HANDLER(SIOCGIWRATE, at76_iw_handler_get_rate),
+        AT76_SET_HANDLER(SIOCSIWRTS, at76_iw_handler_set_rts),
+        AT76_SET_HANDLER(SIOCGIWRTS, at76_iw_handler_get_rts),
+        AT76_SET_HANDLER(SIOCSIWFRAG, at76_iw_handler_set_frag),
+        AT76_SET_HANDLER(SIOCGIWFRAG, at76_iw_handler_get_frag),
+        AT76_SET_HANDLER(SIOCGIWTXPOW, at76_iw_handler_get_txpow),
+        AT76_SET_HANDLER(SIOCSIWRETRY, at76_iw_handler_set_retry),
+        AT76_SET_HANDLER(SIOCGIWRETRY, at76_iw_handler_get_retry),
+        AT76_SET_HANDLER(SIOCSIWENCODE, at76_iw_handler_set_encode),
+        AT76_SET_HANDLER(SIOCGIWENCODE, at76_iw_handler_get_encode),
+        AT76_SET_HANDLER(SIOCSIWPOWER, at76_iw_handler_set_power),
+        AT76_SET_HANDLER(SIOCGIWPOWER, at76_iw_handler_get_power)
+};
+
+#define AT76_SET_PRIV(h, f) [h - SIOCIWFIRSTPRIV] = (iw_handler) f
+
+/* Private wireless handlers */
+static const iw_handler at76_priv_handlers[] = {
+        AT76_SET_PRIV(AT76_SET_SHORT_PREAMBLE, at76_iw_set_short_preamble),
+        AT76_SET_PRIV(AT76_GET_SHORT_PREAMBLE, at76_iw_get_short_preamble),
+        AT76_SET_PRIV(AT76_SET_DEBUG, at76_iw_set_debug),
+        AT76_SET_PRIV(AT76_GET_DEBUG, at76_iw_get_debug),
+        AT76_SET_PRIV(AT76_SET_POWERSAVE_MODE, at76_iw_set_powersave_mode),
+        AT76_SET_PRIV(AT76_GET_POWERSAVE_MODE, at76_iw_get_powersave_mode),
+        AT76_SET_PRIV(AT76_SET_SCAN_TIMES, at76_iw_set_scan_times),
+        AT76_SET_PRIV(AT76_GET_SCAN_TIMES, at76_iw_get_scan_times),
+        AT76_SET_PRIV(AT76_SET_SCAN_MODE, at76_iw_set_scan_mode),
+        AT76_SET_PRIV(AT76_GET_SCAN_MODE, at76_iw_get_scan_mode),
+};
+
+/* Names and arguments of private wireless handlers */
+static const struct iw_priv_args at76_priv_args[] = {
+        /* 0 - long, 1 - short */
+        {AT76_SET_SHORT_PREAMBLE,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_preamble"},
+
+        {AT76_GET_SHORT_PREAMBLE,
+         0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 10, "get_preamble"},
+
+        /* we must pass the new debug mask as a string, because iwpriv cannot
+         * parse hex numbers starting with 0x :-(  */
+        {AT76_SET_DEBUG,
+         IW_PRIV_TYPE_CHAR | 10, 0, "set_debug"},
+
+        {AT76_GET_DEBUG,
+         0, IW_PRIV_TYPE_CHAR | IW_PRIV_SIZE_FIXED | 10, "get_debug"},
+
+        /* 1 - active, 2 - power save, 3 - smart power save */
+        {AT76_SET_POWERSAVE_MODE,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_powersave"},
+
+        {AT76_GET_POWERSAVE_MODE,
+         0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_powersave"},
+
+        /* min_channel_time, max_channel_time */
+        {AT76_SET_SCAN_TIMES,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, 0, "set_scan_times"},
+
+        {AT76_GET_SCAN_TIMES,
+         0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 2, "get_scan_times"},
+
+        /* 0 - active, 1 - passive scan */
+        {AT76_SET_SCAN_MODE,
+         IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, 0, "set_scan_mode"},
+
+        {AT76_GET_SCAN_MODE,
+         0, IW_PRIV_TYPE_INT | IW_PRIV_SIZE_FIXED | 1, "get_scan_mode"},
+};
+
+static const struct iw_handler_def at76_handler_def = {
+        .num_standard = ARRAY_SIZE(at76_handlers),
+        .num_private = ARRAY_SIZE(at76_priv_handlers),
+        .num_private_args = ARRAY_SIZE(at76_priv_args),
+        .standard = at76_handlers,
+        .private = at76_priv_handlers,
+        .private_args = at76_priv_args,
+        .get_wireless_stats = at76_get_wireless_stats,
+};
+
+static const u8 snapsig[] = { 0xaa, 0xaa, 0x03 };
+
+/* RFC 1042 encapsulates Ethernet frames in 802.2 SNAP (0xaa, 0xaa, 0x03) with
+ * a SNAP OID of 0 (0x00, 0x00, 0x00) */
+static const u8 rfc1042sig[] = { 0xaa, 0xaa, 0x03, 0x00, 0x00, 0x00 };
+
+static int at76_tx(struct sk_buff *skb, struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        struct net_device_stats *stats = &priv->stats;
+        int ret = 0;
+        int wlen;
+        int submit_len;
+        struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
+        struct ieee80211_hdr_3addr *i802_11_hdr =
+            (struct ieee80211_hdr_3addr *)tx_buffer->packet;
+        u8 *payload = i802_11_hdr->payload;
+        struct ethhdr *eh = (struct ethhdr *)skb->data;
+
+        if (netif_queue_stopped(netdev)) {
+                printk(KERN_ERR "%s: %s called while netdev is stopped\n",
+                       netdev->name, __func__);
+                /* skip this packet */
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        if (priv->tx_urb->status == -EINPROGRESS) {
+                printk(KERN_ERR "%s: %s called while tx urb is pending\n",
+                       netdev->name, __func__);
+                /* skip this packet */
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        if (skb->len < ETH_HLEN) {
+                printk(KERN_ERR "%s: %s: skb too short (%d)\n",
+                       netdev->name, __func__, skb->len);
+                dev_kfree_skb(skb);
+                return 0;
+        }
+
+        at76_ledtrig_tx_activity();     /* tell ledtrigger we send a packet */
+
+        /* we can get rid of memcpy if we set netdev->hard_header_len to
+           reserve enough space, but we would need to keep the skb around */
+
+        if (ntohs(eh->h_proto) <= ETH_DATA_LEN) {
+                /* this is a 802.3 packet */
+                if (skb->len >= ETH_HLEN + sizeof(rfc1042sig)
+                    && skb->data[ETH_HLEN] == rfc1042sig[0]
+                    && skb->data[ETH_HLEN + 1] == rfc1042sig[1]) {
+                        /* higher layer delivered SNAP header - keep it */
+                        memcpy(payload, skb->data + ETH_HLEN,
+                               skb->len - ETH_HLEN);
+                        wlen = IEEE80211_3ADDR_LEN + skb->len - ETH_HLEN;
+                } else {
+                        printk(KERN_ERR "%s: dropping non-SNAP 802.2 packet "
+                               "(DSAP 0x%02x SSAP 0x%02x cntrl 0x%02x)\n",
+                               priv->netdev->name, skb->data[ETH_HLEN],
+                               skb->data[ETH_HLEN + 1],
+                               skb->data[ETH_HLEN + 2]);
+                        dev_kfree_skb(skb);
+                        return 0;
+                }
+        } else {
+                /* add RFC 1042 header in front */
+                memcpy(payload, rfc1042sig, sizeof(rfc1042sig));
+                memcpy(payload + sizeof(rfc1042sig), &eh->h_proto,
+                       skb->len - offsetof(struct ethhdr, h_proto));
+                wlen = IEEE80211_3ADDR_LEN + sizeof(rfc1042sig) + skb->len -
+                    offsetof(struct ethhdr, h_proto);
+        }
+
+        /* make wireless header */
+        i802_11_hdr->frame_ctl =
+            cpu_to_le16(IEEE80211_FTYPE_DATA |
+                        (priv->wep_enabled ? IEEE80211_FCTL_PROTECTED : 0) |
+                        (priv->iw_mode ==
+                         IW_MODE_INFRA ? IEEE80211_FCTL_TODS : 0));
+
+        if (priv->iw_mode == IW_MODE_ADHOC) {
+                memcpy(i802_11_hdr->addr1, eh->h_dest, ETH_ALEN);
+                memcpy(i802_11_hdr->addr2, eh->h_source, ETH_ALEN);
+                memcpy(i802_11_hdr->addr3, priv->bssid, ETH_ALEN);
+        } else if (priv->iw_mode == IW_MODE_INFRA) {
+                memcpy(i802_11_hdr->addr1, priv->bssid, ETH_ALEN);
+                memcpy(i802_11_hdr->addr2, eh->h_source, ETH_ALEN);
+                memcpy(i802_11_hdr->addr3, eh->h_dest, ETH_ALEN);
+        }
+
+        i802_11_hdr->duration_id = cpu_to_le16(0);
+        i802_11_hdr->seq_ctl = cpu_to_le16(0);
+
+        /* setup 'Atmel' header */
+        tx_buffer->wlength = cpu_to_le16(wlen);
+        tx_buffer->tx_rate = priv->txrate;
+        /* for broadcast destination addresses, the firmware 0.100.x
+           seems to choose the highest rate set with CMD_STARTUP in
+           basic_rate_set replacing this value */
+
+        memset(tx_buffer->reserved, 0, sizeof(tx_buffer->reserved));
+
+        tx_buffer->padding = at76_calc_padding(wlen);
+        submit_len = wlen + AT76_TX_HDRLEN + tx_buffer->padding;
+
+        at76_dbg(DBG_TX_DATA_CONTENT, "%s skb->data %s", priv->netdev->name,
+                 hex2str(skb->data, 32));
+        at76_dbg(DBG_TX_DATA, "%s tx: wlen 0x%x pad 0x%x rate %d hdr %s",
+                 priv->netdev->name,
+                 le16_to_cpu(tx_buffer->wlength),
+                 tx_buffer->padding, tx_buffer->tx_rate,
+                 hex2str(i802_11_hdr, sizeof(*i802_11_hdr)));
+        at76_dbg(DBG_TX_DATA_CONTENT, "%s payload %s", priv->netdev->name,
+                 hex2str(payload, 48));
+
+        /* send stuff */
+        netif_stop_queue(netdev);
+        netdev->trans_start = jiffies;
+
+        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe, tx_buffer,
+                          submit_len, at76_tx_callback, priv);
+        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
+        if (ret) {
+                stats->tx_errors++;
+                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
+                       netdev->name, ret);
+                if (ret == -EINVAL)
+                        printk(KERN_ERR
+                               "%s: -EINVAL: tx urb %p hcpriv %p complete %p\n",
+                               priv->netdev->name, priv->tx_urb,
+                               priv->tx_urb->hcpriv, priv->tx_urb->complete);
+        } else {
+                stats->tx_bytes += skb->len;
+                dev_kfree_skb(skb);
+        }
+
+        return ret;
+}
+
+static void at76_tx_timeout(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        if (!priv)
+                return;
+        dev_warn(&netdev->dev, "tx timeout.");
+
+        usb_unlink_urb(priv->tx_urb);
+        priv->stats.tx_errors++;
+}
+
 static int at76_submit_rx_urb(struct at76_priv *priv)
 {
         int ret;
@@ -1327,7 +3270,7 @@ static int at76_submit_rx_urb(struct at76_priv *priv)
 
         if (!priv->rx_urb) {
                 printk(KERN_ERR "%s: %s: priv->rx_urb is NULL\n",
-                       wiphy_name(priv->hw->wiphy), __func__);
+                       priv->netdev->name, __func__);
                 return -EFAULT;
         }
 
@@ -1335,7 +3278,7 @@ static int at76_submit_rx_urb(struct at76_priv *priv)
                 skb = dev_alloc_skb(sizeof(struct at76_rx_buffer));
                 if (!skb) {
                         printk(KERN_ERR "%s: cannot allocate rx skbuff\n",
-                               wiphy_name(priv->hw->wiphy));
+                               priv->netdev->name);
                         ret = -ENOMEM;
                         goto exit;
                 }
@@ -1355,18 +3298,110 @@ static int at76_submit_rx_urb(struct at76_priv *priv)
                                  "usb_submit_urb returned -ENODEV");
                 else
                         printk(KERN_ERR "%s: rx, usb_submit_urb failed: %d\n",
-                               wiphy_name(priv->hw->wiphy), ret);
+                               priv->netdev->name, ret);
         }
 
 exit:
         if (ret < 0 && ret != -ENODEV)
                 printk(KERN_ERR "%s: cannot submit rx urb - please unload the "
                        "driver and/or power cycle the device\n",
-                       wiphy_name(priv->hw->wiphy));
+                       priv->netdev->name);
 
         return ret;
 }
 
+static int at76_open(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        int ret = 0;
+
+        at76_dbg(DBG_PROC_ENTRY, "%s(): entry", __func__);
+
+        if (mutex_lock_interruptible(&priv->mtx))
+                return -EINTR;
+
+        /* if netdev->dev_addr != priv->mac_addr we must
+           set the mac address in the device ! */
+        if (compare_ether_addr(netdev->dev_addr, priv->mac_addr)) {
+                if (at76_add_mac_address(priv, netdev->dev_addr) >= 0)
+                        at76_dbg(DBG_PROGRESS, "%s: set new MAC addr %s",
+                                 netdev->name, mac2str(netdev->dev_addr));
+        }
+
+        priv->scan_state = SCAN_IDLE;
+        priv->last_scan = jiffies;
+
+        ret = at76_submit_rx_urb(priv);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: open: submit_rx_urb failed: %d\n",
+                       netdev->name, ret);
+                goto error;
+        }
+
+        schedule_delayed_work(&priv->dwork_restart, 0);
+
+        at76_dbg(DBG_PROC_ENTRY, "%s(): end", __func__);
+error:
+        mutex_unlock(&priv->mtx);
+        return ret < 0 ? ret : 0;
+}
+
+static int at76_stop(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        at76_dbg(DBG_DEVSTART, "%s: ENTER", __func__);
+
+        if (mutex_lock_interruptible(&priv->mtx))
+                return -EINTR;
+
+        at76_quiesce(priv);
+
+        if (!priv->device_unplugged) {
+                /* We are called by "ifconfig ethX down", not because the
+                 * device is not available anymore. */
+                at76_set_radio(priv, 0);
+
+                /* We unlink rx_urb because at76_open() re-submits it.
+                 * If unplugged, at76_delete_device() takes care of it. */
+                usb_kill_urb(priv->rx_urb);
+        }
+
+        /* free the bss_list */
+        at76_free_bss_list(priv);
+
+        mutex_unlock(&priv->mtx);
+        at76_dbg(DBG_DEVSTART, "%s: EXIT", __func__);
+
+        return 0;
+}
+
+static void at76_ethtool_get_drvinfo(struct net_device *netdev,
+                                     struct ethtool_drvinfo *info)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+
+        strncpy(info->driver, DRIVER_NAME, sizeof(info->driver));
+        strncpy(info->version, DRIVER_VERSION, sizeof(info->version));
+
+        usb_make_path(priv->udev, info->bus_info, sizeof(info->bus_info));
+
+        snprintf(info->fw_version, sizeof(info->fw_version), "%d.%d.%d-%d",
+                 priv->fw_version.major, priv->fw_version.minor,
+                 priv->fw_version.patch, priv->fw_version.build);
+}
+
+static u32 at76_ethtool_get_link(struct net_device *netdev)
+{
+        struct at76_priv *priv = netdev_priv(netdev);
+        return priv->mac_state == MAC_CONNECTED;
+}
+
+static struct ethtool_ops at76_ethtool_ops = {
+        .get_drvinfo = at76_ethtool_get_drvinfo,
+        .get_link = at76_ethtool_get_link,
+};
+
 /* Download external firmware */
 static int at76_load_external_fw(struct usb_device *udev, struct fwentry *fwe)
 {
@@ -1463,6 +3498,406 @@ exit:
         return ret;
 }
 
+static int at76_match_essid(struct at76_priv *priv, struct bss_info *ptr)
+{
+        /* common criteria for both modi */
+
+        int ret = (priv->essid_size == 0 /* ANY ssid */  ||
+                   (priv->essid_size == ptr->ssid_len &&
+                    !memcmp(priv->essid, ptr->ssid, ptr->ssid_len)));
+        if (!ret)
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s bss table entry %p: essid didn't match",
+                         priv->netdev->name, ptr);
+        return ret;
+}
+
+static inline int at76_match_mode(struct at76_priv *priv, struct bss_info *ptr)
+{
+        int ret;
+
+        if (priv->iw_mode == IW_MODE_ADHOC)
+                ret = ptr->capa & WLAN_CAPABILITY_IBSS;
+        else
+                ret = ptr->capa & WLAN_CAPABILITY_ESS;
+        if (!ret)
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s bss table entry %p: mode didn't match",
+                         priv->netdev->name, ptr);
+        return ret;
+}
+
+static int at76_match_rates(struct at76_priv *priv, struct bss_info *ptr)
+{
+        int i;
+
+        for (i = 0; i < ptr->rates_len; i++) {
+                u8 rate = ptr->rates[i];
+
+                if (!(rate & 0x80))
+                        continue;
+
+                /* this is a basic rate we have to support
+                   (see IEEE802.11, ch. 7.3.2.2) */
+                if (rate != (0x80 | hw_rates[0])
+                    && rate != (0x80 | hw_rates[1])
+                    && rate != (0x80 | hw_rates[2])
+                    && rate != (0x80 | hw_rates[3])) {
+                        at76_dbg(DBG_BSS_MATCH,
+                                 "%s: bss table entry %p: basic rate %02x not "
+                                 "supported", priv->netdev->name, ptr, rate);
+                        return 0;
+                }
+        }
+
+        /* if we use short preamble, the bss must support it */
+        if (priv->preamble_type == PREAMBLE_TYPE_SHORT &&
+            !(ptr->capa & WLAN_CAPABILITY_SHORT_PREAMBLE)) {
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s: %p does not support short preamble",
+                         priv->netdev->name, ptr);
+                return 0;
+        } else
+                return 1;
+}
+
+static inline int at76_match_wep(struct at76_priv *priv, struct bss_info *ptr)
+{
+        if (!priv->wep_enabled && ptr->capa & WLAN_CAPABILITY_PRIVACY) {
+                /* we have disabled WEP, but the BSS signals privacy */
+                at76_dbg(DBG_BSS_MATCH,
+                         "%s: bss table entry %p: requires encryption",
+                         priv->netdev->name, ptr);
+                return 0;
+        }
+        /* otherwise if the BSS does not signal privacy it may well
+           accept encrypted packets from us ... */
+        return 1;
+}
+
+static inline int at76_match_bssid(struct at76_priv *priv, struct bss_info *ptr)
+{
+        if (!priv->wanted_bssid_valid ||
+            !compare_ether_addr(ptr->bssid, priv->wanted_bssid))
+                return 1;
+
+        at76_dbg(DBG_BSS_MATCH,
+                 "%s: requested bssid - %s does not match",
+                 priv->netdev->name, mac2str(priv->wanted_bssid));
+        at76_dbg(DBG_BSS_MATCH,
+                 "      AP bssid - %s of bss table entry %p",
+                 mac2str(ptr->bssid), ptr);
+        return 0;
+}
+
+/**
+ * at76_match_bss - try to find a matching bss in priv->bss
+ *
+ * last - last bss tried
+ *
+ * last == NULL signals a new round starting with priv->bss_list.next
+ * this function must be called inside an acquired priv->bss_list_spinlock
+ * otherwise the timeout on bss may remove the newly chosen entry
+ */
+static struct bss_info *at76_match_bss(struct at76_priv *priv,
+                                       struct bss_info *last)
+{
+        struct bss_info *ptr = NULL;
+        struct list_head *curr;
+
+        curr = last ? last->list.next : priv->bss_list.next;
+        while (curr != &priv->bss_list) {
+                ptr = list_entry(curr, struct bss_info, list);
+                if (at76_match_essid(priv, ptr) && at76_match_mode(priv, ptr)
+                    && at76_match_wep(priv, ptr) && at76_match_rates(priv, ptr)
+                    && at76_match_bssid(priv, ptr))
+                        break;
+                curr = curr->next;
+        }
+
+        if (curr == &priv->bss_list)
+                ptr = NULL;
+        /* otherwise ptr points to the struct bss_info we have chosen */
+
+        at76_dbg(DBG_BSS_TABLE, "%s %s: returned %p", priv->netdev->name,
+                 __func__, ptr);
+        return ptr;
+}
+
+/* Start joining a matching BSS, or create own IBSS */
+static void at76_work_join(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_join);
+        int ret;
+        unsigned long flags;
+
+        mutex_lock(&priv->mtx);
+
+        WARN_ON(priv->mac_state != MAC_JOINING);
+        if (priv->mac_state != MAC_JOINING)
+                goto exit;
+
+        /* secure the access to priv->curr_bss ! */
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+        priv->curr_bss = at76_match_bss(priv, priv->curr_bss);
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
+
+        if (!priv->curr_bss) {
+                /* here we haven't found a matching (i)bss ... */
+                if (priv->iw_mode == IW_MODE_ADHOC) {
+                        at76_set_mac_state(priv, MAC_OWN_IBSS);
+                        at76_start_ibss(priv);
+                        goto exit;
+                }
+                /* haven't found a matching BSS in infra mode - try again */
+                at76_set_mac_state(priv, MAC_SCANNING);
+                schedule_work(&priv->work_start_scan);
+                goto exit;
+        }
+
+        ret = at76_join_bss(priv, priv->curr_bss);
+        if (ret < 0) {
+                printk(KERN_ERR "%s: join_bss failed with %d\n",
+                       priv->netdev->name, ret);
+                goto exit;
+        }
+
+        ret = at76_wait_completion(priv, CMD_JOIN);
+        if (ret != CMD_STATUS_COMPLETE) {
+                if (ret != CMD_STATUS_TIME_OUT)
+                        printk(KERN_ERR "%s: join_bss completed with %d\n",
+                               priv->netdev->name, ret);
+                else
+                        printk(KERN_INFO "%s: join_bss ssid %s timed out\n",
+                               priv->netdev->name,
+                               mac2str(priv->curr_bss->bssid));
+
+                /* retry next BSS immediately */
+                schedule_work(&priv->work_join);
+                goto exit;
+        }
+
+        /* here we have joined the (I)BSS */
+        if (priv->iw_mode == IW_MODE_ADHOC) {
+                struct bss_info *bptr = priv->curr_bss;
+                at76_set_mac_state(priv, MAC_CONNECTED);
+                /* get ESSID, BSSID and channel for priv->curr_bss */
+                priv->essid_size = bptr->ssid_len;
+                memcpy(priv->essid, bptr->ssid, bptr->ssid_len);
+                memcpy(priv->bssid, bptr->bssid, ETH_ALEN);
+                priv->channel = bptr->channel;
+                at76_iwevent_bss_connect(priv->netdev, bptr->bssid);
+                netif_carrier_on(priv->netdev);
+                netif_start_queue(priv->netdev);
+                /* just to be sure */
+                cancel_delayed_work(&priv->dwork_get_scan);
+                cancel_delayed_work(&priv->dwork_auth);
+                cancel_delayed_work(&priv->dwork_assoc);
+        } else {
+                /* send auth req */
+                priv->retries = AUTH_RETRIES;
+                at76_set_mac_state(priv, MAC_AUTH);
+                at76_auth_req(priv, priv->curr_bss, 1, NULL);
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer + HZ", __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_auth, AUTH_TIMEOUT);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Reap scan results */
+static void at76_dwork_get_scan(struct work_struct *work)
+{
+        int status;
+        int ret;
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_get_scan.work);
+
+        mutex_lock(&priv->mtx);
+        WARN_ON(priv->mac_state != MAC_SCANNING);
+        if (priv->mac_state != MAC_SCANNING)
+                goto exit;
+
+        status = at76_get_cmd_status(priv->udev, CMD_SCAN);
+        if (status < 0) {
+                printk(KERN_ERR "%s: %s: at76_get_cmd_status failed with %d\n",
+                       priv->netdev->name, __func__, status);
+                status = CMD_STATUS_IN_PROGRESS;
+                /* INFO: Hope it was a one off error - if not, scanning
+                   further down the line and stop this cycle */
+        }
+        at76_dbg(DBG_PROGRESS,
+                 "%s %s: got cmd_status %d (state %s, need_any %d)",
+                 priv->netdev->name, __func__, status,
+                 mac_states[priv->mac_state], priv->scan_need_any);
+
+        if (status != CMD_STATUS_COMPLETE) {
+                if ((status != CMD_STATUS_IN_PROGRESS) &&
+                    (status != CMD_STATUS_IDLE))
+                        printk(KERN_ERR "%s: %s: Bad scan status: %s\n",
+                               priv->netdev->name, __func__,
+                               at76_get_cmd_status_string(status));
+
+                /* the first cmd status after scan start is always a IDLE ->
+                   start the timer to poll again until COMPLETED */
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer for %d ticks",
+                         __func__, __LINE__, SCAN_POLL_INTERVAL);
+                schedule_delayed_work(&priv->dwork_get_scan,
+                                      SCAN_POLL_INTERVAL);
+                goto exit;
+        }
+
+        if (at76_debug & DBG_BSS_TABLE)
+                at76_dump_bss_table(priv);
+
+        if (priv->scan_need_any) {
+                ret = at76_start_scan(priv, 0);
+                if (ret < 0)
+                        printk(KERN_ERR
+                               "%s: %s: start_scan (ANY) failed with %d\n",
+                               priv->netdev->name, __func__, ret);
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer for %d ticks", __func__,
+                         __LINE__, SCAN_POLL_INTERVAL);
+                schedule_delayed_work(&priv->dwork_get_scan,
+                                      SCAN_POLL_INTERVAL);
+                priv->scan_need_any = 0;
+        } else {
+                priv->scan_state = SCAN_COMPLETED;
+                /* report the end of scan to user space */
+                at76_iwevent_scan_complete(priv->netdev);
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Handle loss of beacons from the AP */
+static void at76_dwork_beacon(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_beacon.work);
+
+        mutex_lock(&priv->mtx);
+        if (priv->mac_state != MAC_CONNECTED || priv->iw_mode != IW_MODE_INFRA)
+                goto exit;
+
+        /* We haven't received any beacons from out AP for BEACON_TIMEOUT */
+        printk(KERN_INFO "%s: lost beacon bssid %s\n",
+               priv->netdev->name, mac2str(priv->curr_bss->bssid));
+
+        netif_carrier_off(priv->netdev);
+        netif_stop_queue(priv->netdev);
+        at76_iwevent_bss_disconnect(priv->netdev);
+        at76_set_mac_state(priv, MAC_SCANNING);
+        schedule_work(&priv->work_start_scan);
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Handle authentication response timeout */
+static void at76_dwork_auth(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_auth.work);
+
+        mutex_lock(&priv->mtx);
+        WARN_ON(priv->mac_state != MAC_AUTH);
+        if (priv->mac_state != MAC_AUTH)
+                goto exit;
+
+        at76_dbg(DBG_PROGRESS, "%s: authentication response timeout",
+                 priv->netdev->name);
+
+        if (priv->retries-- >= 0) {
+                at76_auth_req(priv, priv->curr_bss, 1, NULL);
+                at76_dbg(DBG_MGMT_TIMER, "%s:%d: starting mgmt_timer + HZ",
+                         __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_auth, AUTH_TIMEOUT);
+        } else {
+                /* try to get next matching BSS */
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Handle association response timeout */
+static void at76_dwork_assoc(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_assoc.work);
+
+        mutex_lock(&priv->mtx);
+        WARN_ON(priv->mac_state != MAC_ASSOC);
+        if (priv->mac_state != MAC_ASSOC)
+                goto exit;
+
+        at76_dbg(DBG_PROGRESS, "%s: association response timeout",
+                 priv->netdev->name);
+
+        if (priv->retries-- >= 0) {
+                at76_assoc_req(priv, priv->curr_bss);
+                at76_dbg(DBG_MGMT_TIMER, "%s:%d: starting mgmt_timer + HZ",
+                         __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_assoc, ASSOC_TIMEOUT);
+        } else {
+                /* try to get next matching BSS */
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
+/* Read new bssid in ad-hoc mode */
+static void at76_work_new_bss(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_new_bss);
+        int ret;
+        struct mib_mac_mgmt mac_mgmt;
+
+        mutex_lock(&priv->mtx);
+
+        ret = at76_get_mib(priv->udev, MIB_MAC_MGMT, &mac_mgmt,
+                           sizeof(struct mib_mac_mgmt));
+        if (ret < 0) {
+                printk(KERN_ERR "%s: at76_get_mib failed: %d\n",
+                       priv->netdev->name, ret);
+                goto exit;
+        }
+
+        at76_dbg(DBG_PROGRESS, "ibss_change = 0x%2x", mac_mgmt.ibss_change);
+        memcpy(priv->bssid, mac_mgmt.current_bssid, ETH_ALEN);
+        at76_dbg(DBG_PROGRESS, "using BSSID %s", mac2str(priv->bssid));
+
+        at76_iwevent_bss_connect(priv->netdev, priv->bssid);
+
+        priv->mib_buf.type = MIB_MAC_MGMT;
+        priv->mib_buf.size = 1;
+        priv->mib_buf.index = offsetof(struct mib_mac_mgmt, ibss_change);
+        priv->mib_buf.data.byte = 0;
+
+        ret = at76_set_mib(priv, &priv->mib_buf);
+        if (ret < 0)
+                printk(KERN_ERR "%s: set_mib (ibss change ok) failed: %d\n",
+                       priv->netdev->name, ret);
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
 static int at76_startup_device(struct at76_priv *priv)
 {
         struct at76_card_config *ccfg = &priv->card_config;
@@ -1470,14 +3905,14 @@ static int at76_startup_device(struct at76_priv *priv)
 
         at76_dbg(DBG_PARAMS,
                  "%s param: ssid %.*s (%s) mode %s ch %d wep %s key %d "
-                 "keylen %d", wiphy_name(priv->hw->wiphy), priv->essid_size,
-                 priv->essid, hex2str(priv->essid, IW_ESSID_MAX_SIZE),
+                 "keylen %d", priv->netdev->name, priv->essid_size, priv->essid,
+                 hex2str(priv->essid, IW_ESSID_MAX_SIZE),
                  priv->iw_mode == IW_MODE_ADHOC ? "adhoc" : "infra",
                  priv->channel, priv->wep_enabled ? "enabled" : "disabled",
                  priv->wep_key_id, priv->wep_keys_len[priv->wep_key_id]);
         at76_dbg(DBG_PARAMS,
                  "%s param: preamble %s rts %d retry %d frag %d "
-                 "txrate %s auth_mode %d", wiphy_name(priv->hw->wiphy),
+                 "txrate %s auth_mode %d", priv->netdev->name,
                  preambles[priv->preamble_type], priv->rts_threshold,
                  priv->short_retry_limit, priv->frag_threshold,
                  priv->txrate == TX_RATE_1MBIT ? "1MBit" : priv->txrate ==
@@ -1488,7 +3923,7 @@ static int at76_startup_device(struct at76_priv *priv)
         at76_dbg(DBG_PARAMS,
                  "%s param: pm_mode %d pm_period %d auth_mode %s "
                  "scan_times %d %d scan_mode %s",
-                 wiphy_name(priv->hw->wiphy), priv->pm_mode, priv->pm_period,
+                 priv->netdev->name, priv->pm_mode, priv->pm_period,
                  priv->auth_mode == WLAN_AUTH_OPEN ? "open" : "shared_secret",
                  priv->scan_min_time, priv->scan_max_time,
                  priv->scan_mode == SCAN_TYPE_ACTIVE ? "active" : "passive");
@@ -1522,8 +3957,7 @@ static int at76_startup_device(struct at76_priv *priv)
         ccfg->ssid_len = priv->essid_size;
 
         ccfg->wep_default_key_id = priv->wep_key_id;
-        memcpy(ccfg->wep_default_key_value, priv->wep_keys,
-               sizeof(priv->wep_keys));
+        memcpy(ccfg->wep_default_key_value, priv->wep_keys, 4 * WEP_KEY_LEN);
 
         ccfg->short_preamble = priv->preamble_type;
         ccfg->beacon_period = cpu_to_le16(priv->beacon_period);
@@ -1532,7 +3966,7 @@ static int at76_startup_device(struct at76_priv *priv)
                                     sizeof(struct at76_card_config));
         if (ret < 0) {
                 printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
                 return ret;
         }
 
@@ -1578,6 +4012,69 @@ static int at76_startup_device(struct at76_priv *priv)
         return 0;
 }
 
+/* Restart the interface */
+static void at76_dwork_restart(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              dwork_restart.work);
+
+        mutex_lock(&priv->mtx);
+
+        netif_carrier_off(priv->netdev);        /* stop netdev watchdog */
+        netif_stop_queue(priv->netdev); /* stop tx data packets */
+
+        at76_startup_device(priv);
+
+        if (priv->iw_mode != IW_MODE_MONITOR) {
+                priv->netdev->type = ARPHRD_ETHER;
+                at76_set_mac_state(priv, MAC_SCANNING);
+                schedule_work(&priv->work_start_scan);
+        } else {
+                priv->netdev->type = ARPHRD_IEEE80211_RADIOTAP;
+                at76_start_monitor(priv);
+        }
+
+        mutex_unlock(&priv->mtx);
+}
+
+/* Initiate scanning */
+static void at76_work_start_scan(struct work_struct *work)
+{
+        struct at76_priv *priv = container_of(work, struct at76_priv,
+                                              work_start_scan);
+        int ret;
+
+        mutex_lock(&priv->mtx);
+
+        WARN_ON(priv->mac_state != MAC_SCANNING);
+        if (priv->mac_state != MAC_SCANNING)
+                goto exit;
+
+        /* only clear the bss list when a scan is actively initiated,
+         * otherwise simply rely on at76_bss_list_timeout */
+        if (priv->scan_state == SCAN_IN_PROGRESS) {
+                at76_free_bss_list(priv);
+                priv->scan_need_any = 1;
+        } else
+                priv->scan_need_any = 0;
+
+        ret = at76_start_scan(priv, 1);
+
+        if (ret < 0)
+                printk(KERN_ERR "%s: %s: start_scan failed with %d\n",
+                       priv->netdev->name, __func__, ret);
+        else {
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer for %d ticks",
+                         __func__, __LINE__, SCAN_POLL_INTERVAL);
+                schedule_delayed_work(&priv->dwork_get_scan,
+                                      SCAN_POLL_INTERVAL);
+        }
+
+exit:
+        mutex_unlock(&priv->mtx);
+}
+
 /* Enable or disable promiscuous mode */
 static void at76_work_set_promisc(struct work_struct *work)
 {
@@ -1595,7 +4092,7 @@ static void at76_work_set_promisc(struct work_struct *work)
         ret = at76_set_mib(priv, &priv->mib_buf);
         if (ret < 0)
                 printk(KERN_ERR "%s: set_mib (promiscuous_mode) failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
+                       priv->netdev->name, ret);
 
         mutex_unlock(&priv->mtx);
 }
@@ -1611,759 +4108,1088 @@ static void at76_work_submit_rx(struct work_struct *work)
         mutex_unlock(&priv->mtx);
 }
 
-static void at76_rx_tasklet(unsigned long param)
+/* We got an association response */
+static void at76_rx_mgmt_assoc(struct at76_priv *priv,
+                               struct at76_rx_buffer *buf)
 {
-        struct urb *urb = (struct urb *)param;
-        struct at76_priv *priv = urb->context;
-        struct at76_rx_buffer *buf;
-        struct ieee80211_rx_status rx_status = { 0 };
-
-        if (priv->device_unplugged) {
-                at76_dbg(DBG_DEVSTART, "device unplugged");
-                if (urb)
-                        at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
+        struct ieee80211_assoc_response *resp =
+            (struct ieee80211_assoc_response *)buf->packet;
+        u16 assoc_id = le16_to_cpu(resp->aid);
+        u16 status = le16_to_cpu(resp->status);
+
+        at76_dbg(DBG_RX_MGMT, "%s: rx AssocResp bssid %s capa 0x%04x status "
+                 "0x%04x assoc_id 0x%04x rates %s", priv->netdev->name,
+                 mac2str(resp->header.addr3), le16_to_cpu(resp->capability),
+                 status, assoc_id, hex2str(resp->info_element->data,
+                                           resp->info_element->len));
+
+        if (priv->mac_state != MAC_ASSOC) {
+                printk(KERN_INFO "%s: AssocResp in state %s ignored\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
                 return;
         }
 
-        if (!priv->rx_skb || !priv->rx_skb->data)
-                return;
-
-        buf = (struct at76_rx_buffer *)priv->rx_skb->data;
-
-        if (urb->status != 0) {
-                if (urb->status != -ENOENT && urb->status != -ECONNRESET)
-                        at76_dbg(DBG_URB,
-                                 "%s %s: - nonzero Rx bulk status received: %d",
-                                 __func__, wiphy_name(priv->hw->wiphy),
-                                 urb->status);
-                return;
+        BUG_ON(!priv->curr_bss);
+
+        cancel_delayed_work(&priv->dwork_assoc);
+        if (status == WLAN_STATUS_SUCCESS) {
+                struct bss_info *ptr = priv->curr_bss;
+                priv->assoc_id = assoc_id & 0x3fff;
+                /* update iwconfig params */
+                memcpy(priv->bssid, ptr->bssid, ETH_ALEN);
+                memcpy(priv->essid, ptr->ssid, ptr->ssid_len);
+                priv->essid_size = ptr->ssid_len;
+                priv->channel = ptr->channel;
+                schedule_work(&priv->work_assoc_done);
+        } else {
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
         }
+}
 
-        at76_dbg(DBG_RX_ATMEL_HDR,
-                 "%s: rx frame: rate %d rssi %d noise %d link %d",
-                 wiphy_name(priv->hw->wiphy), buf->rx_rate, buf->rssi,
-                 buf->noise_level, buf->link_quality);
-
-        skb_trim(priv->rx_skb, le16_to_cpu(buf->wlength) + AT76_RX_HDRLEN);
-        at76_dbg_dump(DBG_RX_DATA, &priv->rx_skb->data[AT76_RX_HDRLEN],
-                      priv->rx_skb->len, "RX: len=%d",
-                      (int)(priv->rx_skb->len - AT76_RX_HDRLEN));
+/* Process disassociation request from the AP */
+static void at76_rx_mgmt_disassoc(struct at76_priv *priv,
+                                  struct at76_rx_buffer *buf)
+{
+        struct ieee80211_disassoc *resp =
+            (struct ieee80211_disassoc *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &resp->header;
+
+        at76_dbg(DBG_RX_MGMT,
+                 "%s: rx DisAssoc bssid %s reason 0x%04x destination %s",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(resp->reason), mac2str(mgmt->addr1));
+
+        /* We are not connected, ignore */
+        if (priv->mac_state == MAC_SCANNING || priv->mac_state == MAC_INIT
+            || !priv->curr_bss)
+                return;
 
-        rx_status.signal = buf->rssi;
-        /* FIXME: is rate_idx still present in structure? */
-        rx_status.rate_idx = buf->rx_rate;
-        rx_status.flag |= RX_FLAG_DECRYPTED;
-        rx_status.flag |= RX_FLAG_IV_STRIPPED;
+        /* Not our BSSID, ignore */
+        if (compare_ether_addr(mgmt->addr3, priv->curr_bss->bssid))
+                return;
 
-        skb_pull(priv->rx_skb, AT76_RX_HDRLEN);
-        at76_dbg(DBG_MAC80211, "calling ieee80211_rx_irqsafe(): %d/%d",
-                 priv->rx_skb->len, priv->rx_skb->data_len);
-        ieee80211_rx_irqsafe(priv->hw, priv->rx_skb, &rx_status);
+        /* Not for our STA and not broadcast, ignore */
+        if (compare_ether_addr(priv->netdev->dev_addr, mgmt->addr1)
+            && !is_broadcast_ether_addr(mgmt->addr1))
+                return;
 
-        /* Use a new skb for the next receive */
-        priv->rx_skb = NULL;
+        if (priv->mac_state != MAC_ASSOC && priv->mac_state != MAC_CONNECTED
+            && priv->mac_state != MAC_JOINING) {
+                printk(KERN_INFO "%s: DisAssoc in state %s ignored\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
+                return;
+        }
 
-        at76_submit_rx_urb(priv);
+        if (priv->mac_state == MAC_CONNECTED) {
+                netif_carrier_off(priv->netdev);
+                netif_stop_queue(priv->netdev);
+                at76_iwevent_bss_disconnect(priv->netdev);
+        }
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
+        at76_set_mac_state(priv, MAC_JOINING);
+        schedule_work(&priv->work_join);
 }
 
-/* Load firmware into kernel memory and parse it */
-static struct fwentry *at76_load_firmware(struct usb_device *udev,
-                                          enum board_type board_type)
+static void at76_rx_mgmt_auth(struct at76_priv *priv,
+                              struct at76_rx_buffer *buf)
 {
-        int ret;
-        char *str;
-        struct at76_fw_header *fwh;
-        struct fwentry *fwe = &firmwares[board_type];
-
-        mutex_lock(&fw_mutex);
-
-        if (fwe->loaded) {
-                at76_dbg(DBG_FW, "re-using previously loaded fw");
-                goto exit;
+        struct ieee80211_auth *resp = (struct ieee80211_auth *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &resp->header;
+        int seq_nr = le16_to_cpu(resp->transaction);
+        int alg = le16_to_cpu(resp->algorithm);
+        int status = le16_to_cpu(resp->status);
+
+        at76_dbg(DBG_RX_MGMT,
+                 "%s: rx AuthFrame bssid %s alg %d seq_nr %d status %d "
+                 "destination %s", priv->netdev->name, mac2str(mgmt->addr3),
+                 alg, seq_nr, status, mac2str(mgmt->addr1));
+
+        if (alg == WLAN_AUTH_SHARED_KEY && seq_nr == 2)
+                at76_dbg(DBG_RX_MGMT, "%s: AuthFrame challenge %s ...",
+                         priv->netdev->name, hex2str(resp->info_element, 18));
+
+        if (priv->mac_state != MAC_AUTH) {
+                printk(KERN_INFO "%s: ignored AuthFrame in state %s\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
+                return;
         }
-
-        at76_dbg(DBG_FW, "downloading firmware %s", fwe->fwname);
-        ret = request_firmware(&fwe->fw, fwe->fwname, &udev->dev);
-        if (ret < 0) {
-                dev_printk(KERN_ERR, &udev->dev, "firmware %s not found!\n",
-                           fwe->fwname);
-                dev_printk(KERN_ERR, &udev->dev,
-                           "you may need to download the firmware from "
-                           "http://developer.berlios.de/projects/at76c503a/\n");
-                goto exit;
+        if (priv->auth_mode != alg) {
+                printk(KERN_INFO "%s: ignored AuthFrame for alg %d\n",
+                       priv->netdev->name, alg);
+                return;
         }
 
-        at76_dbg(DBG_FW, "got it.");
-        fwh = (struct at76_fw_header *)(fwe->fw->data);
+        BUG_ON(!priv->curr_bss);
 
-        if (fwe->fw->size <= sizeof(*fwh)) {
-                dev_printk(KERN_ERR, &udev->dev,
-                           "firmware is too short (0x%zx)\n", fwe->fw->size);
-                goto exit;
+        /* Not our BSSID or not for our STA, ignore */
+        if (compare_ether_addr(mgmt->addr3, priv->curr_bss->bssid)
+            || compare_ether_addr(priv->netdev->dev_addr, mgmt->addr1))
+                return;
+
+        cancel_delayed_work(&priv->dwork_auth);
+        if (status != WLAN_STATUS_SUCCESS) {
+                /* try to join next bss */
+                at76_set_mac_state(priv, MAC_JOINING);
+                schedule_work(&priv->work_join);
+                return;
         }
 
-        /* CRC currently not checked */
-        fwe->board_type = le32_to_cpu(fwh->board_type);
-        if (fwe->board_type != board_type) {
-                dev_printk(KERN_ERR, &udev->dev,
-                           "board type mismatch, requested %u, got %u\n",
-                           board_type, fwe->board_type);
-                goto exit;
+        if (priv->auth_mode == WLAN_AUTH_OPEN || seq_nr == 4) {
+                priv->retries = ASSOC_RETRIES;
+                at76_set_mac_state(priv, MAC_ASSOC);
+                at76_assoc_req(priv, priv->curr_bss);
+                at76_dbg(DBG_MGMT_TIMER,
+                         "%s:%d: starting mgmt_timer + HZ", __func__, __LINE__);
+                schedule_delayed_work(&priv->dwork_assoc, ASSOC_TIMEOUT);
+                return;
         }
 
-        fwe->fw_version.major = fwh->major;
-        fwe->fw_version.minor = fwh->minor;
-        fwe->fw_version.patch = fwh->patch;
-        fwe->fw_version.build = fwh->build;
+        WARN_ON(seq_nr != 2);
+        at76_auth_req(priv, priv->curr_bss, seq_nr + 1, resp->info_element);
+        at76_dbg(DBG_MGMT_TIMER, "%s:%d: starting mgmt_timer + HZ", __func__,
+                 __LINE__);
+        schedule_delayed_work(&priv->dwork_auth, AUTH_TIMEOUT);
+}
 
-        str = (char *)fwh + le32_to_cpu(fwh->str_offset);
-        fwe->intfw = (u8 *)fwh + le32_to_cpu(fwh->int_fw_offset);
-        fwe->intfw_size = le32_to_cpu(fwh->int_fw_len);
-        fwe->extfw = (u8 *)fwh + le32_to_cpu(fwh->ext_fw_offset);
-        fwe->extfw_size = le32_to_cpu(fwh->ext_fw_len);
+static void at76_rx_mgmt_deauth(struct at76_priv *priv,
+                                struct at76_rx_buffer *buf)
+{
+        struct ieee80211_disassoc *resp =
+            (struct ieee80211_disassoc *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &resp->header;
+
+        at76_dbg(DBG_RX_MGMT | DBG_PROGRESS,
+                 "%s: rx DeAuth bssid %s reason 0x%04x destination %s",
+                 priv->netdev->name, mac2str(mgmt->addr3),
+                 le16_to_cpu(resp->reason), mac2str(mgmt->addr1));
+
+        if (priv->mac_state != MAC_AUTH && priv->mac_state != MAC_ASSOC
+            && priv->mac_state != MAC_CONNECTED) {
+                printk(KERN_INFO "%s: DeAuth in state %s ignored\n",
+                       priv->netdev->name, mac_states[priv->mac_state]);
+                return;
+        }
 
-        fwe->loaded = 1;
+        BUG_ON(!priv->curr_bss);
 
-        dev_printk(KERN_DEBUG, &udev->dev,
-                   "using firmware %s (version %d.%d.%d-%d)\n",
-                   fwe->fwname, fwh->major, fwh->minor, fwh->patch, fwh->build);
+        /* Not our BSSID, ignore */
+        if (compare_ether_addr(mgmt->addr3, priv->curr_bss->bssid))
+                return;
 
-        at76_dbg(DBG_DEVSTART, "board %u, int %d:%d, ext %d:%d", board_type,
-                 le32_to_cpu(fwh->int_fw_offset), le32_to_cpu(fwh->int_fw_len),
-                 le32_to_cpu(fwh->ext_fw_offset), le32_to_cpu(fwh->ext_fw_len));
-        at76_dbg(DBG_DEVSTART, "firmware id %s", str);
+        /* Not for our STA and not broadcast, ignore */
+        if (compare_ether_addr(priv->netdev->dev_addr, mgmt->addr1)
+            && !is_broadcast_ether_addr(mgmt->addr1))
+                return;
 
-exit:
-        mutex_unlock(&fw_mutex);
+        if (priv->mac_state == MAC_CONNECTED)
+                at76_iwevent_bss_disconnect(priv->netdev);
 
-        if (fwe->loaded)
-                return fwe;
-        else
-                return NULL;
+        at76_set_mac_state(priv, MAC_JOINING);
+        schedule_work(&priv->work_join);
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
 }
 
-static void at76_mac80211_tx_callback(struct urb *urb)
+static void at76_rx_mgmt_beacon(struct at76_priv *priv,
+                                struct at76_rx_buffer *buf)
 {
-        struct at76_priv *priv = urb->context;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(priv->tx_skb);
+        int varpar_len;
+        /* beacon content */
+        struct ieee80211_beacon *bdata = (struct ieee80211_beacon *)buf->packet;
+        struct ieee80211_hdr_3addr *mgmt = &bdata->header;
+
+        struct list_head *lptr;
+        struct bss_info *match; /* entry matching addr3 with its bssid */
+        int new_entry = 0;
+        int len;
+        struct ieee80211_info_element *ie;
+        int have_ssid = 0;
+        int have_rates = 0;
+        int have_channel = 0;
+        int keep_going = 1;
+        unsigned long flags;
+
+        spin_lock_irqsave(&priv->bss_list_spinlock, flags);
+        if (priv->mac_state == MAC_CONNECTED) {
+                /* in state MAC_CONNECTED we use the mgmt_timer to control
+                   the beacon of the BSS */
+                BUG_ON(!priv->curr_bss);
+
+                if (!compare_ether_addr(priv->curr_bss->bssid, mgmt->addr3)) {
+                        /* We got our AP's beacon, defer the timeout handler.
+                           Kill pending work first, as schedule_delayed_work()
+                           won't do it. */
+                        cancel_delayed_work(&priv->dwork_beacon);
+                        schedule_delayed_work(&priv->dwork_beacon,
+                                              BEACON_TIMEOUT);
+                        priv->curr_bss->rssi = buf->rssi;
+                        priv->beacons_received++;
+                        goto exit;
+                }
+        }
 
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+        /* look if we have this BSS already in the list */
+        match = NULL;
 
-        switch (urb->status) {
-        case 0:
-                /* success */
-                /* FIXME:
-                 * is the frame really ACKed when tx_callback is called ? */
-                info->flags |= IEEE80211_TX_STAT_ACK;
-                break;
-        case -ENOENT:
-        case -ECONNRESET:
-                /* fail, urb has been unlinked */
-                /* FIXME: add error message */
-                break;
-        default:
-                at76_dbg(DBG_URB, "%s - nonzero tx status received: %d",
-                         __func__, urb->status);
-                break;
+        if (!list_empty(&priv->bss_list)) {
+                list_for_each(lptr, &priv->bss_list) {
+                        struct bss_info *bss_ptr =
+                            list_entry(lptr, struct bss_info, list);
+                        if (!compare_ether_addr(bss_ptr->bssid, mgmt->addr3)) {
+                                match = bss_ptr;
+                                break;
+                        }
+                }
         }
 
-        memset(&info->status, 0, sizeof(info->status));
+        if (!match) {
+                /* BSS not in the list - append it */
+                match = kzalloc(sizeof(struct bss_info), GFP_ATOMIC);
+                if (!match) {
+                        at76_dbg(DBG_BSS_TABLE,
+                                 "%s: cannot kmalloc new bss info (%zd byte)",
+                                 priv->netdev->name, sizeof(struct bss_info));
+                        goto exit;
+                }
+                new_entry = 1;
+                list_add_tail(&match->list, &priv->bss_list);
+        }
 
-        ieee80211_tx_status_irqsafe(priv->hw, priv->tx_skb);
+        match->capa = le16_to_cpu(bdata->capability);
+        match->beacon_interval = le16_to_cpu(bdata->beacon_interval);
+        match->rssi = buf->rssi;
+        match->link_qual = buf->link_quality;
+        match->noise_level = buf->noise_level;
+        memcpy(match->bssid, mgmt->addr3, ETH_ALEN);
+        at76_dbg(DBG_RX_BEACON, "%s: bssid %s", priv->netdev->name,
+                 mac2str(match->bssid));
+
+        ie = bdata->info_element;
+
+        /* length of var length beacon parameters */
+        varpar_len = min_t(int, le16_to_cpu(buf->wlength) -
+                           sizeof(struct ieee80211_beacon),
+                           BEACON_MAX_DATA_LENGTH);
+
+        /* This routine steps through the bdata->data array to get
+         * some useful information about the access point.
+         * Currently, this implementation supports receipt of: SSID,
+         * supported transfer rates and channel, in any order, with some
+         * tolerance for intermittent unknown codes (although this
+         * functionality may not be necessary as the useful information will
+         * usually arrive in consecutively, but there have been some
+         * reports of some of the useful information fields arriving in a
+         * different order).
+         * It does not support any more IE types although MFIE_TYPE_TIM may
+         * be supported (on my AP at least).
+         * The bdata->data array is about 1500 bytes long but only ~36 of those
+         * bytes are useful, hence the have_ssid etc optimizations. */
+
+        while (keep_going &&
+               ((&ie->data[ie->len] - (u8 *)bdata->info_element) <=
+                varpar_len)) {
+
+                switch (ie->id) {
+
+                case MFIE_TYPE_SSID:
+                        if (have_ssid)
+                                break;
 
-        priv->tx_skb = NULL;
+                        len = min_t(int, IW_ESSID_MAX_SIZE, ie->len);
 
-        ieee80211_wake_queues(priv->hw);
-}
+                        /* we copy only if this is a new entry,
+                           or the incoming SSID is not a hidden SSID. This
+                           will protect us from overwriting a real SSID read
+                           in a ProbeResponse with a hidden one from a
+                           following beacon. */
+                        if (!new_entry && at76_is_hidden_ssid(ie->data, len)) {
+                                have_ssid = 1;
+                                break;
+                        }
 
-static int at76_mac80211_tx(struct ieee80211_hw *hw, struct sk_buff *skb)
-{
-        struct at76_priv *priv = hw->priv;
-        struct at76_tx_buffer *tx_buffer = priv->bulk_out_buffer;
-        struct ieee80211_tx_info *info = IEEE80211_SKB_CB(skb);
-        int padding, submit_len, ret;
+                        match->ssid_len = len;
+                        memcpy(match->ssid, ie->data, len);
+                        at76_dbg(DBG_RX_BEACON, "%s: SSID - %.*s",
+                                 priv->netdev->name, len, match->ssid);
+                        have_ssid = 1;
+                        break;
 
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+                case MFIE_TYPE_RATES:
+                        if (have_rates)
+                                break;
 
-        if (priv->tx_urb->status == -EINPROGRESS) {
-                printk(KERN_ERR "%s: %s called while tx urb is pending\n",
-                       wiphy_name(priv->hw->wiphy), __func__);
-                return NETDEV_TX_BUSY;
-        }
+                        match->rates_len =
+                            min_t(int, sizeof(match->rates), ie->len);
+                        memcpy(match->rates, ie->data, match->rates_len);
+                        have_rates = 1;
+                        at76_dbg(DBG_RX_BEACON, "%s: SUPPORTED RATES %s",
+                                 priv->netdev->name,
+                                 hex2str(ie->data, ie->len));
+                        break;
 
-        ieee80211_stop_queues(hw);
+                case MFIE_TYPE_DS_SET:
+                        if (have_channel)
+                                break;
 
-        at76_ledtrig_tx_activity();     /* tell ledtrigger we send a packet */
+                        match->channel = ie->data[0];
+                        have_channel = 1;
+                        at76_dbg(DBG_RX_BEACON, "%s: CHANNEL - %d",
+                                 priv->netdev->name, match->channel);
+                        break;
 
-        WARN_ON(priv->tx_skb != NULL);
+                case MFIE_TYPE_CF_SET:
+                case MFIE_TYPE_TIM:
+                case MFIE_TYPE_IBSS_SET:
+                default:
+                        at76_dbg(DBG_RX_BEACON, "%s: beacon IE id %d len %d %s",
+                                 priv->netdev->name, ie->id, ie->len,
+                                 hex2str(ie->data, ie->len));
+                        break;
+                }
 
-        priv->tx_skb = skb;
-        padding = at76_calc_padding(skb->len);
-        submit_len = AT76_TX_HDRLEN + skb->len + padding;
+                /* advance to the next informational element */
+                next_ie(&ie);
 
-        /* setup 'Atmel' header */
-        memset(tx_buffer, 0, sizeof(*tx_buffer));
-        tx_buffer->padding = padding;
-        tx_buffer->wlength = cpu_to_le16(skb->len);
-        tx_buffer->tx_rate = ieee80211_get_tx_rate(hw, info)->hw_value;
-        if (FIRMWARE_IS_WPA(priv->fw_version) && info->control.hw_key) {
-                tx_buffer->key_id = (info->control.hw_key->keyidx);
-                tx_buffer->cipher_type =
-                        priv->keys[info->control.hw_key->keyidx].cipher;
-                tx_buffer->cipher_length =
-                        priv->keys[info->control.hw_key->keyidx].keylen;
-                tx_buffer->reserved = 0;
-        } else {
-                tx_buffer->key_id = 0;
-                tx_buffer->cipher_type = 0;
-                tx_buffer->cipher_length = 0;
-                tx_buffer->reserved = 0;
-        };
-        /* memset(tx_buffer->reserved, 0, sizeof(tx_buffer->reserved)); */
-        memcpy(tx_buffer->packet, skb->data, skb->len);
+                /* Optimization: after all, the bdata->data array is
+                 * varpar_len bytes long, whereas we get all of the useful
+                 * information after only ~36 bytes, this saves us a lot of
+                 * time (and trouble as the remaining portion of the array
+                 * could be full of junk)
+                 * Comment this out if you want to see what other information
+                 * comes from the AP - although little of it may be useful */
+        }
 
-        at76_dbg(DBG_TX_DATA, "%s tx: wlen 0x%x pad 0x%x rate %d hdr",
-                 wiphy_name(priv->hw->wiphy), le16_to_cpu(tx_buffer->wlength),
-                 tx_buffer->padding, tx_buffer->tx_rate);
+        at76_dbg(DBG_RX_BEACON, "%s: Finished processing beacon data",
+                 priv->netdev->name);
 
-        /* send stuff */
-        at76_dbg_dump(DBG_TX_DATA_CONTENT, tx_buffer, submit_len,
-                      "%s(): tx_buffer %d bytes:", __func__, submit_len);
-        usb_fill_bulk_urb(priv->tx_urb, priv->udev, priv->tx_pipe, tx_buffer,
-                          submit_len, at76_mac80211_tx_callback, priv);
-        ret = usb_submit_urb(priv->tx_urb, GFP_ATOMIC);
-        if (ret) {
-                printk(KERN_ERR "%s: error in tx submit urb: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                if (ret == -EINVAL)
-                        printk(KERN_ERR
-                               "%s: -EINVAL: tx urb %p hcpriv %p complete %p\n",
-                               wiphy_name(priv->hw->wiphy), priv->tx_urb,
-                               priv->tx_urb->hcpriv, priv->tx_urb->complete);
-        }
+        match->last_rx = jiffies;       /* record last rx of beacon */
 
-        return 0;
+exit:
+        spin_unlock_irqrestore(&priv->bss_list_spinlock, flags);
 }
 
-static int at76_mac80211_start(struct ieee80211_hw *hw)
+/* Calculate the link level from a given rx_buffer */
+static void at76_calc_level(struct at76_priv *priv, struct at76_rx_buffer *buf,
+                            struct iw_quality *qual)
 {
-        struct at76_priv *priv = hw->priv;
-        int ret;
-
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+        /* just a guess for now, might be different for other chips */
+        int max_rssi = 42;
 
-        mutex_lock(&priv->mtx);
-
-        ret = at76_submit_rx_urb(priv);
-        if (ret < 0) {
-                printk(KERN_ERR "%s: open: submit_rx_urb failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                goto error;
-        }
+        qual->level = (buf->rssi * 100 / max_rssi);
+        if (qual->level > 100)
+                qual->level = 100;
+        qual->updated |= IW_QUAL_LEVEL_UPDATED;
+}
 
-        at76_startup_device(priv);
+/* Calculate the link quality from a given rx_buffer */
+static void at76_calc_qual(struct at76_priv *priv, struct at76_rx_buffer *buf,
+                           struct iw_quality *qual)
+{
+        if (at76_is_intersil(priv->board_type))
+                qual->qual = buf->link_quality;
+        else {
+                unsigned long elapsed;
 
-        at76_start_monitor(priv);
+                /* Update qual at most once a second */
+                elapsed = jiffies - priv->beacons_last_qual;
+                if (elapsed < 1 * HZ)
+                        return;
 
-error:
-        mutex_unlock(&priv->mtx);
+                qual->qual = qual->level * priv->beacons_received *
+                    msecs_to_jiffies(priv->beacon_period) / elapsed;
 
-        return 0;
+                priv->beacons_last_qual = jiffies;
+                priv->beacons_received = 0;
+        }
+        qual->qual = (qual->qual > 100) ? 100 : qual->qual;
+        qual->updated |= IW_QUAL_QUAL_UPDATED;
 }
 
-static void at76_mac80211_stop(struct ieee80211_hw *hw)
+/* Calculate the noise quality from a given rx_buffer */
+static void at76_calc_noise(struct at76_priv *priv, struct at76_rx_buffer *buf,
+                            struct iw_quality *qual)
 {
-        struct at76_priv *priv = hw->priv;
-
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
-
-        mutex_lock(&priv->mtx);
+        qual->noise = 0;
+        qual->updated |= IW_QUAL_NOISE_INVALID;
+}
 
-        if (!priv->device_unplugged) {
-                /* We are called by "ifconfig ethX down", not because the
-                 * device is not available anymore. */
-                if (at76_set_radio(priv, 0) == 1)
-                        at76_wait_completion(priv, CMD_RADIO_ON);
+static void at76_update_wstats(struct at76_priv *priv,
+                               struct at76_rx_buffer *buf)
+{
+        struct iw_quality *qual = &priv->wstats.qual;
 
-                /* We unlink rx_urb because at76_open() re-submits it.
-                 * If unplugged, at76_delete_device() takes care of it. */
-                usb_kill_urb(priv->rx_urb);
+        if (buf->rssi && priv->mac_state == MAC_CONNECTED) {
+                qual->updated = 0;
+                at76_calc_level(priv, buf, qual);
+                at76_calc_qual(priv, buf, qual);
+                at76_calc_noise(priv, buf, qual);
+        } else {
+                qual->qual = 0;
+                qual->level = 0;
+                qual->noise = 0;
+                qual->updated = IW_QUAL_ALL_INVALID;
         }
-
-        mutex_unlock(&priv->mtx);
 }
 
-static int at76_add_interface(struct ieee80211_hw *hw,
-                              struct ieee80211_if_init_conf *conf)
+static void at76_rx_mgmt(struct at76_priv *priv, struct at76_rx_buffer *buf)
 {
-        struct at76_priv *priv = hw->priv;
-        int ret = 0;
+        struct ieee80211_hdr_3addr *mgmt =
+            (struct ieee80211_hdr_3addr *)buf->packet;
+        u16 framectl = le16_to_cpu(mgmt->frame_ctl);
+
+        /* update wstats */
+        if (priv->mac_state != MAC_INIT && priv->mac_state != MAC_SCANNING) {
+                /* jal: this is a dirty hack needed by Tim in ad-hoc mode */
+                /* Data packets always seem to have a 0 link level, so we
+                   only read link quality info from management packets.
+                   Atmel driver actually averages the present, and previous
+                   values, we just present the raw value at the moment - TJS */
+                if (priv->iw_mode == IW_MODE_ADHOC
+                    || (priv->curr_bss
+                        && !compare_ether_addr(mgmt->addr3,
+                                               priv->curr_bss->bssid)))
+                        at76_update_wstats(priv, buf);
+        }
 
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
+        at76_dbg(DBG_RX_MGMT_CONTENT, "%s rx mgmt framectl 0x%x %s",
+                 priv->netdev->name, framectl,
+                 hex2str(mgmt, le16_to_cpu(buf->wlength)));
 
-        mutex_lock(&priv->mtx);
+        switch (framectl & IEEE80211_FCTL_STYPE) {
+        case IEEE80211_STYPE_BEACON:
+        case IEEE80211_STYPE_PROBE_RESP:
+                at76_rx_mgmt_beacon(priv, buf);
+                break;
+
+        case IEEE80211_STYPE_ASSOC_RESP:
+                at76_rx_mgmt_assoc(priv, buf);
+                break;
 
-        switch (conf->type) {
-        case NL80211_IFTYPE_STATION:
-                priv->iw_mode = IW_MODE_INFRA;
+        case IEEE80211_STYPE_DISASSOC:
+                at76_rx_mgmt_disassoc(priv, buf);
                 break;
+
+        case IEEE80211_STYPE_AUTH:
+                at76_rx_mgmt_auth(priv, buf);
+                break;
+
+        case IEEE80211_STYPE_DEAUTH:
+                at76_rx_mgmt_deauth(priv, buf);
+                break;
+
         default:
-                ret = -EOPNOTSUPP;
-                goto exit;
+                printk(KERN_DEBUG "%s: ignoring frame with framectl 0x%04x\n",
+                       priv->netdev->name, framectl);
         }
 
-exit:
-        mutex_unlock(&priv->mtx);
-
-        return ret;
+        return;
 }
 
-static void at76_remove_interface(struct ieee80211_hw *hw,
-                                  struct ieee80211_if_init_conf *conf)
+/* Convert the 802.11 header into an ethernet-style header, make skb
+ * ready for consumption by netif_rx() */
+static void at76_ieee80211_to_eth(struct sk_buff *skb, int iw_mode)
 {
-        at76_dbg(DBG_MAC80211, "%s()", __func__);
-}
+        struct ieee80211_hdr_3addr *i802_11_hdr;
+        struct ethhdr *eth_hdr_p;
+        u8 *src_addr;
+        u8 *dest_addr;
 
-static int at76_join(struct at76_priv *priv)
-{
-        struct at76_req_join join;
-        int ret;
+        i802_11_hdr = (struct ieee80211_hdr_3addr *)skb->data;
 
-        memset(&join, 0, sizeof(struct at76_req_join));
-        memcpy(join.essid, priv->essid, priv->essid_size);
-        join.essid_size = priv->essid_size;
-        memcpy(join.bssid, priv->bssid, ETH_ALEN);
-        join.bss_type = INFRASTRUCTURE_MODE;
-        join.channel = priv->channel;
-        join.timeout = cpu_to_le16(2000);
+        /* That would be the ethernet header if the hardware converted
+         * the frame for us.  Make sure the source and the destination
+         * match the 802.11 header.  Which hardware does it? */
+        eth_hdr_p = (struct ethhdr *)skb_pull(skb, IEEE80211_3ADDR_LEN);
 
-        at76_dbg(DBG_MAC80211, "%s: sending CMD_JOIN", __func__);
-        ret = at76_set_card_command(priv->udev, CMD_JOIN, &join,
-                                    sizeof(struct at76_req_join));
+        dest_addr = i802_11_hdr->addr1;
+        if (iw_mode == IW_MODE_ADHOC)
+                src_addr = i802_11_hdr->addr2;
+        else
+                src_addr = i802_11_hdr->addr3;
 
-        if (ret < 0) {
-                printk(KERN_ERR "%s: at76_set_card_command failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                return 0;
-        }
+        if (!compare_ether_addr(eth_hdr_p->h_source, src_addr) &&
+            !compare_ether_addr(eth_hdr_p->h_dest, dest_addr))
+                /* Yes, we already have an ethernet header */
+                skb_reset_mac_header(skb);
+        else {
+                u16 len;
+
+                /* Need to build an ethernet header */
+                if (!memcmp(skb->data, snapsig, sizeof(snapsig))) {
+                        /* SNAP frame - decapsulate, keep proto */
+                        skb_push(skb, offsetof(struct ethhdr, h_proto) -
+                                 sizeof(rfc1042sig));
+                        len = 0;
+                } else {
+                        /* 802.3 frame, proto is length */
+                        len = skb->len;
+                        skb_push(skb, ETH_HLEN);
+                }
 
-        ret = at76_wait_completion(priv, CMD_JOIN);
-        at76_dbg(DBG_MAC80211, "%s: CMD_JOIN returned: 0x%02x", __func__, ret);
-        if (ret != CMD_STATUS_COMPLETE) {
-                printk(KERN_ERR "%s: at76_wait_completion failed: %d\n",
-                       wiphy_name(priv->hw->wiphy), ret);
-                return 0;
+                skb_reset_mac_header(skb);
+                eth_hdr_p = eth_hdr(skb);
+                /* This needs to be done in this order (eth_hdr_p->h_dest may
+                 * overlap src_addr) */
+                memcpy(eth_hdr_p->h_source, src_addr, ETH_ALEN);
+                memcpy(eth_hdr_p->h_dest, dest_addr, ETH_ALEN);
+                if (len)
+                        eth_hdr_p->h_proto = htons(len);
         }
 
-        at76_set_tkip_bssid(priv, priv->bssid);
-        at76_set_pm_mode(priv);
-
-        return 0;
+        skb->protocol = eth_type_trans(skb, skb->dev);
 }
 
-static void at76_dwork_hw_scan(struct work_struct *work)
+/* Check for fragmented data in priv->rx_skb. If the packet was no fragment
+   or it was the last of a fragment set a skb containing the whole packet
+   is returned for further processing. Otherwise we get NULL and are
+   done and the packet is either stored inside the fragment buffer
+   or thrown away.  Every returned skb starts with the ieee802_11 header
+   and contains _no_ FCS at the end */
+static struct sk_buff *at76_check_for_rx_frags(struct at76_priv *priv)
 {
-        struct at76_priv *priv = container_of(work, struct at76_priv,
-                                              dwork_hw_scan.work);
-        int ret;
+        struct sk_buff *skb = priv->rx_skb;
+        struct at76_rx_buffer *buf = (struct at76_rx_buffer *)skb->data;
+        struct ieee80211_hdr_3addr *i802_11_hdr =
+            (struct ieee80211_hdr_3addr *)buf->packet;
+        /* seq_ctrl, fragment_number, sequence number of new packet */
+        u16 sctl = le16_to_cpu(i802_11_hdr->seq_ctl);
+        u16 fragnr = sctl & 0xf;
+        u16 seqnr = sctl >> 4;
+        u16 frame_ctl = le16_to_cpu(i802_11_hdr->frame_ctl);
 
-        ret = at76_get_cmd_status(priv->udev, CMD_SCAN);
-        at76_dbg(DBG_MAC80211, "%s: CMD_SCAN status 0x%02x", __func__, ret);
+        /* Length including the IEEE802.11 header, but without the trailing
+         * FCS and without the Atmel Rx header */
+        int length = le16_to_cpu(buf->wlength) - IEEE80211_FCS_LEN;
 
-        /* FIXME: add maximum time for scan to complete */
+        /* where does the data payload start in skb->data ? */
+        u8 *data = i802_11_hdr->payload;
 
-        if (ret != CMD_STATUS_COMPLETE) {
-                queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
-                                   SCAN_POLL_INTERVAL);
-                goto exit;
+        /* length of payload, excl. the trailing FCS */
+        int data_len = length - IEEE80211_3ADDR_LEN;
+
+        int i;
+        struct rx_data_buf *bptr, *optr;
+        unsigned long oldest = ~0UL;
+
+        at76_dbg(DBG_RX_FRAGS,
+                 "%s: rx data frame_ctl %04x addr2 %s seq/frag %d/%d "
+                 "length %d data %d: %s ...", priv->netdev->name, frame_ctl,
+                 mac2str(i802_11_hdr->addr2), seqnr, fragnr, length, data_len,
+                 hex2str(data, 32));
+
+        at76_dbg(DBG_RX_FRAGS_SKB, "%s: incoming skb: head %p data %p "
+                 "tail %p end %p len %d", priv->netdev->name, skb->head,
+                 skb->data, skb_tail_pointer(skb), skb_end_pointer(skb),
+                 skb->len);
+
+        if (data_len < 0) {
+                /* make sure data starts in the buffer */
+                printk(KERN_INFO "%s: data frame too short\n",
+                       priv->netdev->name);
+                return NULL;
         }
 
-        ieee80211_scan_completed(priv->hw);
+        WARN_ON(length <= AT76_RX_HDRLEN);
+        if (length <= AT76_RX_HDRLEN)
+                return NULL;
 
-        if (is_valid_ether_addr(priv->bssid)) {
-                ieee80211_wake_queues(priv->hw);
-                at76_join(priv);
+        /* remove the at76_rx_buffer header - we don't need it anymore */
+        /* we need the IEEE802.11 header (for the addresses) if this packet
+           is the first of a chain */
+        skb_pull(skb, AT76_RX_HDRLEN);
+
+        /* remove FCS at end */
+        skb_trim(skb, length);
+
+        at76_dbg(DBG_RX_FRAGS_SKB, "%s: trimmed skb: head %p data %p tail %p "
+                 "end %p len %d data %p data_len %d", priv->netdev->name,
+                 skb->head, skb->data, skb_tail_pointer(skb),
+                 skb_end_pointer(skb), skb->len, data, data_len);
+
+        if (fragnr == 0 && !(frame_ctl & IEEE80211_FCTL_MOREFRAGS)) {
+                /* unfragmented packet received */
+                /* Use a new skb for the next receive */
+                priv->rx_skb = NULL;
+                at76_dbg(DBG_RX_FRAGS, "%s: unfragmented", priv->netdev->name);
+                return skb;
         }
 
-        ieee80211_wake_queues(priv->hw);
+        /* look if we've got a chain for the sender address.
+           afterwards optr points to first free or the oldest entry,
+           or, if i < NR_RX_DATA_BUF, bptr points to the entry for the
+           sender address */
+        /* determining the oldest entry doesn't cope with jiffies wrapping
+           but I don't care to delete a young entry at these rare moments ... */
+
+        bptr = priv->rx_data;
+        optr = NULL;
+        for (i = 0; i < NR_RX_DATA_BUF; i++, bptr++) {
+                if (!bptr->skb) {
+                        optr = bptr;
+                        oldest = 0UL;
+                        continue;
+                }
 
-exit:
-        return;
-}
+                if (!compare_ether_addr(i802_11_hdr->addr2, bptr->sender))
+                        break;
 
-static int at76_hw_scan(struct ieee80211_hw *hw, u8 *ssid, size_t len)
-{
-        struct at76_priv *priv = hw->priv;
-        struct at76_req_scan scan;
-        int ret;
+                if (!optr) {
+                        optr = bptr;
+                        oldest = bptr->last_rx;
+                } else if (bptr->last_rx < oldest)
+                        optr = bptr;
+        }
 
-        at76_dbg(DBG_MAC80211, "%s():", __func__);
-        at76_dbg_dump(DBG_MAC80211, ssid, len, "ssid %zd bytes:", len);
+        if (i < NR_RX_DATA_BUF) {
+
+                at76_dbg(DBG_RX_FRAGS, "%s: %d. cacheentry (seq/frag = %d/%d) "
+                         "matched sender addr",
+                         priv->netdev->name, i, bptr->seqnr, bptr->fragnr);
+
+                /* bptr points to an entry for the sender address */
+                if (bptr->seqnr == seqnr) {
+                        int left;
+                        /* the fragment has the current sequence number */
+                        if (((bptr->fragnr + 1) & 0xf) != fragnr) {
+                                /* wrong fragment number -> ignore it */
+                                /* is & 0xf necessary above ??? */
+                                at76_dbg(DBG_RX_FRAGS,
+                                         "%s: frag nr mismatch: %d + 1 != %d",
+                                         priv->netdev->name, bptr->fragnr,
+                                         fragnr);
+                                return NULL;
+                        }
+                        bptr->last_rx = jiffies;
+                        /* the next following fragment number ->
+                           add the data at the end */
+
+                        /* for test only ??? */
+                        left = skb_tailroom(bptr->skb);
+                        if (left < data_len)
+                                printk(KERN_INFO
+                                       "%s: only %d byte free (need %d)\n",
+                                       priv->netdev->name, left, data_len);
+                        else
+                                memcpy(skb_put(bptr->skb, data_len), data,
+                                       data_len);
+
+                        bptr->fragnr = fragnr;
+                        if (frame_ctl & IEEE80211_FCTL_MOREFRAGS)
+                                return NULL;
+
+                        /* this was the last fragment - send it */
+                        skb = bptr->skb;
+                        bptr->skb = NULL;       /* free the entry */
+                        at76_dbg(DBG_RX_FRAGS, "%s: last frag of seq %d",
+                                 priv->netdev->name, seqnr);
+                        return skb;
+                }
 
-        mutex_lock(&priv->mtx);
+                /* got another sequence number */
+                if (fragnr == 0) {
+                        /* it's the start of a new chain - replace the
+                           old one by this */
+                        /* bptr->sender has the correct value already */
+                        at76_dbg(DBG_RX_FRAGS,
+                                 "%s: start of new seq %d, removing old seq %d",
+                                 priv->netdev->name, seqnr, bptr->seqnr);
+                        bptr->seqnr = seqnr;
+                        bptr->fragnr = 0;
+                        bptr->last_rx = jiffies;
+                        /* swap bptr->skb and priv->rx_skb */
+                        skb = bptr->skb;
+                        bptr->skb = priv->rx_skb;
+                        priv->rx_skb = skb;
+                } else {
+                        /* it from the middle of a new chain ->
+                           delete the old entry and skip the new one */
+                        at76_dbg(DBG_RX_FRAGS,
+                                 "%s: middle of new seq %d (%d) "
+                                 "removing old seq %d",
+                                 priv->netdev->name, seqnr, fragnr,
+                                 bptr->seqnr);
+                        dev_kfree_skb(bptr->skb);
+                        bptr->skb = NULL;
+                }
+                return NULL;
+        }
 
-        ieee80211_stop_queues(hw);
+        /* if we didn't find a chain for the sender address, optr
+           points either to the first free or the oldest entry */
 
-        memset(&scan, 0, sizeof(struct at76_req_scan));
-        memset(scan.bssid, 0xFF, ETH_ALEN);
-        scan.scan_type = SCAN_TYPE_ACTIVE;
-        if (priv->essid_size > 0) {
-                memcpy(scan.essid, ssid, len);
-                scan.essid_size = len;
+        if (fragnr != 0) {
+                /* this is not the begin of a fragment chain ... */
+                at76_dbg(DBG_RX_FRAGS,
+                         "%s: no chain for non-first fragment (%d)",
+                         priv->netdev->name, fragnr);
+                return NULL;
         }
-        scan.min_channel_time = cpu_to_le16(priv->scan_min_time);
-        scan.max_channel_time = cpu_to_le16(priv->scan_max_time);
-        scan.probe_delay = cpu_to_le16(priv->scan_min_time * 1000);
-        scan.international_scan = 0;
 
-        at76_dbg(DBG_MAC80211, "%s: sending CMD_SCAN", __func__);
-        ret = at76_set_card_command(priv->udev, CMD_SCAN, &scan, sizeof(scan));
+        BUG_ON(!optr);
+        if (optr->skb) {
+                /* swap the skb's */
+                skb = optr->skb;
+                optr->skb = priv->rx_skb;
+                priv->rx_skb = skb;
 
-        if (ret < 0) {
-                err("CMD_SCAN failed: %d", ret);
-                goto exit;
-        }
+                at76_dbg(DBG_RX_FRAGS,
+                         "%s: free old contents: sender %s seq/frag %d/%d",
+                         priv->netdev->name, mac2str(optr->sender),
+                         optr->seqnr, optr->fragnr);
 
-        queue_delayed_work(priv->hw->workqueue, &priv->dwork_hw_scan,
-                           SCAN_POLL_INTERVAL);
+        } else {
+                /* take the skb from priv->rx_skb */
+                optr->skb = priv->rx_skb;
+                /* let at76_submit_rx_urb() allocate a new skb */
+                priv->rx_skb = NULL;
 
-exit:
-        mutex_unlock(&priv->mtx);
+                at76_dbg(DBG_RX_FRAGS, "%s: use a free entry",
+                         priv->netdev->name);
+        }
+        memcpy(optr->sender, i802_11_hdr->addr2, ETH_ALEN);
+        optr->seqnr = seqnr;
+        optr->fragnr = 0;
+        optr->last_rx = jiffies;
 
-        return 0;
+        return NULL;
 }
 
-static int at76_config(struct ieee80211_hw *hw, u32 changed)
+/* Rx interrupt: we expect the complete data buffer in priv->rx_skb */
+static void at76_rx_data(struct at76_priv *priv)
 {
-        struct at76_priv *priv = hw->priv;
-        struct ieee80211_conf *conf = &hw->conf;
+        struct net_device *netdev = priv->netdev;
+        struct net_device_stats *stats = &priv->stats;
+        struct sk_buff *skb = priv->rx_skb;
+        struct at76_rx_buffer *buf = (struct at76_rx_buffer *)skb->data;
+        struct ieee80211_hdr_3addr *i802_11_hdr;
+        int length = le16_to_cpu(buf->wlength);
 
-        at76_dbg(DBG_MAC80211, "%s(): channel %d radio %d",
-                 __func__, conf->channel->hw_value, conf->radio_enabled);
-        at76_dbg_dump(DBG_MAC80211, priv->essid, priv->essid_size, "ssid:");
-        at76_dbg_dump(DBG_MAC80211, priv->bssid, ETH_ALEN, "bssid:");
+        at76_dbg(DBG_RX_DATA, "%s received data packet: %s", netdev->name,
+                 hex2str(skb->data, AT76_RX_HDRLEN));
 
-        mutex_lock(&priv->mtx);
+        at76_dbg(DBG_RX_DATA_CONTENT, "rx packet: %s",
+                 hex2str(skb->data + AT76_RX_HDRLEN, length));
 
-        priv->channel = conf->channel->hw_value;
+        skb = at76_check_for_rx_frags(priv);
+        if (!skb)
+                return;
 
-        if (is_valid_ether_addr(priv->bssid)) {
-                at76_join(priv);
-                ieee80211_wake_queues(priv->hw);
-        } else {
-                ieee80211_stop_queues(priv->hw);
-                at76_start_monitor(priv);
-        };
+        /* Atmel header and the FCS are already removed */
+        i802_11_hdr = (struct ieee80211_hdr_3addr *)skb->data;
 
-        mutex_unlock(&priv->mtx);
+        skb->dev = netdev;
+        skb->ip_summed = CHECKSUM_NONE; /* TODO: should check CRC */
 
-        return 0;
-}
+        if (is_broadcast_ether_addr(i802_11_hdr->addr1)) {
+                if (!compare_ether_addr(i802_11_hdr->addr1, netdev->broadcast))
+                        skb->pkt_type = PACKET_BROADCAST;
+                else
+                        skb->pkt_type = PACKET_MULTICAST;
+        } else if (compare_ether_addr(i802_11_hdr->addr1, netdev->dev_addr))
+                skb->pkt_type = PACKET_OTHERHOST;
 
-static int at76_config_interface(struct ieee80211_hw *hw,
-                                 struct ieee80211_vif *vif,
-                                 struct ieee80211_if_conf *conf)
-{
-        struct at76_priv *priv = hw->priv;
+        at76_ieee80211_to_eth(skb, priv->iw_mode);
 
-        at76_dbg_dump(DBG_MAC80211, conf->bssid, ETH_ALEN, "bssid:");
+        netdev->last_rx = jiffies;
+        netif_rx(skb);
+        stats->rx_packets++;
+        stats->rx_bytes += length;
 
-        mutex_lock(&priv->mtx);
+        return;
+}
 
-        memcpy(priv->bssid, conf->bssid, ETH_ALEN);
-//      memcpy(priv->essid, conf->ssid, conf->ssid_len);
-//      priv->essid_size = conf->ssid_len;
+static void at76_rx_monitor_mode(struct at76_priv *priv)
+{
+        struct at76_rx_radiotap *rt;
+        u8 *payload;
+        int skblen;
+        struct net_device *netdev = priv->netdev;
+        struct at76_rx_buffer *buf =
+            (struct at76_rx_buffer *)priv->rx_skb->data;
+        /* length including the IEEE802.11 header and the trailing FCS,
+           but not at76_rx_buffer */
+        int length = le16_to_cpu(buf->wlength);
+        struct sk_buff *skb = priv->rx_skb;
+        struct net_device_stats *stats = &priv->stats;
 
-        if (is_valid_ether_addr(priv->bssid)) {
-                /* mac80211 is joining a bss */
-                ieee80211_wake_queues(priv->hw);
-                at76_join(priv);
-        } else
-                ieee80211_stop_queues(priv->hw);
+        if (length < IEEE80211_FCS_LEN) {
+                /* buffer contains no data */
+                at76_dbg(DBG_MONITOR_MODE,
+                         "%s: MONITOR MODE: rx skb without data",
+                         priv->netdev->name);
+                return;
+        }
 
-        mutex_unlock(&priv->mtx);
+        skblen = sizeof(struct at76_rx_radiotap) + length;
 
-        return 0;
+        skb = dev_alloc_skb(skblen);
+        if (!skb) {
+                printk(KERN_ERR "%s: MONITOR MODE: dev_alloc_skb for radiotap "
+                       "header returned NULL\n", priv->netdev->name);
+                return;
+        }
+
+        skb_put(skb, skblen);
+
+        rt = (struct at76_rx_radiotap *)skb->data;
+        payload = skb->data + sizeof(struct at76_rx_radiotap);
+
+        rt->rt_hdr.it_version = 0;
+        rt->rt_hdr.it_pad = 0;
+        rt->rt_hdr.it_len = cpu_to_le16(sizeof(struct at76_rx_radiotap));
+        rt->rt_hdr.it_present = cpu_to_le32(AT76_RX_RADIOTAP_PRESENT);
+
+        rt->rt_tsft = cpu_to_le64(le32_to_cpu(buf->rx_time));
+        rt->rt_rate = hw_rates[buf->rx_rate] & (~0x80);
+        rt->rt_signal = buf->rssi;
+        rt->rt_noise = buf->noise_level;
+        rt->rt_flags = IEEE80211_RADIOTAP_F_FCS;
+        if (buf->fragmentation)
+                rt->rt_flags |= IEEE80211_RADIOTAP_F_FRAG;
+
+        memcpy(payload, buf->packet, length);
+        skb->dev = netdev;
+        skb->ip_summed = CHECKSUM_NONE;
+        skb_reset_mac_header(skb);
+        skb->pkt_type = PACKET_OTHERHOST;
+        skb->protocol = htons(ETH_P_802_2);
+
+        netdev->last_rx = jiffies;
+        netif_rx(skb);
+        stats->rx_packets++;
+        stats->rx_bytes += length;
 }
 
-/* must be atomic */
-static void at76_configure_filter(struct ieee80211_hw *hw,
-                                  unsigned int changed_flags,
-                                  unsigned int *total_flags, int mc_count,
-                                  struct dev_addr_list *mc_list)
+/* Check if we spy on the sender address in buf and update stats */
+static void at76_iwspy_update(struct at76_priv *priv,
+                              struct at76_rx_buffer *buf)
 {
-        struct at76_priv *priv = hw->priv;
-        int flags;
-
-        at76_dbg(DBG_MAC80211, "%s(): changed_flags=0x%08x "
-                 "total_flags=0x%08x mc_count=%d",
-                 __func__, changed_flags, *total_flags, mc_count);
+        struct ieee80211_hdr_3addr *hdr =
+            (struct ieee80211_hdr_3addr *)buf->packet;
+        struct iw_quality qual;
 
-        flags = changed_flags & AT76_SUPPORTED_FILTERS;
-        *total_flags = AT76_SUPPORTED_FILTERS;
+        /* We can only set the level here */
+        qual.updated = IW_QUAL_QUAL_INVALID | IW_QUAL_NOISE_INVALID;
+        qual.level = 0;
+        qual.noise = 0;
+        at76_calc_level(priv, buf, &qual);
 
-        /* FIXME: access to priv->promisc should be protected with
-         * priv->mtx, but it's impossible because this function needs to be
-         * atomic */
+        spin_lock_bh(&priv->spy_spinlock);
 
-        if (flags && !priv->promisc) {
-                /* mac80211 wants us to enable promiscuous mode */
-                priv->promisc = 1;
-        } else if (!flags && priv->promisc) {
-                /* we need to disable promiscuous mode */
-                priv->promisc = 0;
-        } else
-                return;
+        if (priv->spy_data.spy_number > 0)
+                wireless_spy_update(priv->netdev, hdr->addr2, &qual);
 
-        queue_work(hw->workqueue, &priv->work_set_promisc);
+        spin_unlock_bh(&priv->spy_spinlock);
 }
 
-static int at76_set_key_oldfw(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                        const u8 *local_address, const u8 *address,
-                        struct ieee80211_key_conf *key)
+static void at76_rx_tasklet(unsigned long param)
 {
-        struct at76_priv *priv = hw->priv;
-
-        int i;
-
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
-                 "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+        struct urb *urb = (struct urb *)param;
+        struct at76_priv *priv = urb->context;
+        struct net_device *netdev = priv->netdev;
+        struct at76_rx_buffer *buf;
+        struct ieee80211_hdr_3addr *i802_11_hdr;
+        u16 frame_ctl;
 
-        if (key->alg != ALG_WEP)
-                return -EOPNOTSUPP;
+        if (priv->device_unplugged) {
+                at76_dbg(DBG_DEVSTART, "device unplugged");
+                if (urb)
+                        at76_dbg(DBG_DEVSTART, "urb status %d", urb->status);
+                return;
+        }
 
-        key->hw_key_idx = key->keyidx;
+        if (!priv->rx_skb || !netdev || !priv->rx_skb->data)
+                return;
 
-        mutex_lock(&priv->mtx);
+        buf = (struct at76_rx_buffer *)priv->rx_skb->data;
 
-        switch (cmd) {
-        case SET_KEY:
-                memcpy(priv->wep_keys[key->keyidx], key->key, key->keylen);
-                priv->wep_keys_len[key->keyidx] = key->keylen;
+        i802_11_hdr = (struct ieee80211_hdr_3addr *)buf->packet;
 
-                /* FIXME: find out how to do this properly */
-                priv->wep_key_id = key->keyidx;
+        frame_ctl = le16_to_cpu(i802_11_hdr->frame_ctl);
 
-                break;
-        case DISABLE_KEY:
-        default:
-                priv->wep_keys_len[key->keyidx] = 0;
-                break;
+        if (urb->status != 0) {
+                if (urb->status != -ENOENT && urb->status != -ECONNRESET)
+                        at76_dbg(DBG_URB,
+                                 "%s %s: - nonzero Rx bulk status received: %d",
+                                 __func__, netdev->name, urb->status);
+                return;
         }
 
-        priv->wep_enabled = 0;
+        at76_dbg(DBG_RX_ATMEL_HDR,
+                 "%s: rx frame: rate %d rssi %d noise %d link %d %s",
+                 priv->netdev->name, buf->rx_rate, buf->rssi, buf->noise_level,
+                 buf->link_quality, hex2str(i802_11_hdr, 48));
+        if (priv->iw_mode == IW_MODE_MONITOR) {
+                at76_rx_monitor_mode(priv);
+                goto exit;
+        }
 
-        for (i = 0; i < WEP_KEYS; i++) {
-                if (priv->wep_keys_len[i] != 0)
-                        priv->wep_enabled = 1;
+        /* there is a new bssid around, accept it: */
+        if (buf->newbss && priv->iw_mode == IW_MODE_ADHOC) {
+                at76_dbg(DBG_PROGRESS, "%s: rx newbss", netdev->name);
+                schedule_work(&priv->work_new_bss);
         }
 
-        at76_startup_device(priv);
+        switch (frame_ctl & IEEE80211_FCTL_FTYPE) {
+        case IEEE80211_FTYPE_DATA:
+                at76_rx_data(priv);
+                break;
 
-        mutex_unlock(&priv->mtx);
+        case IEEE80211_FTYPE_MGMT:
+                /* jal: TODO: find out if we can update iwspy also on
+                   other frames than management (might depend on the
+                   radio chip / firmware version !) */
 
-        return 0;
-}
+                at76_iwspy_update(priv, buf);
 
-static int at76_set_key_newfw(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                        const u8 *local_address, const u8 *address,
-                        struct ieee80211_key_conf *key)
-{
-        struct at76_priv *priv = hw->priv;
-        int ret = -EOPNOTSUPP;
-
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
-                 "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+                at76_rx_mgmt(priv, buf);
+                break;
 
-        mutex_lock(&priv->mtx);
+        case IEEE80211_FTYPE_CTL:
+                at76_dbg(DBG_RX_CTRL, "%s: ignored ctrl frame: %04x",
+                         priv->netdev->name, frame_ctl);
+                break;
 
-        priv->mib_buf.type = MIB_MAC_ENCRYPTION;
+        default:
+                printk(KERN_DEBUG "%s: ignoring frame with framectl 0x%04x\n",
+                       priv->netdev->name, frame_ctl);
+        }
+exit:
+        at76_submit_rx_urb(priv);
+}
 
-        if (cmd == DISABLE_KEY) {
-                priv->mib_buf.size = CIPHER_KEY_LEN;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                cipher_default_keyvalue[key->keyidx]);
-                memset(priv->mib_buf.data.data, 0, CIPHER_KEY_LEN);
-                if (at76_set_mib(priv, &priv->mib_buf) != CMD_STATUS_COMPLETE)
-                        ret = -EOPNOTSUPP; /* -EIO would be probably better */
-                else {
+/* Load firmware into kernel memory and parse it */
+static struct fwentry *at76_load_firmware(struct usb_device *udev,
+                                          enum board_type board_type)
+{
+        int ret;
+        char *str;
+        struct at76_fw_header *fwh;
+        struct fwentry *fwe = &firmwares[board_type];
 
-                        priv->keys[key->keyidx].cipher = CIPHER_NONE;
-                        priv->keys[key->keyidx].keylen = 0;
-                };
-                if (priv->default_group_key == key->keyidx)
-                        priv->default_group_key = 0xff;
+        mutex_lock(&fw_mutex);
 
-                if (priv->default_pairwise_key == key->keyidx)
-                        priv->default_pairwise_key = 0xff;
-                /* If default pairwise key is removed, fall back to
-                 * group key? */
-                ret = 0;
+        if (fwe->loaded) {
+                at76_dbg(DBG_FW, "re-using previously loaded fw");
                 goto exit;
-        };
-
-        if (cmd == SET_KEY) {
-                /* store key into MIB */
-                priv->mib_buf.size = CIPHER_KEY_LEN;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                cipher_default_keyvalue[key->keyidx]);
-                memset(priv->mib_buf.data.data, 0, CIPHER_KEY_LEN);
-                memcpy(priv->mib_buf.data.data, key->key, key->keylen);
-
-                switch (key->alg) {
-                case ALG_WEP:
-                        if (key->keylen == 5) {
-                                priv->keys[key->keyidx].cipher =
-                                        CIPHER_WEP64;
-                                priv->keys[key->keyidx].keylen = 8;
-                        } else if (key->keylen == 13) {
-                                priv->keys[key->keyidx].cipher =
-                                        CIPHER_WEP128;
-                                /* Firmware needs this */
-                                priv->keys[key->keyidx].keylen = 8;
-                        } else {
-                                ret = -EOPNOTSUPP;
-                                goto exit;
-                        };
-                        break;
-                case ALG_TKIP:
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        priv->keys[key->keyidx].cipher = CIPHER_TKIP;
-                        priv->keys[key->keyidx].keylen = 12;
-                        break;
+        }
 
-                case ALG_CCMP:
-                        if (!at76_is_505a(priv->board_type)) {
-                                ret = -EOPNOTSUPP;
-                                goto exit;
-                        };
-                        key->flags |= IEEE80211_KEY_FLAG_GENERATE_MMIC;
-                        priv->keys[key->keyidx].cipher = CIPHER_CCMP;
-                        priv->keys[key->keyidx].keylen = 16;
-                        break;
+        at76_dbg(DBG_FW, "downloading firmware %s", fwe->fwname);
+        ret = request_firmware(&fwe->fw, fwe->fwname, &udev->dev);
+        if (ret < 0) {
+                dev_printk(KERN_ERR, &udev->dev, "firmware %s not found!\n",
+                           fwe->fwname);
+                dev_printk(KERN_ERR, &udev->dev,
+                           "you may need to download the firmware from "
+                           "http://developer.berlios.de/projects/at76c503a/");
+                goto exit;
+        }
 
-                default:
-                        ret = -EOPNOTSUPP;
-                        goto exit;
-                };
-
-                priv->mib_buf.data.data[38] = priv->keys[key->keyidx].cipher;
-                priv->mib_buf.data.data[39] = 1; /* Taken from atmelwlandriver,
-                                                    not documented */
-
-                if (is_valid_ether_addr(address))
-                        /* Pairwise key */
-                        priv->mib_buf.data.data[39] |= (KEY_PAIRWISE | KEY_TX);
-                else if (is_broadcast_ether_addr(address))
-                        /* Group key */
-                        priv->mib_buf.data.data[39] |= (KEY_TX);
-                else    /* Key used only for transmission ??? */
-                        priv->mib_buf.data.data[39] |= (KEY_TX);
-
-                if (at76_set_mib(priv, &priv->mib_buf) !=
-                                CMD_STATUS_COMPLETE) {
-                        ret = -EOPNOTSUPP; /* -EIO would be probably better */
-                        goto exit;
-                };
+        at76_dbg(DBG_FW, "got it.");
+        fwh = (struct at76_fw_header *)(fwe->fw->data);
 
-                if ((key->alg == ALG_TKIP) || (key->alg == ALG_CCMP))
-                        at76_reset_rsc(priv);
+        if (fwe->fw->size <= sizeof(*fwh)) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "firmware is too short (0x%zx)\n", fwe->fw->size);
+                goto exit;
+        }
 
-                key->hw_key_idx = key->keyidx;
+        /* CRC currently not checked */
+        fwe->board_type = le32_to_cpu(fwh->board_type);
+        if (fwe->board_type != board_type) {
+                dev_printk(KERN_ERR, &udev->dev,
+                           "board type mismatch, requested %u, got %u\n",
+                           board_type, fwe->board_type);
+                goto exit;
+        }
 
-                /* Set up default keys */
-                if (is_broadcast_ether_addr(address))
-                        priv->default_group_key = key->keyidx;
-                if (is_valid_ether_addr(address))
-                        priv->default_pairwise_key = key->keyidx;
+        fwe->fw_version.major = fwh->major;
+        fwe->fw_version.minor = fwh->minor;
+        fwe->fw_version.patch = fwh->patch;
+        fwe->fw_version.build = fwh->build;
 
-                /* Set up encryption MIBs */
+        str = (char *)fwh + le32_to_cpu(fwh->str_offset);
+        fwe->intfw = (u8 *)fwh + le32_to_cpu(fwh->int_fw_offset);
+        fwe->intfw_size = le32_to_cpu(fwh->int_fw_len);
+        fwe->extfw = (u8 *)fwh + le32_to_cpu(fwh->ext_fw_offset);
+        fwe->extfw_size = le32_to_cpu(fwh->ext_fw_len);
 
-                /* first block of settings */
-                priv->mib_buf.size = 3;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                privacy_invoked);
-                priv->mib_buf.data.data[0] = 1; /* privacy_invoked */
-                priv->mib_buf.data.data[1] = priv->default_pairwise_key;
-                priv->mib_buf.data.data[2] = priv->default_group_key;
+        fwe->loaded = 1;
 
-                ret = at76_set_mib(priv, &priv->mib_buf);
-                if (ret != CMD_STATUS_COMPLETE)
-                        goto exit;
+        dev_printk(KERN_DEBUG, &udev->dev,
+                   "using firmware %s (version %d.%d.%d-%d)\n",
+                   fwe->fwname, fwh->major, fwh->minor, fwh->patch, fwh->build);
 
-                /* second block of settings */
-                priv->mib_buf.size = 3;
-                priv->mib_buf.index = offsetof(struct mib_mac_encryption,
-                                exclude_unencrypted);
-                priv->mib_buf.data.data[0] = 1; /* exclude_unencrypted */
-                priv->mib_buf.data.data[1] = 0; /* wep_encryption_type */
-                priv->mib_buf.data.data[2] = 0; /* ckip_key_permutation */
+        at76_dbg(DBG_DEVSTART, "board %u, int %d:%d, ext %d:%d", board_type,
+                 le32_to_cpu(fwh->int_fw_offset), le32_to_cpu(fwh->int_fw_len),
+                 le32_to_cpu(fwh->ext_fw_offset), le32_to_cpu(fwh->ext_fw_len));
+        at76_dbg(DBG_DEVSTART, "firmware id %s", str);
 
-                ret = at76_set_mib(priv, &priv->mib_buf);
-                if (ret != CMD_STATUS_COMPLETE)
-                        goto exit;
-                ret = 0;
-        };
 exit:
-        at76_dump_mib_mac_encryption(priv);
-        mutex_unlock(&priv->mtx);
-        return ret;
-}
-
-static int at76_set_key(struct ieee80211_hw *hw, enum set_key_cmd cmd,
-                        const u8 *local_address, const u8 *address,
-                        struct ieee80211_key_conf *key)
-{
-        struct at76_priv *priv = hw->priv;
-
-        at76_dbg(DBG_MAC80211, "%s(): cmd %d key->alg %d key->keyidx %d "
-                 "key->keylen %d",
-                 __func__, cmd, key->alg, key->keyidx, key->keylen);
+        mutex_unlock(&fw_mutex);
 
-        if (FIRMWARE_IS_WPA(priv->fw_version))
-                return at76_set_key_newfw(hw, cmd, local_address, address, key);
+        if (fwe->loaded)
+                return fwe;
         else
-                return at76_set_key_oldfw(hw, cmd, local_address, address, key);
-
+                return NULL;
 }
 
-static const struct ieee80211_ops at76_ops = {
-        .tx = at76_mac80211_tx,
-        .add_interface = at76_add_interface,
-        .remove_interface = at76_remove_interface,
-        .config = at76_config,
-        .config_interface = at76_config_interface,
-        .configure_filter = at76_configure_filter,
-        .start = at76_mac80211_start,
-        .stop = at76_mac80211_stop,
-        .hw_scan = at76_hw_scan,
-        .set_key = at76_set_key,
-};
-
 /* Allocate network device and initialize private data */
 static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
 {
-        struct ieee80211_hw *hw;
+        struct net_device *netdev;
         struct at76_priv *priv;
+        int i;
 
-        hw = ieee80211_alloc_hw(sizeof(struct at76_priv), &at76_ops);
-        if (!hw) {
-                printk(KERN_ERR DRIVER_NAME ": could not register"
-                       " ieee80211_hw\n");
+        /* allocate memory for our device state and initialize it */
+        netdev = alloc_etherdev(sizeof(struct at76_priv));
+        if (!netdev) {
+                dev_printk(KERN_ERR, &udev->dev, "out of memory\n");
                 return NULL;
         }
 
-        priv = hw->priv;
-        priv->hw = hw;
+        priv = netdev_priv(netdev);
 
         priv->udev = udev;
+        priv->netdev = netdev;
 
         mutex_init(&priv->mtx);
+        INIT_WORK(&priv->work_assoc_done, at76_work_assoc_done);
+        INIT_WORK(&priv->work_join, at76_work_join);
+        INIT_WORK(&priv->work_new_bss, at76_work_new_bss);
+        INIT_WORK(&priv->work_start_scan, at76_work_start_scan);
         INIT_WORK(&priv->work_set_promisc, at76_work_set_promisc);
         INIT_WORK(&priv->work_submit_rx, at76_work_submit_rx);
-        INIT_DELAYED_WORK(&priv->dwork_hw_scan, at76_dwork_hw_scan);
+        INIT_DELAYED_WORK(&priv->dwork_restart, at76_dwork_restart);
+        INIT_DELAYED_WORK(&priv->dwork_get_scan, at76_dwork_get_scan);
+        INIT_DELAYED_WORK(&priv->dwork_beacon, at76_dwork_beacon);
+        INIT_DELAYED_WORK(&priv->dwork_auth, at76_dwork_auth);
+        INIT_DELAYED_WORK(&priv->dwork_assoc, at76_dwork_assoc);
+
+        spin_lock_init(&priv->mgmt_spinlock);
+        priv->next_mgmt_bulk = NULL;
+        priv->mac_state = MAC_INIT;
+
+        /* initialize empty BSS list */
+        priv->curr_bss = NULL;
+        INIT_LIST_HEAD(&priv->bss_list);
+        spin_lock_init(&priv->bss_list_spinlock);
+
+        init_timer(&priv->bss_list_timer);
+        priv->bss_list_timer.data = (unsigned long)priv;
+        priv->bss_list_timer.function = at76_bss_list_timeout;
+
+        spin_lock_init(&priv->spy_spinlock);
+
+        /* mark all rx data entries as unused */
+        for (i = 0; i < NR_RX_DATA_BUF; i++)
+                priv->rx_data[i].skb = NULL;
 
         priv->rx_tasklet.func = at76_rx_tasklet;
         priv->rx_tasklet.data = 0;
@@ -2371,9 +5197,6 @@ static struct at76_priv *at76_alloc_new_device(struct usb_device *udev)
         priv->pm_mode = AT76_PM_OFF;
         priv->pm_period = 0;
 
-        /* unit us */
-        priv->hw->channel_change_time = 100000;
-
         return priv;
 }
 
@@ -2436,42 +5259,11 @@ static int at76_alloc_urbs(struct at76_priv *priv,
         return 0;
 }
 
-static struct ieee80211_rate at76_rates[] = {
-        { .bitrate = 10, .hw_value = TX_RATE_1MBIT, },
-        { .bitrate = 20, .hw_value = TX_RATE_2MBIT, },
-        { .bitrate = 55, .hw_value = TX_RATE_5_5MBIT, },
-        { .bitrate = 110, .hw_value = TX_RATE_11MBIT, },
-};
-
-static struct ieee80211_channel at76_channels[] = {
-        { .center_freq = 2412, .hw_value = 1 },
-        { .center_freq = 2417, .hw_value = 2 },
-        { .center_freq = 2422, .hw_value = 3 },
-        { .center_freq = 2427, .hw_value = 4 },
-        { .center_freq = 2432, .hw_value = 5 },
-        { .center_freq = 2437, .hw_value = 6 },
-        { .center_freq = 2442, .hw_value = 7 },
-        { .center_freq = 2447, .hw_value = 8 },
-        { .center_freq = 2452, .hw_value = 9 },
-        { .center_freq = 2457, .hw_value = 10 },
-        { .center_freq = 2462, .hw_value = 11 },
-        { .center_freq = 2467, .hw_value = 12 },
-        { .center_freq = 2472, .hw_value = 13 },
-        { .center_freq = 2484, .hw_value = 14 }
-};
-
-static struct ieee80211_supported_band at76_supported_band = {
-        .channels = at76_channels,
-        .n_channels = ARRAY_SIZE(at76_channels),
-        .bitrates = at76_rates,
-        .n_bitrates = ARRAY_SIZE(at76_rates),
-};
-
 /* Register network device and initialize the hardware */
 static int at76_init_new_device(struct at76_priv *priv,
                                 struct usb_interface *interface)
 {
-        struct device *dev = &interface->dev;
+        struct net_device *netdev = priv->netdev;
         int ret;
 
         /* set up the endpoint information */
@@ -2487,11 +5279,14 @@ static int at76_init_new_device(struct at76_priv *priv,
         /* MAC address */
         ret = at76_get_hw_config(priv);
         if (ret < 0) {
-                dev_err(dev, "cannot get MAC address\n");
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot get MAC address\n");
                 goto exit;
         }
 
         priv->domain = at76_get_reg_domain(priv->regulatory_domain);
+        /* init. netdev->dev_addr */
+        memcpy(netdev->dev_addr, priv->mac_addr, ETH_ALEN);
 
         priv->channel = DEF_CHANNEL;
         priv->iw_mode = IW_MODE_INFRA;
@@ -2501,54 +5296,47 @@ static int at76_init_new_device(struct at76_priv *priv,
         priv->txrate = TX_RATE_AUTO;
         priv->preamble_type = PREAMBLE_TYPE_LONG;
         priv->beacon_period = 100;
+        priv->beacons_last_qual = jiffies;
         priv->auth_mode = WLAN_AUTH_OPEN;
         priv->scan_min_time = DEF_SCAN_MIN_TIME;
         priv->scan_max_time = DEF_SCAN_MAX_TIME;
         priv->scan_mode = SCAN_TYPE_ACTIVE;
-        priv->default_pairwise_key = 0xff;
-        priv->default_group_key = 0xff;
-
-        /* mac80211 initialisation */
-        priv->hw->wiphy->bands[IEEE80211_BAND_2GHZ] = &at76_supported_band;
 
-        if (FIRMWARE_IS_WPA(priv->fw_version) &&
-                (at76_is_503rfmd(priv->board_type) ||
-                 at76_is_505(priv->board_type)))
-                priv->hw->flags = IEEE80211_HW_SIGNAL_UNSPEC;
-        else
-                priv->hw->flags = IEEE80211_HW_RX_INCLUDES_FCS |
-                                  IEEE80211_HW_SIGNAL_UNSPEC;
-
-        priv->hw->wiphy->interface_modes = BIT(NL80211_IFTYPE_STATION);
-
-        SET_IEEE80211_DEV(priv->hw, &interface->dev);
-        SET_IEEE80211_PERM_ADDR(priv->hw, priv->mac_addr);
-
-        ret = ieee80211_register_hw(priv->hw);
+        netdev->flags &= ~IFF_MULTICAST;        /* not yet or never */
+        netdev->open = at76_open;
+        netdev->stop = at76_stop;
+        netdev->get_stats = at76_get_stats;
+        netdev->ethtool_ops = &at76_ethtool_ops;
+
+        /* Add pointers to enable iwspy support. */
+        priv->wireless_data.spy_data = &priv->spy_data;
+        netdev->wireless_data = &priv->wireless_data;
+
+        netdev->hard_start_xmit = at76_tx;
+        netdev->tx_timeout = at76_tx_timeout;
+        netdev->watchdog_timeo = 2 * HZ;
+        netdev->wireless_handlers = &at76_handler_def;
+        netdev->set_multicast_list = at76_set_multicast;
+        netdev->set_mac_address = at76_set_mac_address;
+        dev_alloc_name(netdev, "wlan%d");
+
+        ret = register_netdev(priv->netdev);
         if (ret) {
-                dev_err(dev, "cannot register mac80211 hw (status %d)!\n", ret);
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot register netdevice (status %d)!\n", ret);
                 goto exit;
         }
+        priv->netdev_registered = 1;
 
-        priv->mac80211_registered = 1;
+        printk(KERN_INFO "%s: USB %s, MAC %s, firmware %d.%d.%d-%d\n",
+               netdev->name, dev_name(&interface->dev), mac2str(priv->mac_addr),
+               priv->fw_version.major, priv->fw_version.minor,
+               priv->fw_version.patch, priv->fw_version.build);
+        printk(KERN_INFO "%s: regulatory domain 0x%02x: %s\n", netdev->name,
+               priv->regulatory_domain, priv->domain->name);
 
-        dev_info(dev, "%s: USB %s, MAC %s, firmware %d.%d.%d-%d\n",
-                 wiphy_name(priv->hw->wiphy),
-                 dev_name(&interface->dev), mac2str(priv->mac_addr),
-                 priv->fw_version.major, priv->fw_version.minor,
-                 priv->fw_version.patch, priv->fw_version.build);
-        dev_info(dev, "%s: regulatory domain 0x%02x: %s\n",
-                 wiphy_name(priv->hw->wiphy),
-                 priv->regulatory_domain, priv->domain->name);
-        dev_info(dev, "%s: WPA support: ", wiphy_name(priv->hw->wiphy));
-        if (!FIRMWARE_IS_WPA(priv->fw_version))
-                printk("none\n");
-        else {
-                if (!at76_is_505a(priv->board_type))
-                        printk("TKIP\n");
-                else
-                        printk("TKIP, AES/CCMP\n");
-        };
+        /* we let this timer run the whole time this driver instance lives */
+        mod_timer(&priv->bss_list_timer, jiffies + BSS_LIST_TIMEOUT);
 
 exit:
         return ret;
@@ -2556,13 +5344,15 @@ exit:
 
 static void at76_delete_device(struct at76_priv *priv)
 {
+        int i;
+
         at76_dbg(DBG_PROC_ENTRY, "%s: ENTER", __func__);
 
         /* The device is gone, don't bother turning it off */
         priv->device_unplugged = 1;
 
-        if (priv->mac80211_registered)
-                ieee80211_unregister_hw(priv->hw);
+        if (priv->netdev_registered)
+                unregister_netdev(priv->netdev);
 
         /* assuming we used keventd, it must quiesce too */
         flush_scheduled_work();
@@ -2583,11 +5373,25 @@ static void at76_delete_device(struct at76_priv *priv)
         if (priv->rx_skb)
                 kfree_skb(priv->rx_skb);
 
+        at76_free_bss_list(priv);
+        del_timer_sync(&priv->bss_list_timer);
+        cancel_delayed_work(&priv->dwork_get_scan);
+        cancel_delayed_work(&priv->dwork_beacon);
+        cancel_delayed_work(&priv->dwork_auth);
+        cancel_delayed_work(&priv->dwork_assoc);
+
+        if (priv->mac_state == MAC_CONNECTED)
+                at76_iwevent_bss_disconnect(priv->netdev);
+
+        for (i = 0; i < NR_RX_DATA_BUF; i++)
+                if (priv->rx_data[i].skb) {
+                        dev_kfree_skb(priv->rx_data[i].skb);
+                        priv->rx_data[i].skb = NULL;
+                }
         usb_put_dev(priv->udev);
 
-        at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/ieee80211_hw",
-                 __func__);
-        ieee80211_free_hw(priv->hw);
+        at76_dbg(DBG_PROC_ENTRY, "%s: before freeing priv/netdev", __func__);
+        free_netdev(priv->netdev);      /* priv is in netdev */
 
         at76_dbg(DBG_PROC_ENTRY, "%s: EXIT", __func__);
 }
@@ -2621,8 +5425,8 @@ static int at76_probe(struct usb_interface *interface,
            we get 204 with 2.4.23, Fiberline FL-WL240u (505A+RFMD2958) ??? */
 
         if (op_mode == OPMODE_HW_CONFIG_MODE) {
-                dev_err(&interface->dev,
-                        "cannot handle a device in HW_CONFIG_MODE\n");
+                dev_printk(KERN_ERR, &interface->dev,
+                           "cannot handle a device in HW_CONFIG_MODE\n");
                 ret = -EBUSY;
                 goto error;
         }
@@ -2630,12 +5434,13 @@ static int at76_probe(struct usb_interface *interface,
         if (op_mode != OPMODE_NORMAL_NIC_WITH_FLASH
             && op_mode != OPMODE_NORMAL_NIC_WITHOUT_FLASH) {
                 /* download internal firmware part */
-                dev_dbg(&interface->dev, "downloading internal firmware\n");
+                dev_printk(KERN_DEBUG, &interface->dev,
+                           "downloading internal firmware\n");
                 ret = at76_load_internal_fw(udev, fwe);
                 if (ret < 0) {
-                        dev_err(&interface->dev,
-                                "error %d downloading internal firmware\n",
-                                ret);
+                        dev_printk(KERN_ERR, &interface->dev,
+                                   "error %d downloading internal firmware\n",
+                                   ret);
                         goto error;
                 }
                 usb_put_dev(udev);
@@ -2660,7 +5465,8 @@ static int at76_probe(struct usb_interface *interface,
                 need_ext_fw = 1;
 
         if (need_ext_fw) {
-                dev_dbg(&interface->dev, "downloading external firmware\n");
+                dev_printk(KERN_DEBUG, &interface->dev,
+                           "downloading external firmware\n");
 
                 ret = at76_load_external_fw(udev, fwe);
                 if (ret)
@@ -2669,8 +5475,8 @@ static int at76_probe(struct usb_interface *interface,
                 /* Re-check firmware version */
                 ret = at76_get_mib(udev, MIB_FW_VERSION, &fwv, sizeof(fwv));
                 if (ret < 0) {
-                        dev_err(&interface->dev,
-                                "error %d getting firmware version\n", ret);
+                        dev_printk(KERN_ERR, &interface->dev,
+                                   "error %d getting firmware version\n", ret);
                         goto error;
                 }
         }
@@ -2681,6 +5487,7 @@ static int at76_probe(struct usb_interface *interface,
                 goto error;
         }
 
+        SET_NETDEV_DEV(priv->netdev, &interface->dev);
         usb_set_intfdata(interface, priv);
 
         memcpy(&priv->fw_version, &fwv, sizeof(struct mib_fw_version));
@@ -2708,7 +5515,7 @@ static void at76_disconnect(struct usb_interface *interface)
         if (!priv)
                 return;
 
-        printk(KERN_INFO "%s: disconnecting\n", wiphy_name(priv->hw->wiphy));
+        printk(KERN_INFO "%s: disconnecting\n", priv->netdev->name);
         at76_delete_device(priv);
         dev_printk(KERN_INFO, &interface->dev, "disconnected\n");
 }
@@ -2764,8 +5571,5 @@ MODULE_AUTHOR("Alex <alex@foogod.com>");
 MODULE_AUTHOR("Nick Jones");
 MODULE_AUTHOR("Balint Seeber <n0_5p4m_p13453@hotmail.com>");
 MODULE_AUTHOR("Pavel Roskin <proski@gnu.org>");
-MODULE_AUTHOR("Guido Guenther <agx@sigxcpu.org>");
-MODULE_AUTHOR("Kalle Valo <kalle.valo@iki.fi>");
-MODULE_AUTHOR("Milan Plzik <milan.plzik@gmail.com>");
 MODULE_DESCRIPTION(DRIVER_DESC);
 MODULE_LICENSE("GPL");
diff --git a/drivers/staging/at76_usb/at76_usb.h b/drivers/staging/at76_usb/at76_usb.h
index 8bb352f16d4..b20be9da1fa 100644
--- a/drivers/staging/at76_usb/at76_usb.h
+++ b/drivers/staging/at76_usb/at76_usb.h
@@ -34,6 +34,23 @@ enum board_type {
         BOARD_505AMX = 8
 };
 
+/* our private ioctl's */
+/* preamble length (0 - long, 1 - short, 2 - auto) */
+#define AT76_SET_SHORT_PREAMBLE         (SIOCIWFIRSTPRIV + 0)
+#define AT76_GET_SHORT_PREAMBLE         (SIOCIWFIRSTPRIV + 1)
+/* which debug channels are enabled */
+#define AT76_SET_DEBUG                  (SIOCIWFIRSTPRIV + 2)
+#define AT76_GET_DEBUG                  (SIOCIWFIRSTPRIV + 3)
+/* power save mode (incl. the Atmel proprietary smart save mode) */
+#define AT76_SET_POWERSAVE_MODE         (SIOCIWFIRSTPRIV + 4)
+#define AT76_GET_POWERSAVE_MODE         (SIOCIWFIRSTPRIV + 5)
+/* min and max channel times for scan */
+#define AT76_SET_SCAN_TIMES             (SIOCIWFIRSTPRIV + 6)
+#define AT76_GET_SCAN_TIMES             (SIOCIWFIRSTPRIV + 7)
+/* scan mode (0 - active, 1 - passive) */
+#define AT76_SET_SCAN_MODE              (SIOCIWFIRSTPRIV + 8)
+#define AT76_GET_SCAN_MODE              (SIOCIWFIRSTPRIV + 9)
+
 #define CMD_STATUS_IDLE                         0x00
 #define CMD_STATUS_COMPLETE                     0x01
 #define CMD_STATUS_UNKNOWN                      0x02
@@ -65,7 +82,6 @@ enum board_type {
 #define MIB_MAC                 0x03
 #define MIB_MAC_MGMT            0x05
 #define MIB_MAC_WEP             0x06
-#define MIB_MAC_ENCRYPTION      0x06
 #define MIB_PHY                 0x07
 #define MIB_FW_VERSION          0x08
 #define MIB_MDOMAIN             0x09
@@ -90,26 +106,6 @@ enum board_type {
 #define AT76_PM_ON              2
 #define AT76_PM_SMART           3
 
-/* cipher values for encryption keys */
-#define CIPHER_NONE             0       /* this value is only guessed */
-#define CIPHER_WEP64            1
-#define CIPHER_TKIP             2
-#define CIPHER_CCMP             3
-#define CIPHER_CCX              4       /* for consistency sake only */
-#define CIPHER_WEP128           5
-
-/* bit flags key types for encryption keys */
-#define KEY_PAIRWISE            2
-#define KEY_TX                  4
-
-#define CIPHER_KEYS             (4)
-#define CIPHER_KEY_LEN          (40)
-
-struct key_config {
-        u8 cipher;
-        u8 keylen;
-};
-
 struct hwcfg_r505 {
         u8 cr39_values[14];
         u8 reserved1[14];
@@ -151,9 +147,6 @@ union at76_hwcfg {
 
 #define WEP_SMALL_KEY_LEN       (40 / 8)
 #define WEP_LARGE_KEY_LEN       (104 / 8)
-#define WEP_KEYS                (4)
-
-
 
 struct at76_card_config {
         u8 exclude_unencrypted;
@@ -168,7 +161,7 @@ struct at76_card_config {
         u8 privacy_invoked;
         u8 wep_default_key_id;  /* 0..3 */
         u8 current_ssid[32];
-        u8 wep_default_key_value[4][WEP_LARGE_KEY_LEN];
+        u8 wep_default_key_value[4][WEP_KEY_LEN];
         u8 ssid_len;
         u8 short_preamble;
         __le16 beacon_period;
@@ -193,7 +186,7 @@ struct at76_rx_buffer {
         u8 link_quality;
         u8 noise_level;
         __le32 rx_time;
-        u8 packet[IEEE80211_MAX_FRAG_THRESHOLD];
+        u8 packet[IEEE80211_FRAME_LEN + IEEE80211_FCS_LEN];
 } __attribute__((packed));
 
 /* Length of Atmel-specific Tx header before 802.11 frame */
@@ -203,11 +196,8 @@ struct at76_tx_buffer {
         __le16 wlength;
         u8 tx_rate;
         u8 padding;
-        u8 key_id;
-        u8 cipher_type;
-        u8 cipher_length;
-        u8 reserved;
-        u8 packet[IEEE80211_MAX_FRAG_THRESHOLD];
+        u8 reserved[4];
+        u8 packet[IEEE80211_FRAME_LEN + IEEE80211_FCS_LEN];
 } __attribute__((packed));
 
 /* defines for scan_type below */
@@ -254,7 +244,6 @@ struct set_mib_buffer {
                 u8 byte;
                 __le16 word;
                 u8 addr[ETH_ALEN];
-                u8 data[256];   /* we need more space for mib_mac_encryption */
         } data;
 } __attribute__((packed));
 
@@ -328,24 +317,10 @@ struct mib_mac_wep {
         u8 exclude_unencrypted;
         __le32 wep_icv_error_count;
         __le32 wep_excluded_count;
-        u8 wep_default_keyvalue[WEP_KEYS][WEP_LARGE_KEY_LEN];
+        u8 wep_default_keyvalue[WEP_KEYS][WEP_KEY_LEN];
         u8 encryption_level;    /* 1 for 40bit, 2 for 104bit encryption */
 } __attribute__((packed));
 
-struct mib_mac_encryption {
-        u8 cipher_default_keyvalue[CIPHER_KEYS][CIPHER_KEY_LEN];
-        u8 tkip_bssid[6];
-        u8 privacy_invoked;
-        u8 cipher_default_key_id;
-        u8 cipher_default_group_key_id;
-        u8 exclude_unencrypted;
-        u8 wep_encryption_type;
-        u8 ckip_key_permutation;        /* bool */
-        __le32 wep_icv_error_count;
-        __le32 wep_excluded_count;
-        u8 key_rsc[CIPHER_KEYS][8];
-} __attribute__((packed));
-
 struct mib_phy {
         __le32 ed_threshold;
 
@@ -389,6 +364,16 @@ struct at76_fw_header {
         __le32 ext_fw_len;      /* external firmware image length */
 } __attribute__((packed));
 
+enum mac_state {
+        MAC_INIT,
+        MAC_SCANNING,
+        MAC_AUTH,
+        MAC_ASSOC,
+        MAC_JOINING,
+        MAC_CONNECTED,
+        MAC_OWN_IBSS
+};
+
 /* a description of a regulatory domain and the allowed channels */
 struct reg_domain {
         u16 code;
@@ -396,6 +381,47 @@ struct reg_domain {
         u32 channel_map;        /* if bit N is set, channel (N+1) is allowed */
 };
 
+/* how long do we keep a (I)BSS in the bss_list in jiffies
+   this should be long enough for the user to retrieve the table
+   (by iwlist ?) after the device started, because all entries from
+   other channels than the one the device locks on get removed, too */
+#define BSS_LIST_TIMEOUT        (120 * HZ)
+/* struct to store BSS info found during scan */
+#define BSS_LIST_MAX_RATE_LEN   32      /* 32 rates should be enough ... */
+
+struct bss_info {
+        struct list_head list;
+
+        u8 bssid[ETH_ALEN];     /* bssid */
+        u8 ssid[IW_ESSID_MAX_SIZE];     /* essid */
+        u8 ssid_len;            /* length of ssid above */
+        u8 channel;
+        u16 capa;               /* BSS capabilities */
+        u16 beacon_interval;    /* beacon interval, Kus (1024 microseconds) */
+        u8 rates[BSS_LIST_MAX_RATE_LEN];        /* supported rates in units of
+                                                   500 kbps, ORed with 0x80 for
+                                                   basic rates */
+        u8 rates_len;
+
+        /* quality of received beacon */
+        u8 rssi;
+        u8 link_qual;
+        u8 noise_level;
+
+        unsigned long last_rx;  /* time (jiffies) of last beacon received */
+};
+
+/* a rx data buffer to collect rx fragments */
+struct rx_data_buf {
+        u8 sender[ETH_ALEN];    /* sender address */
+        u16 seqnr;              /* sequence number */
+        u16 fragnr;             /* last fragment received */
+        unsigned long last_rx;  /* jiffies of last rx */
+        struct sk_buff *skb;    /* == NULL if entry is free */
+};
+
+#define NR_RX_DATA_BUF          8
+
 /* Data for one loaded firmware file */
 struct fwentry {
         const char *const fwname;
@@ -412,9 +438,11 @@ struct fwentry {
 
 struct at76_priv {
         struct usb_device *udev;        /* USB device pointer */
+        struct net_device *netdev;      /* net device pointer */
+        struct net_device_stats stats;  /* net device stats */
+        struct iw_statistics wstats;    /* wireless stats */
 
         struct sk_buff *rx_skb; /* skbuff for receiving data */
-        struct sk_buff *tx_skb; /* skbuff for transmitting data */
         void *bulk_out_buffer;  /* buffer for sending data */
 
         struct urb *tx_urb;     /* URB for sending data */
@@ -426,17 +454,26 @@ struct at76_priv {
         struct mutex mtx;       /* locks this structure */
 
         /* work queues */
+        struct work_struct work_assoc_done;
+        struct work_struct work_join;
+        struct work_struct work_new_bss;
+        struct work_struct work_start_scan;
         struct work_struct work_set_promisc;
         struct work_struct work_submit_rx;
-        struct delayed_work dwork_hw_scan;
+        struct delayed_work dwork_restart;
+        struct delayed_work dwork_get_scan;
+        struct delayed_work dwork_beacon;
+        struct delayed_work dwork_auth;
+        struct delayed_work dwork_assoc;
 
         struct tasklet_struct rx_tasklet;
 
         /* the WEP stuff */
         int wep_enabled;        /* 1 if WEP is enabled */
         int wep_key_id;         /* key id to be used */
-        u8 wep_keys[WEP_KEYS][WEP_LARGE_KEY_LEN];       /* WEP keys */
-        u8 wep_keys_len[WEP_KEYS];      /* length of WEP keys */
+        u8 wep_keys[WEP_KEYS][WEP_KEY_LEN];     /* the four WEP keys,
+                                                   5 or 13 bytes are used */
+        u8 wep_keys_len[WEP_KEYS];      /* the length of the above keys */
 
         int channel;
         int iw_mode;
@@ -458,13 +495,44 @@ struct at76_priv {
         int scan_mode;          /* SCAN_TYPE_ACTIVE, SCAN_TYPE_PASSIVE */
         int scan_need_any;      /* if set, need to scan for any ESSID */
 
+        /* the list we got from scanning */
+        spinlock_t bss_list_spinlock;   /* protects bss_list operations */
+        struct list_head bss_list;      /* list of BSS we got beacons from */
+        struct timer_list bss_list_timer;       /* timer to purge old entries
+                                                   from bss_list */
+        struct bss_info *curr_bss;      /* current BSS */
         u16 assoc_id;           /* current association ID, if associated */
 
+        u8 wanted_bssid[ETH_ALEN];
+        int wanted_bssid_valid; /* != 0 if wanted_bssid is to be used */
+
+        /* some data for infrastructure mode only */
+        spinlock_t mgmt_spinlock;       /* this spinlock protects access to
+                                           next_mgmt_bulk */
+
+        struct at76_tx_buffer *next_mgmt_bulk;  /* pending management msg to
+                                                   send via bulk out */
+        enum mac_state mac_state;
+        enum {
+                SCAN_IDLE,
+                SCAN_IN_PROGRESS,
+                SCAN_COMPLETED
+        } scan_state;
+        time_t last_scan;
+
+        int retries;            /* remaining retries in case of timeout when
+                                 * sending AuthReq or AssocReq */
         u8 pm_mode;             /* power management mode */
         u32 pm_period;          /* power management period in microseconds */
 
         struct reg_domain const *domain;        /* reg domain description */
 
+        /* iwspy support */
+        spinlock_t spy_spinlock;
+        struct iw_spy_data spy_data;
+
+        struct iw_public_data wireless_data;
+
         /* These fields contain HW config provided by the device (not all of
          * these fields are used by all board types) */
         u8 mac_addr[ETH_ALEN];
@@ -472,6 +540,9 @@ struct at76_priv {
 
         struct at76_card_config card_config;
 
+        /* store rx fragments until complete */
+        struct rx_data_buf rx_data[NR_RX_DATA_BUF];
+
         enum board_type board_type;
         struct mib_fw_version fw_version;
 
@@ -479,20 +550,58 @@ struct at76_priv {
         unsigned int netdev_registered:1;
         struct set_mib_buffer mib_buf;  /* global buffer for set_mib calls */
 
+        /* beacon counting */
         int beacon_period;      /* period of mgmt beacons, Kus */
+        int beacons_received;
+        unsigned long beacons_last_qual;        /* time we restarted counting
+                                                   beacons */
+};
 
-        struct ieee80211_hw *hw;
-        int mac80211_registered;
-
-        struct key_config keys[4];      /* installed key types */
-        u8 default_pairwise_key;
-        u8 default_group_key;
+struct at76_rx_radiotap {
+        struct ieee80211_radiotap_header rt_hdr;
+        __le64 rt_tsft;
+        u8 rt_flags;
+        u8 rt_rate;
+        s8 rt_signal;
+        s8 rt_noise;
 };
 
-#define AT76_SUPPORTED_FILTERS FIF_PROMISC_IN_BSS
+#define AT76_RX_RADIOTAP_PRESENT                  \
+        ((1 << IEEE80211_RADIOTAP_TSFT)         | \
+        (1 << IEEE80211_RADIOTAP_FLAGS)         | \
+        (1 << IEEE80211_RADIOTAP_RATE)          | \
+        (1 << IEEE80211_RADIOTAP_DB_ANTSIGNAL)  | \
+        (1 << IEEE80211_RADIOTAP_DB_ANTNOISE))
+
+#define BEACON_MAX_DATA_LENGTH  1500
+
+/* the maximum size of an AssocReq packet */
+#define ASSOCREQ_MAX_SIZE \
+  (AT76_TX_HDRLEN + sizeof(struct ieee80211_assoc_request) + \
+   1 + 1 + IW_ESSID_MAX_SIZE + 1 + 1 + 4)
+
+/* for shared secret auth, add the challenge text size */
+#define AUTH_FRAME_SIZE (AT76_TX_HDRLEN + sizeof(struct ieee80211_auth))
+
+/* Maximal number of AuthReq retries */
+#define AUTH_RETRIES            3
 
+/* Maximal number of AssocReq retries */
+#define ASSOC_RETRIES           3
+
+/* Beacon timeout in managed mode when we are connected */
+#define BEACON_TIMEOUT          (10 * HZ)
+
+/* Timeout for authentication response */
+#define AUTH_TIMEOUT            (1 * HZ)
+
+/* Timeout for association response */
+#define ASSOC_TIMEOUT           (1 * HZ)
+
+/* Polling interval when scan is running */
 #define SCAN_POLL_INTERVAL      (HZ / 4)
 
+/* Command completion timeout */
 #define CMD_COMPLETION_TIMEOUT  (5 * HZ)
 
 #define DEF_RTS_THRESHOLD       1536
@@ -502,6 +611,8 @@ struct at76_priv {
 #define DEF_SCAN_MIN_TIME       10
 #define DEF_SCAN_MAX_TIME       120
 
+#define MAX_RTS_THRESHOLD       (MAX_FRAG_THRESHOLD + 1)
+
 /* the max padding size for tx in bytes (see calc_padding) */
 #define MAX_PADDING_SIZE        53
 
diff --git a/drivers/staging/panel/panel.c b/drivers/staging/panel/panel.c
index 5ffe269c238..ab69c1bf36a 100644
--- a/drivers/staging/panel/panel.c
+++ b/drivers/staging/panel/panel.c
@@ -622,7 +622,7 @@ static int set_ctrl_bits(void)
 }
 
 /* sets ctrl & data port bits according to current signals values */
-static void set_bits(void)
+static void panel_set_bits(void)
 {
         set_data_bits();
         set_ctrl_bits();
@@ -707,12 +707,12 @@ static void lcd_send_serial(int byte)
          */
         for (bit = 0; bit < 8; bit++) {
                 bits.cl = BIT_CLR;      /* CLK low */
-                set_bits();
+                panel_set_bits();
                 bits.da = byte & 1;
-                set_bits();
+                panel_set_bits();
                 udelay(2);      /* maintain the data during 2 us before CLK up */
                 bits.cl = BIT_SET;      /* CLK high */
-                set_bits();
+                panel_set_bits();
                 udelay(1);      /* maintain the strobe during 1 us */
                 byte >>= 1;
         }
@@ -727,7 +727,7 @@ static void lcd_backlight(int on)
         /* The backlight is activated by seting the AUTOFEED line to +5V  */
         spin_lock(&pprt_lock);
         bits.bl = on;
-        set_bits();
+        panel_set_bits();
         spin_unlock(&pprt_lock);
 }
 
diff --git a/drivers/usb/Makefile b/drivers/usb/Makefile
index 8bcde8cde55..b2ceb4aff23 100644
--- a/drivers/usb/Makefile
+++ b/drivers/usb/Makefile
@@ -11,6 +11,7 @@ obj-$(CONFIG_USB_MON)		+= mon/
 obj-$(CONFIG_PCI)               += host/
 obj-$(CONFIG_USB_EHCI_HCD)      += host/
 obj-$(CONFIG_USB_ISP116X_HCD)   += host/
+obj-$(CONFIG_USB_ISP1760_HCD)   += host/
 obj-$(CONFIG_USB_OHCI_HCD)      += host/
 obj-$(CONFIG_USB_UHCI_HCD)      += host/
 obj-$(CONFIG_USB_FHCI_HCD)      += host/
diff --git a/drivers/usb/class/cdc-acm.c b/drivers/usb/class/cdc-acm.c
index 97ba4a985ed..326dd7f65ee 100644
--- a/drivers/usb/class/cdc-acm.c
+++ b/drivers/usb/class/cdc-acm.c
@@ -1349,9 +1349,6 @@ static struct usb_device_id acm_ids[] = {
         { USB_DEVICE(0x0e8d, 0x0003), /* FIREFLY, MediaTek Inc; andrey.arapov@gmail.com */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
-        { USB_DEVICE(0x0e8d, 0x3329), /* i-blue 747, Qstarz BT-Q1000, Holux M-241 */
-        .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
-        },
         { USB_DEVICE(0x0e8d, 0x3329), /* MediaTek Inc GPS */
         .driver_info = NO_UNION_NORMAL, /* has no union descriptor */
         },
diff --git a/drivers/usb/gadget/fsl_qe_udc.c b/drivers/usb/gadget/fsl_qe_udc.c
index d6c5bcd4006..d701bf4698d 100644
--- a/drivers/usb/gadget/fsl_qe_udc.c
+++ b/drivers/usb/gadget/fsl_qe_udc.c
@@ -1622,6 +1622,8 @@ static int qe_ep_disable(struct usb_ep *_ep)
         nuke(ep, -ESHUTDOWN);
         ep->desc = NULL;
         ep->stopped = 1;
+        ep->tx_req = NULL;
+        qe_ep_reset(udc, ep->epnum);
         spin_unlock_irqrestore(&udc->lock, flags);
 
         cpm_muram_free(cpm_muram_offset(ep->rxbase));
@@ -1681,14 +1683,11 @@ static void qe_free_request(struct usb_ep *_ep, struct usb_request *_req)
                 kfree(req);
 }
 
-/* queues (submits) an I/O request to an endpoint */
-static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
-                                gfp_t gfp_flags)
+static int __qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req)
 {
         struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
         struct qe_req *req = container_of(_req, struct qe_req, req);
         struct qe_udc *udc;
-        unsigned long flags;
         int reval;
 
         udc = ep->udc;
@@ -1732,7 +1731,7 @@ static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
         list_add_tail(&req->queue, &ep->queue);
         dev_vdbg(udc->dev, "gadget have request in %s! %d\n",
                         ep->name, req->req.length);
-        spin_lock_irqsave(&udc->lock, flags);
+
         /* push the request to device */
         if (ep_is_in(ep))
                 reval = ep_req_send(ep, req);
@@ -1748,11 +1747,24 @@ static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
         if (ep->dir == USB_DIR_OUT)
                 reval = ep_req_receive(ep, req);
 
-        spin_unlock_irqrestore(&udc->lock, flags);
-
         return 0;
 }
 
+/* queues (submits) an I/O request to an endpoint */
+static int qe_ep_queue(struct usb_ep *_ep, struct usb_request *_req,
+                       gfp_t gfp_flags)
+{
+        struct qe_ep *ep = container_of(_ep, struct qe_ep, ep);
+        struct qe_udc *udc = ep->udc;
+        unsigned long flags;
+        int ret;
+
+        spin_lock_irqsave(&udc->lock, flags);
+        ret = __qe_ep_queue(_ep, _req);
+        spin_unlock_irqrestore(&udc->lock, flags);
+        return ret;
+}
+
 /* dequeues (cancels, unlinks) an I/O request from an endpoint */
 static int qe_ep_dequeue(struct usb_ep *_ep, struct usb_request *_req)
 {
@@ -2008,7 +2020,7 @@ static void ch9getstatus(struct qe_udc *udc, u8 request_type, u16 value,
         udc->ep0_dir = USB_DIR_IN;
 
         /* data phase */
-        status = qe_ep_queue(&ep->ep, &req->req, GFP_ATOMIC);
+        status = __qe_ep_queue(&ep->ep, &req->req);
 
         if (status == 0)
                 return;
@@ -2151,6 +2163,9 @@ static int reset_irq(struct qe_udc *udc)
 {
         unsigned char i;
 
+        if (udc->usb_state == USB_STATE_DEFAULT)
+                return 0;
+
         qe_usb_disable();
         out_8(&udc->usb_regs->usb_usadr, 0);
 
@@ -2442,8 +2457,12 @@ static int __devinit qe_udc_reg_init(struct qe_udc *udc)
         struct usb_ctlr __iomem *qe_usbregs;
         qe_usbregs = udc->usb_regs;
 
-        /* Init the usb register */
+        /* Spec says that we must enable the USB controller to change mode. */
         out_8(&qe_usbregs->usb_usmod, 0x01);
+        /* Mode changed, now disable it, since muram isn't initialized yet. */
+        out_8(&qe_usbregs->usb_usmod, 0x00);
+
+        /* Initialize the rest. */
         out_be16(&qe_usbregs->usb_usbmr, 0);
         out_8(&qe_usbregs->usb_uscom, 0);
         out_be16(&qe_usbregs->usb_usber, USBER_ALL_CLEAR);
@@ -2604,6 +2623,10 @@ static int __devinit qe_udc_probe(struct of_device *ofdev,
                         (unsigned long)udc_controller);
         /* request irq and disable DR  */
         udc_controller->usb_irq = irq_of_parse_and_map(np, 0);
+        if (!udc_controller->usb_irq) {
+                ret = -EINVAL;
+                goto err_noirq;
+        }
 
         ret = request_irq(udc_controller->usb_irq, qe_udc_irq, 0,
                                 driver_name, udc_controller);
@@ -2625,6 +2648,8 @@ static int __devinit qe_udc_probe(struct of_device *ofdev,
 err6:
         free_irq(udc_controller->usb_irq, udc_controller);
 err5:
+        irq_dispose_mapping(udc_controller->usb_irq);
+err_noirq:
         if (udc_controller->nullmap) {
                 dma_unmap_single(udc_controller->gadget.dev.parent,
                         udc_controller->nullp, 256,
@@ -2648,7 +2673,7 @@ err2:
         iounmap(udc_controller->usb_regs);
 err1:
         kfree(udc_controller);
-
+        udc_controller = NULL;
         return ret;
 }
 
@@ -2710,6 +2735,7 @@ static int __devexit qe_udc_remove(struct of_device *ofdev)
         kfree(ep->txframe);
 
         free_irq(udc_controller->usb_irq, udc_controller);
+        irq_dispose_mapping(udc_controller->usb_irq);
 
         tasklet_kill(&udc_controller->rx_tasklet);
 
diff --git a/drivers/usb/host/whci/asl.c b/drivers/usb/host/whci/asl.c
index 577c0d29849..2291c5f5af5 100644
--- a/drivers/usb/host/whci/asl.c
+++ b/drivers/usb/host/whci/asl.c
@@ -170,12 +170,17 @@ void asl_stop(struct whc *whc)
 void asl_update(struct whc *whc, uint32_t wusbcmd)
 {
         struct wusbhc *wusbhc = &whc->wusbhc;
+        long t;
 
         mutex_lock(&wusbhc->mutex);
         if (wusbhc->active) {
                 whc_write_wusbcmd(whc, wusbcmd, wusbcmd);
-                wait_event(whc->async_list_wq,
-                           (le_readl(whc->base + WUSBCMD) & WUSBCMD_ASYNC_UPDATED) == 0);
+                t = wait_event_timeout(
+                        whc->async_list_wq,
+                        (le_readl(whc->base + WUSBCMD) & WUSBCMD_ASYNC_UPDATED) == 0,
+                        msecs_to_jiffies(1000));
+                if (t == 0)
+                        whc_hw_error(whc, "ASL update timeout");
         }
         mutex_unlock(&wusbhc->mutex);
 }
diff --git a/drivers/usb/host/whci/hw.c b/drivers/usb/host/whci/hw.c
index d498e720321..6afa2e37916 100644
--- a/drivers/usb/host/whci/hw.c
+++ b/drivers/usb/host/whci/hw.c
@@ -87,3 +87,18 @@ out:
 
         return ret;
 }
+
+/**
+ * whc_hw_error - recover from a hardware error
+ * @whc:    the WHCI HC that broke.
+ * @reason: a description of the failure.
+ *
+ * Recover from broken hardware with a full reset.
+ */
+void whc_hw_error(struct whc *whc, const char *reason)
+{
+        struct wusbhc *wusbhc = &whc->wusbhc;
+
+        dev_err(&whc->umc->dev, "hardware error: %s\n", reason);
+        wusbhc_reset_all(wusbhc);
+}
diff --git a/drivers/usb/host/whci/pzl.c b/drivers/usb/host/whci/pzl.c
index 2ae5abf69a6..7dc85a0bee7 100644
--- a/drivers/usb/host/whci/pzl.c
+++ b/drivers/usb/host/whci/pzl.c
@@ -183,12 +183,17 @@ void pzl_stop(struct whc *whc)
 void pzl_update(struct whc *whc, uint32_t wusbcmd)
 {
         struct wusbhc *wusbhc = &whc->wusbhc;
+        long t;
 
         mutex_lock(&wusbhc->mutex);
         if (wusbhc->active) {
                 whc_write_wusbcmd(whc, wusbcmd, wusbcmd);
-                wait_event(whc->periodic_list_wq,
-                           (le_readl(whc->base + WUSBCMD) & WUSBCMD_PERIODIC_UPDATED) == 0);
+                t = wait_event_timeout(
+                        whc->periodic_list_wq,
+                        (le_readl(whc->base + WUSBCMD) & WUSBCMD_PERIODIC_UPDATED) == 0,
+                        msecs_to_jiffies(1000));
+                if (t == 0)
+                        whc_hw_error(whc, "PZL update timeout");
         }
         mutex_unlock(&wusbhc->mutex);
 }
diff --git a/drivers/usb/host/whci/whcd.h b/drivers/usb/host/whci/whcd.h
index 0f3540f04f5..d3543a181dc 100644
--- a/drivers/usb/host/whci/whcd.h
+++ b/drivers/usb/host/whci/whcd.h
@@ -137,6 +137,7 @@ void whc_clean_up(struct whc *whc);
 /* hw.c */
 void whc_write_wusbcmd(struct whc *whc, u32 mask, u32 val);
 int whc_do_gencmd(struct whc *whc, u32 cmd, u32 params, void *addr, size_t len);
+void whc_hw_error(struct whc *whc, const char *reason);
 
 /* wusb.c */
 int whc_wusbhc_start(struct wusbhc *wusbhc);
diff --git a/drivers/usb/serial/aircable.c b/drivers/usb/serial/aircable.c
index 537f953bd7f..6d106e74265 100644
--- a/drivers/usb/serial/aircable.c
+++ b/drivers/usb/serial/aircable.c
@@ -621,9 +621,9 @@ static int __init aircable_init(void)
                 goto failed_usb_register;
         return 0;
 
-failed_serial_register:
-        usb_serial_deregister(&aircable_device);
 failed_usb_register:
+        usb_serial_deregister(&aircable_device);
+failed_serial_register:
         return retval;
 }
 
diff --git a/drivers/usb/serial/ftdi_sio.c b/drivers/usb/serial/ftdi_sio.c
index 75597337583..f92f4d77337 100644
--- a/drivers/usb/serial/ftdi_sio.c
+++ b/drivers/usb/serial/ftdi_sio.c
@@ -662,6 +662,7 @@ static struct usb_device_id id_table_combined [] = {
         { USB_DEVICE(FTDI_VID, FTDI_DOMINTELL_DUSB_PID) },
         { USB_DEVICE(ALTI2_VID, ALTI2_N3_PID) },
         { USB_DEVICE(FTDI_VID, DIEBOLD_BCS_SE923_PID) },
+        { USB_DEVICE(FTDI_VID, FTDI_NDI_HUC_PID) },
         { },                                    /* Optional parameter entry */
         { }                                     /* Terminating entry */
 };
@@ -1064,8 +1065,10 @@ static int set_serial_info(struct tty_struct *tty,
 
         if (!capable(CAP_SYS_ADMIN)) {
                 if (((new_serial.flags & ~ASYNC_USR_MASK) !=
-                     (priv->flags & ~ASYNC_USR_MASK)))
+                     (priv->flags & ~ASYNC_USR_MASK))) {
+                        unlock_kernel();
                         return -EPERM;
+                }
                 priv->flags = ((priv->flags & ~ASYNC_USR_MASK) |
                                (new_serial.flags & ASYNC_USR_MASK));
                 priv->custom_divisor = new_serial.custom_divisor;
diff --git a/drivers/usb/serial/ftdi_sio.h b/drivers/usb/serial/ftdi_sio.h
index 1b62eff475d..e300c840f8c 100644
--- a/drivers/usb/serial/ftdi_sio.h
+++ b/drivers/usb/serial/ftdi_sio.h
@@ -844,6 +844,9 @@
 #define TML_VID                 0x1B91  /* Vendor ID */
 #define TML_USB_SERIAL_PID      0x0064  /* USB - Serial Converter */
 
+/* NDI Polaris System */
+#define FTDI_NDI_HUC_PID        0xDA70
+
 /* Propox devices */
 #define FTDI_PROPOX_JTAGCABLEII_PID     0xD738
 
diff --git a/drivers/usb/serial/option.c b/drivers/usb/serial/option.c
index 6c89da9c6fe..bfd0b68cecc 100644
--- a/drivers/usb/serial/option.c
+++ b/drivers/usb/serial/option.c
@@ -199,14 +199,15 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 #define NOVATELWIRELESS_PRODUCT_MC950D          0x4400
 
 /* FUTURE NOVATEL PRODUCTS */
-#define NOVATELWIRELESS_PRODUCT_EVDO_1          0x6000
-#define NOVATELWIRELESS_PRODUCT_HSPA_1          0x7000
-#define NOVATELWIRELESS_PRODUCT_EMBEDDED_1      0x8000
-#define NOVATELWIRELESS_PRODUCT_GLOBAL_1        0x9000
-#define NOVATELWIRELESS_PRODUCT_EVDO_2          0x6001
-#define NOVATELWIRELESS_PRODUCT_HSPA_2          0x7001
-#define NOVATELWIRELESS_PRODUCT_EMBEDDED_2      0x8001
-#define NOVATELWIRELESS_PRODUCT_GLOBAL_2        0x9001
+#define NOVATELWIRELESS_PRODUCT_EVDO_FULLSPEED  0X6000
+#define NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED  0X6001
+#define NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED  0X7000
+#define NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED  0X7001
+#define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED 0X8000
+#define NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED 0X8001
+#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED 0X9000
+#define NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED 0X9001
+#define NOVATELWIRELESS_PRODUCT_GLOBAL          0XA001
 
 /* AMOI PRODUCTS */
 #define AMOI_VENDOR_ID                          0x1614
@@ -216,6 +217,27 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 
 #define DELL_VENDOR_ID                          0x413C
 
+/* Dell modems */
+#define DELL_PRODUCT_5700_MINICARD              0x8114
+#define DELL_PRODUCT_5500_MINICARD              0x8115
+#define DELL_PRODUCT_5505_MINICARD              0x8116
+#define DELL_PRODUCT_5700_EXPRESSCARD           0x8117
+#define DELL_PRODUCT_5510_EXPRESSCARD           0x8118
+
+#define DELL_PRODUCT_5700_MINICARD_SPRINT       0x8128
+#define DELL_PRODUCT_5700_MINICARD_TELUS        0x8129
+
+#define DELL_PRODUCT_5720_MINICARD_VZW          0x8133
+#define DELL_PRODUCT_5720_MINICARD_SPRINT       0x8134
+#define DELL_PRODUCT_5720_MINICARD_TELUS        0x8135
+#define DELL_PRODUCT_5520_MINICARD_CINGULAR     0x8136
+#define DELL_PRODUCT_5520_MINICARD_GENERIC_L    0x8137
+#define DELL_PRODUCT_5520_MINICARD_GENERIC_I    0x8138
+
+#define DELL_PRODUCT_5730_MINICARD_SPRINT       0x8180
+#define DELL_PRODUCT_5730_MINICARD_TELUS        0x8181
+#define DELL_PRODUCT_5730_MINICARD_VZW          0x8182
+
 #define KYOCERA_VENDOR_ID                       0x0c88
 #define KYOCERA_PRODUCT_KPC650                  0x17da
 #define KYOCERA_PRODUCT_KPC680                  0x180a
@@ -274,12 +296,6 @@ static int  option_send_setup(struct tty_struct *tty, struct usb_serial_port *po
 #define ERICSSON_VENDOR_ID                      0x0bdb
 #define ERICSSON_PRODUCT_F3507G                 0x1900
 
-/* Pantech products */
-#define PANTECH_VENDOR_ID                       0x106c
-#define PANTECH_PRODUCT_PC5740                  0x3701
-#define PANTECH_PRODUCT_PC5750                  0x3702  /* PX-500 */
-#define PANTECH_PRODUCT_UM150                   0x3711
-
 static struct usb_device_id option_ids[] = {
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_COLT) },
         { USB_DEVICE(OPTION_VENDOR_ID, OPTION_PRODUCT_RICOLA) },
@@ -395,31 +411,37 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EU870D) }, /* Novatel EU850D/EU860D/EU870D */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC950D) }, /* Novatel MC930D/MC950D */
         { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_MC727) }, /* Novatel MC727/U727/USB727 */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_1) }, /* Novatel EVDO product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_1) }, /* Novatel HSPA product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_1) }, /* Novatel Embedded product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_1) }, /* Novatel Global product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_2) }, /* Novatel EVDO product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_2) }, /* Novatel HSPA product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EMBEDDED_2) }, /* Novatel Embedded product */
-        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL_2) }, /* Novatel Global product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_FULLSPEED) }, /* Novatel EVDO product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_FULLSPEED) }, /* Novatel HSPA product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_FULLSPEED) }, /* Novatel EVDO Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_FULLSPEED) }, /* Novatel HSPA Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_HIGHSPEED) }, /* Novatel EVDO product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_HIGHSPEED) }, /* Novatel HSPA product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_EVDO_EMBEDDED_HIGHSPEED) }, /* Novatel EVDO Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_HSPA_EMBEDDED_HIGHSPEED) }, /* Novatel HSPA Embedded product */
+        { USB_DEVICE(NOVATELWIRELESS_VENDOR_ID, NOVATELWIRELESS_PRODUCT_GLOBAL) }, /* Novatel Global product */
 
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H01A) },
         { USB_DEVICE(AMOI_VENDOR_ID, AMOI_PRODUCT_H02) },
 
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8114) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8115) }, /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8116) }, /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8117) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8118) }, /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8128) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8129) }, /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite ET620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8133) }, /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8136) }, /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8137) }, /* Dell Wireless HSDPA 5520 */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8138) }, /* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
-        { USB_DEVICE(DELL_VENDOR_ID, 0x8147) }, /* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD) },             /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5500_MINICARD) },             /* Dell Wireless 5500 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5505_MINICARD) },             /* Dell Wireless 5505 Mobile Broadband HSDPA Mini-Card == Novatel Expedite EU740 HSDPA/3G */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_EXPRESSCARD) },          /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO ExpressCard == Novatel Merlin XV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5510_EXPRESSCARD) },          /* Dell Wireless 5510 Mobile Broadband HSDPA ExpressCard == Novatel Merlin XU870 HSDPA/3G */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD_SPRINT) },      /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite E720 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5700_MINICARD_TELUS) },       /* Dell Wireless 5700 Mobile Broadband CDMA/EVDO Mini-Card == Novatel Expedite ET620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_VZW) },         /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_SPRINT) },      /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5720_MINICARD_TELUS) },       /* Dell Wireless 5720 == Novatel EV620 CDMA/EV-DO */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_CINGULAR) },    /* Dell Wireless HSDPA 5520 == Novatel Expedite EU860D */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_GENERIC_L) },   /* Dell Wireless HSDPA 5520 */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5520_MINICARD_GENERIC_I) },   /* Dell Wireless 5520 Voda I Mobile Broadband (3G HSDPA) Minicard */
+        { USB_DEVICE(DELL_VENDOR_ID, 0x8147) },                                 /* Dell Wireless 5530 Mobile Broadband (3G HSPA) Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_SPRINT) },      /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_TELUS) },       /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
+        { USB_DEVICE(DELL_VENDOR_ID, DELL_PRODUCT_5730_MINICARD_VZW) },         /* Dell Wireless 5730 Mobile Broadband EVDO/HSPA Mini-Card */
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_E100A) },   /* ADU-E100, ADU-310 */
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_500A) },
         { USB_DEVICE(ANYDATA_VENDOR_ID, ANYDATA_PRODUCT_ADU_620UW) },
@@ -488,9 +510,6 @@ static struct usb_device_id option_ids[] = {
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_MF628) },
         { USB_DEVICE(ZTE_VENDOR_ID, ZTE_PRODUCT_CDMA_TECH) },
         { USB_DEVICE(ERICSSON_VENDOR_ID, ERICSSON_PRODUCT_F3507G) },
-        { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5740) },
-        { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_PC5750) },
-        { USB_DEVICE(PANTECH_VENDOR_ID, PANTECH_PRODUCT_UM150) },
         { } /* Terminating entry */
 };
 MODULE_DEVICE_TABLE(usb, option_ids);
diff --git a/drivers/usb/serial/ti_usb_3410_5052.c b/drivers/usb/serial/ti_usb_3410_5052.c
index baf591137b8..2620bf6fe5e 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.c
+++ b/drivers/usb/serial/ti_usb_3410_5052.c
@@ -176,7 +176,7 @@ static unsigned int product_5052_count;
 /* the array dimension is the number of default entries plus */
 /* TI_EXTRA_VID_PID_COUNT user defined entries plus 1 terminating */
 /* null entry */
-static struct usb_device_id ti_id_table_3410[7+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_3410[10+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -185,9 +185,11 @@ static struct usb_device_id ti_id_table_3410[7+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_PRODUCT_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_EDGE_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
 };
 
-static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_5052[5+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5152_BOOT_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
@@ -195,7 +197,7 @@ static struct usb_device_id ti_id_table_5052[4+TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
 };
 
-static struct usb_device_id ti_id_table_combined[6+2*TI_EXTRA_VID_PID_COUNT+1] = {
+static struct usb_device_id ti_id_table_combined[14+2*TI_EXTRA_VID_PID_COUNT+1] = {
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_3410_EZ430_ID) },
         { USB_DEVICE(MTS_VENDOR_ID, MTS_GSM_NO_FW_PRODUCT_ID) },
@@ -208,6 +210,8 @@ static struct usb_device_id ti_id_table_combined[6+2*TI_EXTRA_VID_PID_COUNT+1] =
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_EEPROM_PRODUCT_ID) },
         { USB_DEVICE(TI_VENDOR_ID, TI_5052_FIRMWARE_PRODUCT_ID) },
         { USB_DEVICE(IBM_VENDOR_ID, IBM_4543_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454B_PRODUCT_ID) },
+        { USB_DEVICE(IBM_VENDOR_ID, IBM_454C_PRODUCT_ID) },
         { }
 };
 
diff --git a/drivers/usb/serial/ti_usb_3410_5052.h b/drivers/usb/serial/ti_usb_3410_5052.h
index b7ea5dbadee..f323c602585 100644
--- a/drivers/usb/serial/ti_usb_3410_5052.h
+++ b/drivers/usb/serial/ti_usb_3410_5052.h
@@ -30,6 +30,8 @@
 #define IBM_VENDOR_ID                   0x04b3
 #define TI_3410_PRODUCT_ID              0x3410
 #define IBM_4543_PRODUCT_ID             0x4543
+#define IBM_454B_PRODUCT_ID             0x454b
+#define IBM_454C_PRODUCT_ID             0x454c
 #define TI_3410_EZ430_ID                0xF430  /* TI ez430 development tool */
 #define TI_5052_BOOT_PRODUCT_ID         0x5052  /* no EEPROM, no firmware */
 #define TI_5152_BOOT_PRODUCT_ID         0x5152  /* no EEPROM, no firmware */
diff --git a/drivers/usb/storage/scsiglue.c b/drivers/usb/storage/scsiglue.c
index 2a42b862aa9..727c506417c 100644
--- a/drivers/usb/storage/scsiglue.c
+++ b/drivers/usb/storage/scsiglue.c
@@ -64,6 +64,7 @@
  */
 #define VENDOR_ID_NOKIA         0x0421
 #define VENDOR_ID_NIKON         0x04b0
+#define VENDOR_ID_PENTAX        0x0a17
 #define VENDOR_ID_MOTOROLA      0x22b8
 
 /***********************************************************************
@@ -158,6 +159,7 @@ static int slave_configure(struct scsi_device *sdev)
                 switch (le16_to_cpu(us->pusb_dev->descriptor.idVendor)) {
                 case VENDOR_ID_NOKIA:
                 case VENDOR_ID_NIKON:
+                case VENDOR_ID_PENTAX:
                 case VENDOR_ID_MOTOROLA:
                         if (!(us->fflags & (US_FL_FIX_CAPACITY |
                                         US_FL_CAPACITY_OK)))
diff --git a/drivers/usb/storage/transport.c b/drivers/usb/storage/transport.c
index 1d5438e6363..fb65d221ced 100644
--- a/drivers/usb/storage/transport.c
+++ b/drivers/usb/storage/transport.c
@@ -558,32 +558,10 @@ static void last_sector_hacks(struct us_data *us, struct scsi_cmnd *srb)
 
         if (srb->result == SAM_STAT_GOOD && scsi_get_resid(srb) == 0) {
 
-                /* The command succeeded.  If the capacity is odd
-                 * (i.e., if the sector number is even) then the
-                 * "always-even" heuristic would be wrong for this
-                 * device.  Issue a WARN() so that the kerneloops.org
-                 * project will be notified and we will then know to
-                 * mark the device with a CAPACITY_OK flag.  Hopefully
-                 * this will occur for only a few devices.
-                 *
-                 * Use the sign of us->last_sector_hacks to tell whether
-                 * the warning has already been issued; we don't need
-                 * more than one warning per device.
+                /* The command succeeded.  We know this device doesn't
+                 * have the last-sector bug, so stop checking it.
                  */
-                if (!(sector & 1) && us->use_last_sector_hacks > 0) {
-                        unsigned vid = le16_to_cpu(
-                                        us->pusb_dev->descriptor.idVendor);
-                        unsigned pid = le16_to_cpu(
-                                        us->pusb_dev->descriptor.idProduct);
-                        unsigned rev = le16_to_cpu(
-                                        us->pusb_dev->descriptor.bcdDevice);
-
-                        WARN(1, "%s: Successful last sector success at %u, "
-                                        "device %04x:%04x:%04x\n",
-                                        sdkp->disk->disk_name, sector,
-                                        vid, pid, rev);
-                        us->use_last_sector_hacks = -1;
-                }
+                us->use_last_sector_hacks = 0;
 
         } else {
                 /* The command failed.  Allow up to 3 retries in case this
@@ -599,14 +577,6 @@ static void last_sector_hacks(struct us_data *us, struct scsi_cmnd *srb)
                 srb->result = SAM_STAT_CHECK_CONDITION;
                 memcpy(srb->sense_buffer, record_not_found,
                                 sizeof(record_not_found));
-
-                /* In theory we might want to issue a WARN() here if the
-                 * capacity is even, since it could indicate the device
-                 * has the READ CAPACITY bug _and_ the real capacity is
-                 * odd.  But it could also indicate that the device
-                 * simply can't access its last sector, a failure mode
-                 * which is surprisingly common.  So no warning.
-                 */
         }
 
  done:
diff --git a/drivers/usb/storage/unusual_devs.h b/drivers/usb/storage/unusual_devs.h
index 69269f73956..50dc33a6065 100644
--- a/drivers/usb/storage/unusual_devs.h
+++ b/drivers/usb/storage/unusual_devs.h
@@ -1214,7 +1214,7 @@ UNUSUAL_DEV(  0x07c4, 0xa400, 0x0000, 0xffff,
                 "Datafab",
                 "KECF-USB",
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_INQUIRY ),
+                US_FL_FIX_INQUIRY | US_FL_FIX_CAPACITY ),
 
 /* Reported by Rauch Wolke <rauchwolke@gmx.net> */
 UNUSUAL_DEV(  0x07c4, 0xa4a5, 0x0000, 0xffff,
@@ -1354,21 +1354,6 @@ UNUSUAL_DEV( 0x0a17, 0x0004, 0x1000, 0x1000,
                 US_SC_DEVICE, US_PR_DEVICE, NULL,
                 US_FL_FIX_INQUIRY ),
 
-
-/* Submitted by Per Winkvist <per.winkvist@uk.com> */
-UNUSUAL_DEV( 0x0a17, 0x006, 0x0000, 0xffff,
-                "Pentax",
-                "Optio S/S4",
-                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_INQUIRY ),
-
-/* Reported by Jaak Ristioja <Ristioja@gmail.com> */
-UNUSUAL_DEV( 0x0a17, 0x006e, 0x0100, 0x0100,
-                "Pentax",
-                "K10D",
-                US_SC_DEVICE, US_PR_DEVICE, NULL,
-                US_FL_FIX_CAPACITY ),
-
 /* These are virtual windows driver CDs, which the zd1211rw driver
  * automatically converts into WLAN devices. */
 UNUSUAL_DEV( 0x0ace, 0x2011, 0x0101, 0x0101,
diff --git a/drivers/usb/wusbcore/devconnect.c b/drivers/usb/wusbcore/devconnect.c
index e2e7e4bc846..8e18141bb2e 100644
--- a/drivers/usb/wusbcore/devconnect.c
+++ b/drivers/usb/wusbcore/devconnect.c
@@ -386,6 +386,7 @@ static void __wusbhc_dev_disconnect(struct wusbhc *wusbhc,
                           | USB_PORT_STAT_LOW_SPEED | USB_PORT_STAT_HIGH_SPEED);
         port->change |= USB_PORT_STAT_C_CONNECTION | USB_PORT_STAT_C_ENABLE;
         if (wusb_dev) {
+                dev_dbg(wusbhc->dev, "disconnecting device from port %d\n", wusb_dev->port_idx);
                 if (!list_empty(&wusb_dev->cack_node))
                         list_del_init(&wusb_dev->cack_node);
                 /* For the one in cack_add() */
diff --git a/drivers/usb/wusbcore/rh.c b/drivers/usb/wusbcore/rh.c
index 3937bf6f8ce..9fe4246cecb 100644
--- a/drivers/usb/wusbcore/rh.c
+++ b/drivers/usb/wusbcore/rh.c
@@ -100,6 +100,9 @@ static int wusbhc_rh_port_reset(struct wusbhc *wusbhc, u8 port_idx)
         struct wusb_port *port = wusb_port_by_idx(wusbhc, port_idx);
         struct wusb_dev *wusb_dev = port->wusb_dev;
 
+        if (wusb_dev == NULL)
+                return -ENOTCONN;
+
         port->status |= USB_PORT_STAT_RESET;
         port->change |= USB_PORT_STAT_C_RESET;
 
diff --git a/drivers/uwb/allocator.c b/drivers/uwb/allocator.c
index c8185e6b0cd..c13cec7dcbc 100644
--- a/drivers/uwb/allocator.c
+++ b/drivers/uwb/allocator.c
@@ -15,7 +15,6 @@
  * You should have received a copy of the GNU General Public License
  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  */
-#include <linux/version.h>
 #include <linux/kernel.h>
 #include <linux/uwb.h>
 
diff --git a/drivers/uwb/drp.c b/drivers/uwb/drp.c
index 2b4f9406789..4f5ca99a04b 100644
--- a/drivers/uwb/drp.c
+++ b/drivers/uwb/drp.c
@@ -66,14 +66,14 @@ static void uwb_rc_set_drp_cmd_done(struct uwb_rc *rc, void *arg,
         } else
                 dev_err(&rc->uwb_dev.dev, "SET-DRP-IE: timeout\n");
 
-        spin_lock(&rc->rsvs_lock);
+        spin_lock_bh(&rc->rsvs_lock);
         if (rc->set_drp_ie_pending > 1) {
                 rc->set_drp_ie_pending = 0;
                 uwb_rsv_queue_update(rc);       
         } else {
                 rc->set_drp_ie_pending = 0;     
         }
-        spin_unlock(&rc->rsvs_lock);
+        spin_unlock_bh(&rc->rsvs_lock);
 }
 
 /**
diff --git a/drivers/uwb/rsv.c b/drivers/uwb/rsv.c
index ec6eecb32f3..6b76f4bb4cc 100644
--- a/drivers/uwb/rsv.c
+++ b/drivers/uwb/rsv.c
@@ -114,7 +114,8 @@ void uwb_rsv_dump(char *text, struct uwb_rsv *rsv)
                 devaddr = rsv->target.devaddr;
         uwb_dev_addr_print(target, sizeof(target), &devaddr);
 
-        dev_dbg(dev, "rsv %s -> %s: %s\n", owner, target, uwb_rsv_state_str(rsv->state));
+        dev_dbg(dev, "rsv %s %s -> %s: %s\n",
+                text, owner, target, uwb_rsv_state_str(rsv->state));
 }
 
 static void uwb_rsv_release(struct kref *kref)
@@ -511,8 +512,7 @@ void uwb_rsv_remove(struct uwb_rsv *rsv)
 
         if (uwb_rsv_is_owner(rsv))
                 uwb_rsv_put_stream(rsv);
-        
-        del_timer_sync(&rsv->timer);
+
         uwb_dev_put(rsv->owner);
         if (rsv->target.type == UWB_RSV_TARGET_DEV)
                 uwb_dev_put(rsv->target.dev);
@@ -870,7 +870,7 @@ void uwb_rsv_queue_update(struct uwb_rc *rc)
  */
 void uwb_rsv_sched_update(struct uwb_rc *rc)
 {
-        spin_lock(&rc->rsvs_lock);
+        spin_lock_bh(&rc->rsvs_lock);
         if (!delayed_work_pending(&rc->rsv_update_work)) {
                 if (rc->set_drp_ie_pending > 0) {
                         rc->set_drp_ie_pending++;
@@ -879,7 +879,7 @@ void uwb_rsv_sched_update(struct uwb_rc *rc)
                 uwb_rsv_queue_update(rc);
         }
 unlock:
-        spin_unlock(&rc->rsvs_lock);
+        spin_unlock_bh(&rc->rsvs_lock);
 }
 
 /*
@@ -943,13 +943,22 @@ void uwb_rsv_remove_all(struct uwb_rc *rc)
 
         mutex_lock(&rc->rsvs_mutex);
         list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
-                uwb_rsv_remove(rsv);
+                if (rsv->state != UWB_RSV_STATE_NONE)
+                        uwb_rsv_set_state(rsv, UWB_RSV_STATE_NONE);
+                del_timer_sync(&rsv->timer);
         }
         /* Cancel any postponed update. */
         rc->set_drp_ie_pending = 0;
         mutex_unlock(&rc->rsvs_mutex);
 
         cancel_delayed_work_sync(&rc->rsv_update_work);
+        flush_workqueue(rc->rsv_workq);
+
+        mutex_lock(&rc->rsvs_mutex);
+        list_for_each_entry_safe(rsv, t, &rc->reservations, rc_node) {
+                uwb_rsv_remove(rsv);
+        }
+        mutex_unlock(&rc->rsvs_mutex);
 }
 
 void uwb_rsv_init(struct uwb_rc *rc)
diff --git a/drivers/video/Kconfig b/drivers/video/Kconfig
index f0267706cb4..bf0af660df8 100644
--- a/drivers/video/Kconfig
+++ b/drivers/video/Kconfig
@@ -1054,9 +1054,10 @@ config FB_RIVA_BACKLIGHT
 
 config FB_I810
         tristate "Intel 810/815 support (EXPERIMENTAL)"
-        depends on FB && EXPERIMENTAL && PCI && X86_32
+        depends on EXPERIMENTAL && PCI && X86_32
         select AGP
         select AGP_INTEL
+        select FB
         select FB_MODE_HELPERS
         select FB_CFB_FILLRECT
         select FB_CFB_COPYAREA
@@ -1119,7 +1120,8 @@ config FB_CARILLO_RANCH
 
 config FB_INTEL
         tristate "Intel 830M/845G/852GM/855GM/865G/915G/945G/945GM/965G/965GM support (EXPERIMENTAL)"
-        depends on FB && EXPERIMENTAL && PCI && X86
+        depends on EXPERIMENTAL && PCI && X86
+        select FB
         select AGP
         select AGP_INTEL
         select FB_MODE_HELPERS
diff --git a/drivers/video/aty/aty128fb.c b/drivers/video/aty/aty128fb.c
index db16112cf19..e6e299feb51 100644
--- a/drivers/video/aty/aty128fb.c
+++ b/drivers/video/aty/aty128fb.c
@@ -1475,7 +1475,7 @@ static int aty128fb_set_par(struct fb_info *info)
         aty128_set_pll(&par->pll, par);
         aty128_set_fifo(&par->fifo_reg, par);
 
-        config = aty_ld_le32(CONFIG_CNTL) & ~3;
+        config = aty_ld_le32(CNFG_CNTL) & ~3;
 
 #if defined(__BIG_ENDIAN)
         if (par->crtc.bpp == 32)
@@ -1484,7 +1484,7 @@ static int aty128fb_set_par(struct fb_info *info)
                 config |= 1;    /* make aperture do 16 bit swapping */
 #endif
 
-        aty_st_le32(CONFIG_CNTL, config);
+        aty_st_le32(CNFG_CNTL, config);
         aty_st_8(CRTC_EXT_CNTL + 1, 0); /* turn the video back on */
 
         info->fix.line_length = (par->crtc.vxres * par->crtc.bpp) >> 3;
@@ -1875,7 +1875,7 @@ static int __devinit aty128_init(struct pci_dev *pdev, const struct pci_device_i
         u32 dac;
 
         /* Get the chip revision */
-        chip_rev = (aty_ld_le32(CONFIG_CNTL) >> 16) & 0x1F;
+        chip_rev = (aty_ld_le32(CNFG_CNTL) >> 16) & 0x1F;
 
         strcpy(video_card, "Rage128 XX ");
         video_card[8] = ent->device >> 8;
@@ -2057,7 +2057,7 @@ static int __devinit aty128_probe(struct pci_dev *pdev, const struct pci_device_
 
         /* Grab memory size from the card */
         // How does this relate to the resource length from the PCI hardware?
-        par->vram_size = aty_ld_le32(CONFIG_MEMSIZE) & 0x03FFFFFF;
+        par->vram_size = aty_ld_le32(CNFG_MEMSIZE) & 0x03FFFFFF;
 
         /* Virtualize the framebuffer */
         info->screen_base = ioremap(fb_addr, par->vram_size);
@@ -2374,6 +2374,8 @@ static void aty128_set_suspend(struct aty128fb_par *par, int suspend)
         /* Set the chip into the appropriate suspend mode (we use D2,
          * D3 would require a complete re-initialisation of the chip,
          * including PCI config registers, clocks, AGP configuration, ...)
+         *
+         * For resume, the core will have already brought us back to D0
          */
         if (suspend) {
                 /* Make sure CRTC2 is reset. Remove that the day we decide to
@@ -2391,17 +2393,9 @@ static void aty128_set_suspend(struct aty128fb_par *par, int suspend)
                 aty_st_le32(BUS_CNTL1, 0x00000010);
                 aty_st_le32(MEM_POWER_MISC, 0x0c830000);
                 mdelay(100);
-                pci_read_config_word(pdev, par->pm_reg+PCI_PM_CTRL, &pwr_command);
+
                 /* Switch PCI power management to D2 */
-                pci_write_config_word(pdev, par->pm_reg+PCI_PM_CTRL,
-                        (pwr_command & ~PCI_PM_CTRL_STATE_MASK) | 2);
-                pci_read_config_word(pdev, par->pm_reg+PCI_PM_CTRL, &pwr_command);
-        } else {
-                /* Switch back PCI power management to D0 */
-                mdelay(100);
-                pci_write_config_word(pdev, par->pm_reg+PCI_PM_CTRL, 0);
-                pci_read_config_word(pdev, par->pm_reg+PCI_PM_CTRL, &pwr_command);
-                mdelay(100);
+                pci_set_power_state(pdev, PCI_D2);
         }
 }
 
@@ -2410,6 +2404,12 @@ static int aty128_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         struct fb_info *info = pci_get_drvdata(pdev);
         struct aty128fb_par *par = info->par;
 
+        /* Because we may change PCI D state ourselves, we need to
+         * first save the config space content so the core can
+         * restore it properly on resume.
+         */
+        pci_save_state(pdev);
+
         /* We don't do anything but D2, for now we return 0, but
          * we may want to change that. How do we know if the BIOS
          * can properly take care of D3 ? Also, with swsusp, we
@@ -2476,6 +2476,11 @@ static int aty128_do_resume(struct pci_dev *pdev)
         if (pdev->dev.power.power_state.event == PM_EVENT_ON)
                 return 0;
 
+        /* PCI state will have been restored by the core, so
+         * we should be in D0 now with our config space fully
+         * restored
+         */
+
         /* Wakeup chip */
         aty128_set_suspend(par, 0);
         par->asleep = 0;
diff --git a/drivers/video/aty/atyfb_base.c b/drivers/video/aty/atyfb_base.c
index cc6b470073d..1207c208a30 100644
--- a/drivers/video/aty/atyfb_base.c
+++ b/drivers/video/aty/atyfb_base.c
@@ -135,7 +135,7 @@
 #if defined(CONFIG_PM) || defined(CONFIG_PMAC_BACKLIGHT) || \
 defined (CONFIG_FB_ATY_GENERIC_LCD) || defined(CONFIG_FB_ATY_BACKLIGHT)
 static const u32 lt_lcd_regs[] = {
-        CONFIG_PANEL_LG,
+        CNFG_PANEL_LG,
         LCD_GEN_CNTL_LG,
         DSTN_CONTROL_LG,
         HFB_PITCH_ADDR_LG,
@@ -446,7 +446,7 @@ static int __devinit correct_chipset(struct atyfb_par *par)
         par->pll_limits.ecp_max = aty_chips[i].ecp_max;
         par->features = aty_chips[i].features;
 
-        chip_id = aty_ld_le32(CONFIG_CHIP_ID, par);
+        chip_id = aty_ld_le32(CNFG_CHIP_ID, par);
         type = chip_id & CFG_CHIP_TYPE;
         rev = (chip_id & CFG_CHIP_REV) >> 24;
 
@@ -629,7 +629,7 @@ static void aty_get_crtc(const struct atyfb_par *par, struct crtc *crtc)
                     crtc->lcd_index = aty_ld_le32(LCD_INDEX, par);
                     aty_st_le32(LCD_INDEX, crtc->lcd_index, par);
                 }
-                crtc->lcd_config_panel = aty_ld_lcd(CONFIG_PANEL, par);
+                crtc->lcd_config_panel = aty_ld_lcd(CNFG_PANEL, par);
                 crtc->lcd_gen_cntl = aty_ld_lcd(LCD_GEN_CNTL, par);
 
 
@@ -676,7 +676,7 @@ static void aty_set_crtc(const struct atyfb_par *par, const struct crtc *crtc)
                 aty_st_le32(CRTC_GEN_CNTL, crtc->gen_cntl & ~(CRTC_EXT_DISP_EN | CRTC_EN), par);
 
                 /* update non-shadow registers first */
-                aty_st_lcd(CONFIG_PANEL, crtc->lcd_config_panel, par);
+                aty_st_lcd(CNFG_PANEL, crtc->lcd_config_panel, par);
                 aty_st_lcd(LCD_GEN_CNTL, crtc->lcd_gen_cntl &
                         ~(CRTC_RW_SELECT | SHADOW_EN | SHADOW_RW_EN), par);
 
@@ -858,7 +858,7 @@ static int aty_var_to_crtc(const struct fb_info *info,
                 if (!M64_HAS(MOBIL_BUS))
                         crtc->lcd_index |= CRTC2_DISPLAY_DIS;
 
-                crtc->lcd_config_panel = aty_ld_lcd(CONFIG_PANEL, par) | 0x4000;
+                crtc->lcd_config_panel = aty_ld_lcd(CNFG_PANEL, par) | 0x4000;
                 crtc->lcd_gen_cntl = aty_ld_lcd(LCD_GEN_CNTL, par) & ~CRTC_RW_SELECT;
 
                 crtc->lcd_gen_cntl &=
@@ -1978,7 +1978,7 @@ static int aty_power_mgmt(int sleep, struct atyfb_par *par)
 
         return timeout ? 0 : -EIO;
 }
-#endif
+#endif /* CONFIG_PPC_PMAC */
 
 static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
 {
@@ -2002,9 +2002,15 @@ static int atyfb_pci_suspend(struct pci_dev *pdev, pm_message_t state)
         par->asleep = 1;
         par->lock_blank = 1;
 
+        /* Because we may change PCI D state ourselves, we need to
+         * first save the config space content so the core can
+         * restore it properly on resume.
+         */
+        pci_save_state(pdev);
+
 #ifdef CONFIG_PPC_PMAC
         /* Set chip to "suspend" mode */
-        if (aty_power_mgmt(1, par)) {
+        if (machine_is(powermac) && aty_power_mgmt(1, par)) {
                 par->asleep = 0;
                 par->lock_blank = 0;
                 atyfb_blank(FB_BLANK_UNBLANK, info);
@@ -2047,11 +2053,15 @@ static int atyfb_pci_resume(struct pci_dev *pdev)
 
         acquire_console_sem();
 
+        /* PCI state will have been restored by the core, so
+         * we should be in D0 now with our config space fully
+         * restored
+         */
+
 #ifdef CONFIG_PPC_PMAC
-        if (pdev->dev.power.power_state.event == 2)
+        if (machine_is(powermac) &&
+            pdev->dev.power.power_state.event == PM_EVENT_SUSPEND)
                 aty_power_mgmt(0, par);
-#else
-        pci_set_power_state(pdev, PCI_D0);
 #endif
 
         aty_resume_chip(info);
@@ -2254,7 +2264,7 @@ static int __devinit aty_init(struct fb_info *info)
         if (!M64_HAS(INTEGRATED)) {
                 u32 stat0;
                 u8 dac_type, dac_subtype, clk_type;
-                stat0 = aty_ld_le32(CONFIG_STAT0, par);
+                stat0 = aty_ld_le32(CNFG_STAT0, par);
                 par->bus_type = (stat0 >> 0) & 0x07;
                 par->ram_type = (stat0 >> 3) & 0x07;
                 ramname = aty_gx_ram[par->ram_type];
@@ -2324,7 +2334,7 @@ static int __devinit aty_init(struct fb_info *info)
                 par->dac_ops = &aty_dac_ct;
                 par->pll_ops = &aty_pll_ct;
                 par->bus_type = PCI;
-                par->ram_type = (aty_ld_le32(CONFIG_STAT0, par) & 0x07);
+                par->ram_type = (aty_ld_le32(CNFG_STAT0, par) & 0x07);
                 ramname = aty_ct_ram[par->ram_type];
                 /* for many chips, the mclk is 67 MHz for SDRAM, 63 MHz otherwise */
                 if (par->pll_limits.mclk == 67 && par->ram_type < SDRAM)
@@ -2433,7 +2443,7 @@ static int __devinit aty_init(struct fb_info *info)
                 }
 
         if (M64_HAS(MAGIC_VRAM_SIZE)) {
-                if (aty_ld_le32(CONFIG_STAT1, par) & 0x40000000)
+                if (aty_ld_le32(CNFG_STAT1, par) & 0x40000000)
                         info->fix.smem_len += 0x400000;
         }
 
@@ -2946,7 +2956,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                  * Fix PROMs idea of MEM_CNTL settings...
                  */
                 mem = aty_ld_le32(MEM_CNTL, par);
-                chip_id = aty_ld_le32(CONFIG_CHIP_ID, par);
+                chip_id = aty_ld_le32(CNFG_CHIP_ID, par);
                 if (((chip_id & CFG_CHIP_TYPE) == VT_CHIP_ID) && !((chip_id >> 24) & 1)) {
                         switch (mem & 0x0f) {
                         case 3:
@@ -2964,7 +2974,7 @@ static int __devinit atyfb_setup_sparc(struct pci_dev *pdev,
                         default:
                                 break;
                         }
-                        if ((aty_ld_le32(CONFIG_STAT0, par) & 7) >= SDRAM)
+                        if ((aty_ld_le32(CNFG_STAT0, par) & 7) >= SDRAM)
                                 mem &= ~(0x00700000);
                 }
                 mem &= ~(0xcf80e000);   /* Turn off all undocumented bits. */
@@ -3572,7 +3582,7 @@ static int __init atyfb_atari_probe(void)
                 }
 
                 /* Fake pci_id for correct_chipset() */
-                switch (aty_ld_le32(CONFIG_CHIP_ID, par) & CFG_CHIP_TYPE) {
+                switch (aty_ld_le32(CNFG_CHIP_ID, par) & CFG_CHIP_TYPE) {
                 case 0x00d7:
                         par->pci_id = PCI_CHIP_MACH64GX;
                         break;
diff --git a/drivers/video/aty/mach64_ct.c b/drivers/video/aty/mach64_ct.c
index c50c7cf26fe..2745b853948 100644
--- a/drivers/video/aty/mach64_ct.c
+++ b/drivers/video/aty/mach64_ct.c
@@ -8,6 +8,9 @@
 #include <asm/io.h>
 #include <video/mach64.h>
 #include "atyfb.h"
+#ifdef CONFIG_PPC
+#include <asm/machdep.h>
+#endif
 
 #undef DEBUG
 
@@ -536,6 +539,14 @@ static int __devinit aty_init_pll_ct(const struct fb_info *info,
         pll->ct.xclk_post_div_real = postdividers[xpost_div];
         pll->ct.mclk_fb_div = q * pll->ct.xclk_post_div_real / 8;
 
+#ifdef CONFIG_PPC
+        if (machine_is(powermac)) {
+                /* Override PLL_EXT_CNTL & 0x07. */
+                pll->ct.xclk_post_div = xpost_div;
+                pll->ct.xclk_ref_div = 1;
+        }
+#endif
+
 #ifdef DEBUG
         pllmclk = (1000000 * pll->ct.mclk_fb_mult * pll->ct.mclk_fb_div) /
                         (par->ref_clk_per * pll->ct.pll_ref_div);
diff --git a/drivers/video/aty/radeon_base.c b/drivers/video/aty/radeon_base.c
index d0f1a7fc2c9..16bb7e3c031 100644
--- a/drivers/video/aty/radeon_base.c
+++ b/drivers/video/aty/radeon_base.c
@@ -1936,8 +1936,8 @@ static void fixup_memory_mappings(struct radeonfb_info *rinfo)
         OUTREG(CRTC_GEN_CNTL, save_crtc_gen_cntl | CRTC_DISP_REQ_EN_B);
         mdelay(100);
 
-        aper_base = INREG(CONFIG_APER_0_BASE);
-        aper_size = INREG(CONFIG_APER_SIZE);
+        aper_base = INREG(CNFG_APER_0_BASE);
+        aper_size = INREG(CNFG_APER_SIZE);
 
 #ifdef SET_MC_FB_FROM_APERTURE
         /* Set framebuffer to be at the same address as set in PCI BAR */
@@ -2024,11 +2024,11 @@ static void radeon_identify_vram(struct radeonfb_info *rinfo)
                      ~CRTC_H_CUTOFF_ACTIVE_EN);
           }
         } else {
-          tmp = INREG(CONFIG_MEMSIZE);
+          tmp = INREG(CNFG_MEMSIZE);
         }
 
         /* mem size is bits [28:0], mask off the rest */
-        rinfo->video_ram = tmp & CONFIG_MEMSIZE_MASK;
+        rinfo->video_ram = tmp & CNFG_MEMSIZE_MASK;
 
         /*
          * Hack to get around some busted production M6's
@@ -2228,7 +2228,7 @@ static int __devinit radeonfb_pci_register (struct pci_dev *pdev,
          */
         rinfo->errata = 0;
         if (rinfo->family == CHIP_FAMILY_R300 &&
-            (INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK)
+            (INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK)
             == CFG_ATI_REV_A11)
                 rinfo->errata |= CHIP_ERRATA_R300_CG;
 
diff --git a/drivers/video/aty/radeon_pm.c b/drivers/video/aty/radeon_pm.c
index 675abdafc2d..ca5f0dc2854 100644
--- a/drivers/video/aty/radeon_pm.c
+++ b/drivers/video/aty/radeon_pm.c
@@ -333,7 +333,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
         if (!rinfo->has_CRTC2) {
                 tmp = INPLL(pllSCLK_CNTL);
 
-                if ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) > CFG_ATI_REV_A13)
+                if ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) > CFG_ATI_REV_A13)
                     tmp &= ~(SCLK_CNTL__FORCE_CP        | SCLK_CNTL__FORCE_RB);
                 tmp &= ~(SCLK_CNTL__FORCE_HDP           | SCLK_CNTL__FORCE_DISP1 |
                          SCLK_CNTL__FORCE_TOP           | SCLK_CNTL__FORCE_SE   |
@@ -468,9 +468,9 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
 
         /*RAGE_6::A11 A12 A12N1 A13, RV250::A11 A12, R300*/
         if ((rinfo->family == CHIP_FAMILY_RV250 &&
-             ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) ||
+             ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) ||
             ((rinfo->family == CHIP_FAMILY_RV100) &&
-             ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) <= CFG_ATI_REV_A13))) {
+             ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) <= CFG_ATI_REV_A13))) {
                 tmp |= SCLK_CNTL__FORCE_CP;
                 tmp |= SCLK_CNTL__FORCE_VIP;
         }
@@ -486,7 +486,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
                 /* RV200::A11 A12 RV250::A11 A12 */
                 if (((rinfo->family == CHIP_FAMILY_RV200) ||
                      (rinfo->family == CHIP_FAMILY_RV250)) &&
-                    ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13))
+                    ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13))
                         tmp |= SCLK_MORE_CNTL__FORCEON;
 
                 OUTPLL(pllSCLK_MORE_CNTL, tmp);
@@ -497,7 +497,7 @@ static void radeon_pm_enable_dynamic_mode(struct radeonfb_info *rinfo)
         /* RV200::A11 A12, RV250::A11 A12 */
         if (((rinfo->family == CHIP_FAMILY_RV200) ||
              (rinfo->family == CHIP_FAMILY_RV250)) &&
-            ((INREG(CONFIG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) {
+            ((INREG(CNFG_CNTL) & CFG_ATI_REV_ID_MASK) < CFG_ATI_REV_A13)) {
                 tmp = INPLL(pllPLL_PWRMGT_CNTL);
                 tmp |= PLL_PWRMGT_CNTL__TCL_BYPASS_DISABLE;
                 OUTPLL(pllPLL_PWRMGT_CNTL, tmp);
@@ -702,7 +702,7 @@ static void radeon_pm_restore_regs(struct radeonfb_info *rinfo)
         OUTREG(DISPLAY_BASE_ADDR, rinfo->save_regs[31]);
         OUTREG(MC_AGP_LOCATION, rinfo->save_regs[32]);
         OUTREG(CRTC2_DISPLAY_BASE_ADDR, rinfo->save_regs[33]);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
 
         OUTREG(DISP_MISC_CNTL, rinfo->save_regs[9]);
         OUTREG(DISP_PWR_MAN, rinfo->save_regs[10]);
@@ -1723,7 +1723,7 @@ static void radeon_reinitialize_M10(struct radeonfb_info *rinfo)
         OUTREG(CRTC2_DISPLAY_BASE_ADDR, rinfo->save_regs[33]);
         OUTREG(MC_FB_LOCATION, rinfo->save_regs[30]);
         OUTREG(OV0_BASE_ADDR, rinfo->save_regs[80]);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
         OUTREG(BUS_CNTL, rinfo->save_regs[36]);
         OUTREG(BUS_CNTL1, rinfo->save_regs[14]);
         OUTREG(MPP_TB_CONFIG, rinfo->save_regs[37]);
@@ -1961,7 +1961,7 @@ static void radeon_pm_m9p_reconfigure_mc(struct radeonfb_info *rinfo)
         OUTMC(rinfo, ixMC_CHP_IO_CNTL_B1, rinfo->save_regs[68] /*0x141555ff*/);
         OUTMC(rinfo, ixMC_IMP_CNTL_0, rinfo->save_regs[71] /*0x00009249*/);
         OUTREG(MC_IND_INDEX, 0);
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
 
         mdelay(20);
 }
@@ -2361,7 +2361,7 @@ static void radeon_reinitialize_QW(struct radeonfb_info *rinfo)
         OUTMC(rinfo, ixMC_IMP_CNTL_0, 0x00009249);
         OUTREG(MC_IND_INDEX, 0);
 
-        OUTREG(CONFIG_MEMSIZE, rinfo->video_ram);
+        OUTREG(CNFG_MEMSIZE, rinfo->video_ram);
 
         radeon_pm_full_reset_sdram(rinfo);
 
@@ -2509,9 +2509,7 @@ static void radeon_reinitialize_QW(struct radeonfb_info *rinfo)
 
 static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
 {
-        u16 pwr_cmd;
         u32 tmp;
-        int i;
 
         if (!rinfo->pm_reg)
                 return;
@@ -2557,32 +2555,14 @@ static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
                         }
                 }
 
-                for (i = 0; i < 64; ++i)
-                        pci_read_config_dword(rinfo->pdev, i * 4,
-                                              &rinfo->cfg_save[i]);
-
                 /* Switch PCI power management to D2. */
                 pci_disable_device(rinfo->pdev);
-                for (;;) {
-                        pci_read_config_word(
-                                rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL,
-                                &pwr_cmd);
-                        if (pwr_cmd & 2)
-                                break;                  
-                        pci_write_config_word(
-                                rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL,
-                                (pwr_cmd & ~PCI_PM_CTRL_STATE_MASK) | 2);
-                        mdelay(500);
-                }
+                pci_save_state(rinfo->pdev);
+                pci_set_power_state(rinfo->pdev, PCI_D2);
         } else {
                 printk(KERN_DEBUG "radeonfb (%s): switching to D0 state...\n",
                        pci_name(rinfo->pdev));
 
-                /* Switch back PCI powermanagment to D0 */
-                mdelay(200);
-                pci_write_config_word(rinfo->pdev, rinfo->pm_reg+PCI_PM_CTRL, 0);
-                mdelay(500);
-
                 if (rinfo->family <= CHIP_FAMILY_RV250) {
                         /* Reset the SDRAM controller  */
                         radeon_pm_full_reset_sdram(rinfo);
@@ -2598,37 +2578,10 @@ static void radeon_set_suspend(struct radeonfb_info *rinfo, int suspend)
         }
 }
 
-static int radeon_restore_pci_cfg(struct radeonfb_info *rinfo)
-{
-        int i;
-        static u32 radeon_cfg_after_resume[64];
-
-        for (i = 0; i < 64; ++i)
-                pci_read_config_dword(rinfo->pdev, i * 4,
-                                      &radeon_cfg_after_resume[i]);
-
-        if (radeon_cfg_after_resume[PCI_BASE_ADDRESS_0/4]
-            == rinfo->cfg_save[PCI_BASE_ADDRESS_0/4])
-                return 0;       /* assume everything is ok */
-
-        for (i = PCI_BASE_ADDRESS_0/4; i < 64; ++i) {
-                if (radeon_cfg_after_resume[i] != rinfo->cfg_save[i])
-                        pci_write_config_dword(rinfo->pdev, i * 4,
-                                               rinfo->cfg_save[i]);
-        }
-        pci_write_config_word(rinfo->pdev, PCI_CACHE_LINE_SIZE,
-                              rinfo->cfg_save[PCI_CACHE_LINE_SIZE/4]);
-        pci_write_config_word(rinfo->pdev, PCI_COMMAND,
-                              rinfo->cfg_save[PCI_COMMAND/4]);
-        return 1;
-}
-
-
 int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
         struct radeonfb_info *rinfo = info->par;
-        int i;
 
         if (mesg.event == pdev->dev.power.power_state.event)
                 return 0;
@@ -2674,6 +2627,11 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
         pmac_suspend_agp_for_card(pdev);
 #endif /* CONFIG_PPC_PMAC */
 
+        /* It's unclear whether or when the generic code will do that, so let's
+         * do it ourselves. We save state before we do any power management
+         */
+        pci_save_state(pdev);
+
         /* If we support wakeup from poweroff, we save all regs we can including cfg
          * space
          */
@@ -2698,9 +2656,6 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
                         mdelay(20);
                         OUTREG(LVDS_GEN_CNTL, INREG(LVDS_GEN_CNTL) & ~(LVDS_DIGON));
                 }
-                // FIXME: Use PCI layer
-                for (i = 0; i < 64; ++i)
-                        pci_read_config_dword(pdev, i * 4, &rinfo->cfg_save[i]);
                 pci_disable_device(pdev);
         }
         /* If we support D2, we go to it (should be fixed later with a flag forcing
@@ -2717,6 +2672,13 @@ int radeonfb_pci_suspend(struct pci_dev *pdev, pm_message_t mesg)
         return 0;
 }
 
+static int radeon_check_power_loss(struct radeonfb_info *rinfo)
+{
+        return rinfo->save_regs[4] != INPLL(CLK_PIN_CNTL) ||
+               rinfo->save_regs[2] != INPLL(MCLK_CNTL) ||
+               rinfo->save_regs[3] != INPLL(SCLK_CNTL);
+}
+
 int radeonfb_pci_resume(struct pci_dev *pdev)
 {
         struct fb_info *info = pci_get_drvdata(pdev);
@@ -2735,20 +2697,13 @@ int radeonfb_pci_resume(struct pci_dev *pdev)
         printk(KERN_DEBUG "radeonfb (%s): resuming from state: %d...\n",
                pci_name(pdev), pdev->dev.power.power_state.event);
 
-
-        if (pci_enable_device(pdev)) {
-                rc = -ENODEV;
-                printk(KERN_ERR "radeonfb (%s): can't enable PCI device !\n",
-                       pci_name(pdev));
-                goto bail;
-        }
-        pci_set_master(pdev);
-
+        /* PCI state will have been restored by the core, so
+         * we should be in D0 now with our config space fully
+         * restored
+         */
         if (pdev->dev.power.power_state.event == PM_EVENT_SUSPEND) {
-                /* Wakeup chip. Check from config space if we were powered off
-                 * (todo: additionally, check CLK_PIN_CNTL too)
-                 */
-                if ((rinfo->pm_mode & radeon_pm_off) && radeon_restore_pci_cfg(rinfo)) {
+                /* Wakeup chip */
+                if ((rinfo->pm_mode & radeon_pm_off) && radeon_check_power_loss(rinfo)) {
                         if (rinfo->reinit_func != NULL)
                                 rinfo->reinit_func(rinfo);
                         else {
diff --git a/drivers/video/aty/radeonfb.h b/drivers/video/aty/radeonfb.h
index 3ea1b00fdd2..7351e66c7f5 100644
--- a/drivers/video/aty/radeonfb.h
+++ b/drivers/video/aty/radeonfb.h
@@ -361,8 +361,6 @@ struct radeonfb_info {
 #ifdef CONFIG_FB_RADEON_I2C
         struct radeon_i2c_chan  i2c[4];
 #endif
-
-        u32                     cfg_save[64];
 };
 
 
diff --git a/drivers/video/backlight/Makefile b/drivers/video/backlight/Makefile
index 363b3cb2f01..63d75949816 100644
--- a/drivers/video/backlight/Makefile
+++ b/drivers/video/backlight/Makefile
@@ -18,7 +18,7 @@ obj-$(CONFIG_BACKLIGHT_OMAP1)	+= omap1_bl.o
 obj-$(CONFIG_BACKLIGHT_PROGEAR) += progear_bl.o
 obj-$(CONFIG_BACKLIGHT_CARILLO_RANCH) += cr_bllcd.o
 obj-$(CONFIG_BACKLIGHT_PWM)     += pwm_bl.o
-obj-$(CONFIG_BACKLIGHT_DA903X)  += da903x.o
+obj-$(CONFIG_BACKLIGHT_DA903X)  += da903x_bl.o
 obj-$(CONFIG_BACKLIGHT_MBP_NVIDIA) += mbp_nvidia_bl.o
 obj-$(CONFIG_BACKLIGHT_TOSA)    += tosa_bl.o
 obj-$(CONFIG_BACKLIGHT_SAHARA)  += kb3886_bl.o
diff --git a/drivers/video/backlight/da903x.c b/drivers/video/backlight/da903x_bl.c
index 93bb4340cc6..93bb4340cc6 100644
--- a/drivers/video/backlight/da903x.c
+++ b/drivers/video/backlight/da903x_bl.c
diff --git a/drivers/video/bfin-t350mcqb-fb.c b/drivers/video/bfin-t350mcqb-fb.c
index 2a423d3a2a8..90cfddabf1f 100644
--- a/drivers/video/bfin-t350mcqb-fb.c
+++ b/drivers/video/bfin-t350mcqb-fb.c
@@ -447,7 +447,7 @@ static irqreturn_t bfin_t350mcqb_irq_error(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-static int __init bfin_t350mcqb_probe(struct platform_device *pdev)
+static int __devinit bfin_t350mcqb_probe(struct platform_device *pdev)
 {
         struct bfin_t350mcqbfb_info *info;
         struct fb_info *fbinfo;
diff --git a/drivers/video/fbcmap.c b/drivers/video/fbcmap.c
index 91b78e69150..f53b9f1d6ab 100644
--- a/drivers/video/fbcmap.c
+++ b/drivers/video/fbcmap.c
@@ -250,10 +250,6 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
         int rc, size = cmap->len * sizeof(u16);
         struct fb_cmap umap;
 
-        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-                                !info->fbops->fb_setcmap))
-                return -EINVAL;
-
         memset(&umap, 0, sizeof(struct fb_cmap));
         rc = fb_alloc_cmap(&umap, cmap->len, cmap->transp != NULL);
         if (rc)
@@ -262,11 +258,23 @@ int fb_set_user_cmap(struct fb_cmap_user *cmap, struct fb_info *info)
             copy_from_user(umap.green, cmap->green, size) ||
             copy_from_user(umap.blue, cmap->blue, size) ||
             (cmap->transp && copy_from_user(umap.transp, cmap->transp, size))) {
-                fb_dealloc_cmap(&umap);
-                return -EFAULT;
+                rc = -EFAULT;
+                goto out;
         }
         umap.start = cmap->start;
+        if (!lock_fb_info(info)) {
+                rc = -ENODEV;
+                goto out;
+        }
+        if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
+                                !info->fbops->fb_setcmap)) {
+                rc = -EINVAL;
+                goto out1;
+        }
         rc = fb_set_cmap(&umap, info);
+out1:
+        unlock_fb_info(info);
+out:
         fb_dealloc_cmap(&umap);
         return rc;
 }
diff --git a/drivers/video/fbmem.c b/drivers/video/fbmem.c
index 756efeb91ab..cfd9dce1ce0 100644
--- a/drivers/video/fbmem.c
+++ b/drivers/video/fbmem.c
@@ -1013,132 +1013,139 @@ static long do_fb_ioctl(struct fb_info *info, unsigned int cmd,
         struct fb_var_screeninfo var;
         struct fb_fix_screeninfo fix;
         struct fb_con2fbmap con2fb;
+        struct fb_cmap cmap_from;
         struct fb_cmap_user cmap;
         struct fb_event event;
         void __user *argp = (void __user *)arg;
         long ret = 0;
 
-        fb = info->fbops;
-        if (!fb)
-                return -ENODEV;
-
         switch (cmd) {
         case FBIOGET_VSCREENINFO:
-                ret = copy_to_user(argp, &info->var,
-                                    sizeof(var)) ? -EFAULT : 0;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                var = info->var;
+                unlock_fb_info(info);
+
+                ret = copy_to_user(argp, &var, sizeof(var)) ? -EFAULT : 0;
                 break;
         case FBIOPUT_VSCREENINFO:
-                if (copy_from_user(&var, argp, sizeof(var))) {
-                        ret =  -EFAULT;
-                        break;
-                }
+                if (copy_from_user(&var, argp, sizeof(var)))
+                        return -EFAULT;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                 acquire_console_sem();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_set_var(info, &var);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
                 release_console_sem();
-                if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
+                unlock_fb_info(info);
+                if (!ret && copy_to_user(argp, &var, sizeof(var)))
                         ret = -EFAULT;
                 break;
         case FBIOGET_FSCREENINFO:
-                ret = copy_to_user(argp, &info->fix,
-                                    sizeof(fix)) ? -EFAULT : 0;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                fix = info->fix;
+                unlock_fb_info(info);
+
+                ret = copy_to_user(argp, &fix, sizeof(fix)) ? -EFAULT : 0;
                 break;
         case FBIOPUTCMAP:
                 if (copy_from_user(&cmap, argp, sizeof(cmap)))
-                        ret = -EFAULT;
-                else
-                        ret = fb_set_user_cmap(&cmap, info);
+                        return -EFAULT;
+                ret = fb_set_user_cmap(&cmap, info);
                 break;
         case FBIOGETCMAP:
                 if (copy_from_user(&cmap, argp, sizeof(cmap)))
-                        ret = -EFAULT;
-                else
-                        ret = fb_cmap_to_user(&info->cmap, &cmap);
+                        return -EFAULT;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                cmap_from = info->cmap;
+                unlock_fb_info(info);
+                ret = fb_cmap_to_user(&cmap_from, &cmap);
                 break;
         case FBIOPAN_DISPLAY:
-                if (copy_from_user(&var, argp, sizeof(var))) {
-                        ret = -EFAULT;
-                        break;
-                }
+                if (copy_from_user(&var, argp, sizeof(var)))
+                        return -EFAULT;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                 acquire_console_sem();
                 ret = fb_pan_display(info, &var);
                 release_console_sem();
+                unlock_fb_info(info);
                 if (ret == 0 && copy_to_user(argp, &var, sizeof(var)))
-                        ret = -EFAULT;
+                        return -EFAULT;
                 break;
         case FBIO_CURSOR:
                 ret = -EINVAL;
                 break;
         case FBIOGET_CON2FBMAP:
                 if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
-                        ret = -EFAULT;
-                else if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
-                        ret = -EINVAL;
-                else {
-                        con2fb.framebuffer = -1;
-                        event.info = info;
-                        event.data = &con2fb;
-                        fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP,
-                                                                &event);
-                        ret = copy_to_user(argp, &con2fb,
-                                    sizeof(con2fb)) ? -EFAULT : 0;
-                }
+                        return -EFAULT;
+                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+                        return -EINVAL;
+                con2fb.framebuffer = -1;
+                event.data = &con2fb;
+
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                event.info = info;
+                fb_notifier_call_chain(FB_EVENT_GET_CONSOLE_MAP, &event);
+                unlock_fb_info(info);
+
+                ret = copy_to_user(argp, &con2fb, sizeof(con2fb)) ? -EFAULT : 0;
                 break;
         case FBIOPUT_CON2FBMAP:
-                if (copy_from_user(&con2fb, argp, sizeof(con2fb))) {
-                        ret = -EFAULT;
-                        break;
-                }
-                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES) {
-                        ret = -EINVAL;
-                        break;
-                }
-                if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX) {
-                        ret = -EINVAL;
-                        break;
-                }
+                if (copy_from_user(&con2fb, argp, sizeof(con2fb)))
+                        return -EFAULT;
+                if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
+                        return -EINVAL;
+                if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
+                        return -EINVAL;
                 if (!registered_fb[con2fb.framebuffer])
                         request_module("fb%d", con2fb.framebuffer);
                 if (!registered_fb[con2fb.framebuffer]) {
                         ret = -EINVAL;
                         break;
                 }
-                event.info = info;
                 event.data = &con2fb;
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                event.info = info;
                 ret = fb_notifier_call_chain(FB_EVENT_SET_CONSOLE_MAP,
                                               &event);
+                unlock_fb_info(info);
                 break;
         case FBIOBLANK:
+                if (!lock_fb_info(info))
+                        return -ENODEV;
                 acquire_console_sem();
                 info->flags |= FBINFO_MISC_USEREVENT;
                 ret = fb_blank(info, arg);
                 info->flags &= ~FBINFO_MISC_USEREVENT;
                 release_console_sem();
-                break;;
+                unlock_fb_info(info);
+                break;
         default:
-                if (fb->fb_ioctl == NULL)
-                        ret = -ENOTTY;
-                else
+                if (!lock_fb_info(info))
+                        return -ENODEV;
+                fb = info->fbops;
+                if (fb->fb_ioctl)
                         ret = fb->fb_ioctl(info, cmd, arg);
+                else
+                        ret = -ENOTTY;
+                unlock_fb_info(info);
         }
         return ret;
 }
 
 static long fb_ioctl(struct file *file, unsigned int cmd, unsigned long arg)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
         struct inode *inode = file->f_path.dentry->d_inode;
         int fbidx = iminor(inode);
-        struct fb_info *info;
-        long ret;
+        struct fb_info *info = registered_fb[fbidx];
 
-        info = registered_fb[fbidx];
-        mutex_lock(&info->lock);
-        ret = do_fb_ioctl(info, cmd, arg);
-        mutex_unlock(&info->lock);
-        return ret;
+        return do_fb_ioctl(info, cmd, arg);
 }
 
 #ifdef CONFIG_COMPAT
@@ -1257,8 +1264,6 @@ static int fb_get_fscreeninfo(struct fb_info *info, unsigned int cmd,
 
 static long fb_compat_ioctl(struct file *file, unsigned int cmd,
                             unsigned long arg)
-__acquires(&info->lock)
-__releases(&info->lock)
 {
         struct inode *inode = file->f_path.dentry->d_inode;
         int fbidx = iminor(inode);
@@ -1266,7 +1271,6 @@ __releases(&info->lock)
         struct fb_ops *fb = info->fbops;
         long ret = -ENOIOCTLCMD;
 
-        mutex_lock(&info->lock);
         switch(cmd) {
         case FBIOGET_VSCREENINFO:
         case FBIOPUT_VSCREENINFO:
@@ -1292,7 +1296,6 @@ __releases(&info->lock)
                         ret = fb->fb_compat_ioctl(info, cmd, arg);
                 break;
         }
-        mutex_unlock(&info->lock);
         return ret;
 }
 #endif
diff --git a/drivers/video/geode/gx1fb_core.c b/drivers/video/geode/gx1fb_core.c
index 751e491ca8c..f20eff8c4a8 100644
--- a/drivers/video/geode/gx1fb_core.c
+++ b/drivers/video/geode/gx1fb_core.c
@@ -136,13 +136,10 @@ static int gx1fb_set_par(struct fb_info *info)
 {
         struct geodefb_par *par = info->par;
 
-        if (info->var.bits_per_pixel == 16) {
+        if (info->var.bits_per_pixel == 16)
                 info->fix.visual = FB_VISUAL_TRUECOLOR;
-                fb_dealloc_cmap(&info->cmap);
-        } else {
+        else
                 info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
-        }
 
         info->fix.line_length = gx1_line_delta(info->var.xres, info->var.bits_per_pixel);
 
@@ -315,6 +312,10 @@ static struct fb_info * __init gx1fb_init_fbinfo(struct device *dev)
         if (!par->panel_x)
                 par->enable_crt = 1; /* fall back to CRT if no panel is specified */
 
+        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+                framebuffer_release(info);
+                return NULL;
+        }
         return info;
 }
 
@@ -374,8 +375,11 @@ static int __init gx1fb_probe(struct pci_dev *pdev, const struct pci_device_id *
                 release_mem_region(gx1_gx_base() + 0x8300, 0x100);
         }
 
-        if (info)
+        if (info) {
+                fb_dealloc_cmap(&info->cmap);
                 framebuffer_release(info);
+        }
+
         return ret;
 }
 
@@ -395,6 +399,7 @@ static void gx1fb_remove(struct pci_dev *pdev)
         iounmap(par->dc_regs);
         release_mem_region(gx1_gx_base() + 0x8300, 0x100);
 
+        fb_dealloc_cmap(&info->cmap);
         pci_set_drvdata(pdev, NULL);
 
         framebuffer_release(info);
diff --git a/drivers/video/geode/gxfb_core.c b/drivers/video/geode/gxfb_core.c
index 48411892631..2552cac39e1 100644
--- a/drivers/video/geode/gxfb_core.c
+++ b/drivers/video/geode/gxfb_core.c
@@ -171,13 +171,10 @@ static int gxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 
 static int gxfb_set_par(struct fb_info *info)
 {
-        if (info->var.bits_per_pixel > 8) {
+        if (info->var.bits_per_pixel > 8)
                 info->fix.visual = FB_VISUAL_TRUECOLOR;
-                fb_dealloc_cmap(&info->cmap);
-        } else {
+        else
                 info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
-        }
 
         info->fix.line_length = gx_line_delta(info->var.xres, info->var.bits_per_pixel);
 
@@ -331,6 +328,11 @@ static struct fb_info * __init gxfb_init_fbinfo(struct device *dev)
 
         info->var.grayscale     = 0;
 
+        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+                framebuffer_release(info);
+                return NULL;
+        }
+
         return info;
 }
 
@@ -443,8 +445,10 @@ static int __init gxfb_probe(struct pci_dev *pdev, const struct pci_device_id *i
                 pci_release_region(pdev, 1);
         }
 
-        if (info)
+        if (info) {
+                fb_dealloc_cmap(&info->cmap);
                 framebuffer_release(info);
+        }
         return ret;
 }
 
@@ -467,6 +471,7 @@ static void gxfb_remove(struct pci_dev *pdev)
         iounmap(par->gp_regs);
         pci_release_region(pdev, 1);
 
+        fb_dealloc_cmap(&info->cmap);
         pci_set_drvdata(pdev, NULL);
 
         framebuffer_release(info);
diff --git a/drivers/video/geode/lxfb_core.c b/drivers/video/geode/lxfb_core.c
index b965ecdbc60..889cbe39e58 100644
--- a/drivers/video/geode/lxfb_core.c
+++ b/drivers/video/geode/lxfb_core.c
@@ -278,13 +278,10 @@ static int lxfb_check_var(struct fb_var_screeninfo *var, struct fb_info *info)
 
 static int lxfb_set_par(struct fb_info *info)
 {
-        if (info->var.bits_per_pixel > 8) {
+        if (info->var.bits_per_pixel > 8)
                 info->fix.visual = FB_VISUAL_TRUECOLOR;
-                fb_dealloc_cmap(&info->cmap);
-        } else {
+        else
                 info->fix.visual = FB_VISUAL_PSEUDOCOLOR;
-                fb_alloc_cmap(&info->cmap, 1<<info->var.bits_per_pixel, 0);
-        }
 
         info->fix.line_length = lx_get_pitch(info->var.xres,
                 info->var.bits_per_pixel);
@@ -451,6 +448,11 @@ static struct fb_info * __init lxfb_init_fbinfo(struct device *dev)
 
         info->pseudo_palette    = (void *)par + sizeof(struct lxfb_par);
 
+        if (fb_alloc_cmap(&info->cmap, 256, 0) < 0) {
+                framebuffer_release(info);
+                return NULL;
+        }
+
         info->var.grayscale     = 0;
 
         return info;
@@ -579,8 +581,10 @@ err:
                 pci_release_region(pdev, 3);
         }
 
-        if (info)
+        if (info) {
+                fb_dealloc_cmap(&info->cmap);
                 framebuffer_release(info);
+        }
 
         return ret;
 }
@@ -604,6 +608,7 @@ static void lxfb_remove(struct pci_dev *pdev)
         iounmap(par->vp_regs);
         pci_release_region(pdev, 3);
 
+        fb_dealloc_cmap(&info->cmap);
         pci_set_drvdata(pdev, NULL);
         framebuffer_release(info);
 }
diff --git a/drivers/virtio/virtio_pci.c b/drivers/virtio/virtio_pci.c
index bef6b45e8a5..330aacbdec1 100644
--- a/drivers/virtio/virtio_pci.c
+++ b/drivers/virtio/virtio_pci.c
@@ -192,7 +192,7 @@ static irqreturn_t vp_interrupt(int irq, void *opaque)
                 drv = container_of(vp_dev->vdev.dev.driver,
                                    struct virtio_driver, driver);
 
-                if (drv->config_changed)
+                if (drv && drv->config_changed)
                         drv->config_changed(&vp_dev->vdev);
         }
 
diff --git a/drivers/w1/slaves/w1_therm.c b/drivers/w1/slaves/w1_therm.c
index 2c8dff9f77d..1ed3d554e37 100644
--- a/drivers/w1/slaves/w1_therm.c
+++ b/drivers/w1/slaves/w1_therm.c
@@ -115,7 +115,7 @@ static struct w1_therm_family_converter w1_therm_families[] = {
 
 static inline int w1_DS18B20_convert_temp(u8 rom[9])
 {
-        s16 t = (rom[1] << 8) | rom[0];
+        int t = ((s16)rom[1] << 8) | rom[0];
         t = t*1000/16;
         return t;
 }
diff --git a/drivers/watchdog/rdc321x_wdt.c b/drivers/watchdog/rdc321x_wdt.c
index bf92802f2bb..36e221beedc 100644
--- a/drivers/watchdog/rdc321x_wdt.c
+++ b/drivers/watchdog/rdc321x_wdt.c
@@ -37,7 +37,7 @@
 #include <linux/io.h>
 #include <linux/uaccess.h>
 
-#include <asm/mach-rdc321x/rdc321x_defs.h>
+#include <asm/rdc321x_defs.h>
 
 #define RDC_WDT_MASK    0x80000000 /* Mask */
 #define RDC_WDT_EN      0x00800000 /* Enable bit */
diff --git a/drivers/xen/balloon.c b/drivers/xen/balloon.c
index 2ba8f95516a..efa4b363ce7 100644
--- a/drivers/xen/balloon.c
+++ b/drivers/xen/balloon.c
@@ -498,7 +498,7 @@ static ssize_t store_target_kb(struct sys_device *dev,
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
-        target_bytes = memparse(buf, &endchar);
+        target_bytes = simple_strtoull(buf, &endchar, 0) * 1024;
 
         balloon_set_new_target(target_bytes >> PAGE_SHIFT);
 
@@ -508,8 +508,39 @@ static ssize_t store_target_kb(struct sys_device *dev,
 static SYSDEV_ATTR(target_kb, S_IRUGO | S_IWUSR,
                    show_target_kb, store_target_kb);
 
+
+static ssize_t show_target(struct sys_device *dev, struct sysdev_attribute *attr,
+                              char *buf)
+{
+        return sprintf(buf, "%llu\n",
+                       (u64)balloon_stats.target_pages << PAGE_SHIFT);
+}
+
+static ssize_t store_target(struct sys_device *dev,
+                            struct sysdev_attribute *attr,
+                            const char *buf,
+                            size_t count)
+{
+        char *endchar;
+        unsigned long long target_bytes;
+
+        if (!capable(CAP_SYS_ADMIN))
+                return -EPERM;
+
+        target_bytes = memparse(buf, &endchar);
+
+        balloon_set_new_target(target_bytes >> PAGE_SHIFT);
+
+        return count;
+}
+
+static SYSDEV_ATTR(target, S_IRUGO | S_IWUSR,
+                   show_target, store_target);
+
+
 static struct sysdev_attribute *balloon_attrs[] = {
         &attr_target_kb,
+        &attr_target,
 };
 
 static struct attribute *balloon_info_attrs[] = {
diff --git a/drivers/xen/events.c b/drivers/xen/events.c
index eb0dfdeaa94..30963af5dba 100644
--- a/drivers/xen/events.c
+++ b/drivers/xen/events.c
@@ -26,9 +26,11 @@
 #include <linux/irq.h>
 #include <linux/module.h>
 #include <linux/string.h>
+#include <linux/bootmem.h>
 
 #include <asm/ptrace.h>
 #include <asm/irq.h>
+#include <asm/idle.h>
 #include <asm/sync_bitops.h>
 #include <asm/xen/hypercall.h>
 #include <asm/xen/hypervisor.h>
@@ -50,36 +52,55 @@ static DEFINE_PER_CPU(int, virq_to_irq[NR_VIRQS]) = {[0 ... NR_VIRQS-1] = -1};
 /* IRQ <-> IPI mapping */
 static DEFINE_PER_CPU(int, ipi_to_irq[XEN_NR_IPIS]) = {[0 ... XEN_NR_IPIS-1] = -1};
 
-/* Packed IRQ information: binding type, sub-type index, and event channel. */
-struct packed_irq
-{
-        unsigned short evtchn;
-        unsigned char index;
-        unsigned char type;
-};
-
-static struct packed_irq irq_info[NR_IRQS];
-
-/* Binding types. */
-enum {
-        IRQT_UNBOUND,
+/* Interrupt types. */
+enum xen_irq_type {
+        IRQT_UNBOUND = 0,
         IRQT_PIRQ,
         IRQT_VIRQ,
         IRQT_IPI,
         IRQT_EVTCHN
 };
 
-/* Convenient shorthand for packed representation of an unbound IRQ. */
-#define IRQ_UNBOUND     mk_irq_info(IRQT_UNBOUND, 0, 0)
+/*
+ * Packed IRQ information:
+ * type - enum xen_irq_type
+ * event channel - irq->event channel mapping
+ * cpu - cpu this event channel is bound to
+ * index - type-specific information:
+ *    PIRQ - vector, with MSB being "needs EIO"
+ *    VIRQ - virq number
+ *    IPI - IPI vector
+ *    EVTCHN -
+ */
+struct irq_info
+{
+        enum xen_irq_type type; /* type */
+        unsigned short evtchn;  /* event channel */
+        unsigned short cpu;     /* cpu bound */
+
+        union {
+                unsigned short virq;
+                enum ipi_vector ipi;
+                struct {
+                        unsigned short gsi;
+                        unsigned short vector;
+                } pirq;
+        } u;
+};
+
+static struct irq_info irq_info[NR_IRQS];
 
 static int evtchn_to_irq[NR_EVENT_CHANNELS] = {
         [0 ... NR_EVENT_CHANNELS-1] = -1
 };
-static unsigned long cpu_evtchn_mask[NR_CPUS][NR_EVENT_CHANNELS/BITS_PER_LONG];
-static u8 cpu_evtchn[NR_EVENT_CHANNELS];
-
-/* Reference counts for bindings to IRQs. */
-static int irq_bindcount[NR_IRQS];
+struct cpu_evtchn_s {
+        unsigned long bits[NR_EVENT_CHANNELS/BITS_PER_LONG];
+};
+static struct cpu_evtchn_s *cpu_evtchn_mask_p;
+static inline unsigned long *cpu_evtchn_mask(int cpu)
+{
+        return cpu_evtchn_mask_p[cpu].bits;
+}
 
 /* Xen will never allocate port zero for any purpose. */
 #define VALID_EVTCHN(chn)       ((chn) != 0)
@@ -87,27 +108,108 @@ static int irq_bindcount[NR_IRQS];
 static struct irq_chip xen_dynamic_chip;
 
 /* Constructor for packed IRQ information. */
-static inline struct packed_irq mk_irq_info(u32 type, u32 index, u32 evtchn)
+static struct irq_info mk_unbound_info(void)
+{
+        return (struct irq_info) { .type = IRQT_UNBOUND };
+}
+
+static struct irq_info mk_evtchn_info(unsigned short evtchn)
+{
+        return (struct irq_info) { .type = IRQT_EVTCHN, .evtchn = evtchn,
+                        .cpu = 0 };
+}
+
+static struct irq_info mk_ipi_info(unsigned short evtchn, enum ipi_vector ipi)
 {
-        return (struct packed_irq) { evtchn, index, type };
+        return (struct irq_info) { .type = IRQT_IPI, .evtchn = evtchn,
+                        .cpu = 0, .u.ipi = ipi };
+}
+
+static struct irq_info mk_virq_info(unsigned short evtchn, unsigned short virq)
+{
+        return (struct irq_info) { .type = IRQT_VIRQ, .evtchn = evtchn,
+                        .cpu = 0, .u.virq = virq };
+}
+
+static struct irq_info mk_pirq_info(unsigned short evtchn,
+                                    unsigned short gsi, unsigned short vector)
+{
+        return (struct irq_info) { .type = IRQT_PIRQ, .evtchn = evtchn,
+                        .cpu = 0, .u.pirq = { .gsi = gsi, .vector = vector } };
 }
 
 /*
  * Accessors for packed IRQ information.
  */
-static inline unsigned int evtchn_from_irq(int irq)
+static struct irq_info *info_for_irq(unsigned irq)
+{
+        return &irq_info[irq];
+}
+
+static unsigned int evtchn_from_irq(unsigned irq)
 {
-        return irq_info[irq].evtchn;
+        return info_for_irq(irq)->evtchn;
 }
 
-static inline unsigned int index_from_irq(int irq)
+static enum ipi_vector ipi_from_irq(unsigned irq)
 {
-        return irq_info[irq].index;
+        struct irq_info *info = info_for_irq(irq);
+
+        BUG_ON(info == NULL);
+        BUG_ON(info->type != IRQT_IPI);
+
+        return info->u.ipi;
 }
 
-static inline unsigned int type_from_irq(int irq)
+static unsigned virq_from_irq(unsigned irq)
 {
-        return irq_info[irq].type;
+        struct irq_info *info = info_for_irq(irq);
+
+        BUG_ON(info == NULL);
+        BUG_ON(info->type != IRQT_VIRQ);
+
+        return info->u.virq;
+}
+
+static unsigned gsi_from_irq(unsigned irq)
+{
+        struct irq_info *info = info_for_irq(irq);
+
+        BUG_ON(info == NULL);
+        BUG_ON(info->type != IRQT_PIRQ);
+
+        return info->u.pirq.gsi;
+}
+
+static unsigned vector_from_irq(unsigned irq)
+{
+        struct irq_info *info = info_for_irq(irq);
+
+        BUG_ON(info == NULL);
+        BUG_ON(info->type != IRQT_PIRQ);
+
+        return info->u.pirq.vector;
+}
+
+static enum xen_irq_type type_from_irq(unsigned irq)
+{
+        return info_for_irq(irq)->type;
+}
+
+static unsigned cpu_from_irq(unsigned irq)
+{
+        return info_for_irq(irq)->cpu;
+}
+
+static unsigned int cpu_from_evtchn(unsigned int evtchn)
+{
+        int irq = evtchn_to_irq[evtchn];
+        unsigned ret = 0;
+
+        if (irq != -1)
+                ret = cpu_from_irq(irq);
+
+        return ret;
 }
 
 static inline unsigned long active_evtchns(unsigned int cpu,
@@ -115,7 +217,7 @@ static inline unsigned long active_evtchns(unsigned int cpu,
                                            unsigned int idx)
 {
         return (sh->evtchn_pending[idx] &
-                cpu_evtchn_mask[cpu][idx] &
+                cpu_evtchn_mask(cpu)[idx] &
                 ~sh->evtchn_mask[idx]);
 }
 
@@ -125,13 +227,13 @@ static void bind_evtchn_to_cpu(unsigned int chn, unsigned int cpu)
 
         BUG_ON(irq == -1);
 #ifdef CONFIG_SMP
-        irq_to_desc(irq)->affinity = cpumask_of_cpu(cpu);
+        cpumask_copy(irq_to_desc(irq)->affinity, cpumask_of(cpu));
 #endif
 
-        __clear_bit(chn, cpu_evtchn_mask[cpu_evtchn[chn]]);
-        __set_bit(chn, cpu_evtchn_mask[cpu]);
+        __clear_bit(chn, cpu_evtchn_mask(cpu_from_irq(irq)));
+        __set_bit(chn, cpu_evtchn_mask(cpu));
 
-        cpu_evtchn[chn] = cpu;
+        irq_info[irq].cpu = cpu;
 }
 
 static void init_evtchn_cpu_bindings(void)
@@ -142,17 +244,11 @@ static void init_evtchn_cpu_bindings(void)
 
         /* By default all event channels notify CPU#0. */
         for_each_irq_desc(i, desc) {
-                desc->affinity = cpumask_of_cpu(0);
+                cpumask_copy(desc->affinity, cpumask_of(0));
         }
 #endif
 
-        memset(cpu_evtchn, 0, sizeof(cpu_evtchn));
-        memset(cpu_evtchn_mask[0], ~0, sizeof(cpu_evtchn_mask[0]));
-}
-
-static inline unsigned int cpu_from_evtchn(unsigned int evtchn)
-{
-        return cpu_evtchn[evtchn];
+        memset(cpu_evtchn_mask(0), ~0, sizeof(cpu_evtchn_mask(0)));
 }
 
 static inline void clear_evtchn(int port)
@@ -232,9 +328,8 @@ static int find_unbound_irq(void)
         int irq;
         struct irq_desc *desc;
 
-        /* Only allocate from dynirq range */
         for (irq = 0; irq < nr_irqs; irq++)
-                if (irq_bindcount[irq] == 0)
+                if (irq_info[irq].type == IRQT_UNBOUND)
                         break;
 
         if (irq == nr_irqs)
@@ -244,6 +339,8 @@ static int find_unbound_irq(void)
         if (WARN_ON(desc == NULL))
                 return -1;
 
+        dynamic_irq_init(irq);
+
         return irq;
 }
 
@@ -258,16 +355,13 @@ int bind_evtchn_to_irq(unsigned int evtchn)
         if (irq == -1) {
                 irq = find_unbound_irq();
 
-                dynamic_irq_init(irq);
                 set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
                                               handle_level_irq, "event");
 
                 evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_irq_info(IRQT_EVTCHN, 0, evtchn);
+                irq_info[irq] = mk_evtchn_info(evtchn);
         }
 
-        irq_bindcount[irq]++;
-
         spin_unlock(&irq_mapping_update_lock);
 
         return irq;
@@ -282,12 +376,12 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
         spin_lock(&irq_mapping_update_lock);
 
         irq = per_cpu(ipi_to_irq, cpu)[ipi];
+
         if (irq == -1) {
                 irq = find_unbound_irq();
                 if (irq < 0)
                         goto out;
 
-                dynamic_irq_init(irq);
                 set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
                                               handle_level_irq, "ipi");
 
@@ -298,15 +392,12 @@ static int bind_ipi_to_irq(unsigned int ipi, unsigned int cpu)
                 evtchn = bind_ipi.port;
 
                 evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_irq_info(IRQT_IPI, ipi, evtchn);
-
+                irq_info[irq] = mk_ipi_info(evtchn, ipi);
                 per_cpu(ipi_to_irq, cpu)[ipi] = irq;
 
                 bind_evtchn_to_cpu(evtchn, cpu);
         }
 
-        irq_bindcount[irq]++;
-
  out:
         spin_unlock(&irq_mapping_update_lock);
         return irq;
@@ -332,20 +423,17 @@ static int bind_virq_to_irq(unsigned int virq, unsigned int cpu)
 
                 irq = find_unbound_irq();
 
-                dynamic_irq_init(irq);
                 set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
                                               handle_level_irq, "virq");
 
                 evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_irq_info(IRQT_VIRQ, virq, evtchn);
+                irq_info[irq] = mk_virq_info(evtchn, virq);
 
                 per_cpu(virq_to_irq, cpu)[virq] = irq;
 
                 bind_evtchn_to_cpu(evtchn, cpu);
         }
 
-        irq_bindcount[irq]++;
-
         spin_unlock(&irq_mapping_update_lock);
 
         return irq;
@@ -358,7 +446,7 @@ static void unbind_from_irq(unsigned int irq)
 
         spin_lock(&irq_mapping_update_lock);
 
-        if ((--irq_bindcount[irq] == 0) && VALID_EVTCHN(evtchn)) {
+        if (VALID_EVTCHN(evtchn)) {
                 close.port = evtchn;
                 if (HYPERVISOR_event_channel_op(EVTCHNOP_close, &close) != 0)
                         BUG();
@@ -366,11 +454,11 @@ static void unbind_from_irq(unsigned int irq)
                 switch (type_from_irq(irq)) {
                 case IRQT_VIRQ:
                         per_cpu(virq_to_irq, cpu_from_evtchn(evtchn))
-                                [index_from_irq(irq)] = -1;
+                                [virq_from_irq(irq)] = -1;
                         break;
                 case IRQT_IPI:
                         per_cpu(ipi_to_irq, cpu_from_evtchn(evtchn))
-                                [index_from_irq(irq)] = -1;
+                                [ipi_from_irq(irq)] = -1;
                         break;
                 default:
                         break;
@@ -380,7 +468,7 @@ static void unbind_from_irq(unsigned int irq)
                 bind_evtchn_to_cpu(evtchn, 0);
 
                 evtchn_to_irq[evtchn] = -1;
-                irq_info[irq] = IRQ_UNBOUND;
+                irq_info[irq] = mk_unbound_info();
 
                 dynamic_irq_cleanup(irq);
         }
@@ -498,8 +586,8 @@ irqreturn_t xen_debug_interrupt(int irq, void *dev_id)
         for(i = 0; i < NR_EVENT_CHANNELS; i++) {
                 if (sync_test_bit(i, sh->evtchn_pending)) {
                         printk("  %d: event %d -> irq %d\n",
-                                cpu_evtchn[i], i,
-                                evtchn_to_irq[i]);
+                               cpu_from_evtchn(i), i,
+                               evtchn_to_irq[i]);
                 }
         }
 
@@ -508,7 +596,6 @@ irqreturn_t xen_debug_interrupt(int irq, void *dev_id)
         return IRQ_HANDLED;
 }
 
-
 /*
  * Search the CPUs pending events bitmasks.  For each one found, map
  * the event number to an irq, and feed it into do_IRQ() for
@@ -521,11 +608,15 @@ irqreturn_t xen_debug_interrupt(int irq, void *dev_id)
 void xen_evtchn_do_upcall(struct pt_regs *regs)
 {
         int cpu = get_cpu();
+        struct pt_regs *old_regs = set_irq_regs(regs);
         struct shared_info *s = HYPERVISOR_shared_info;
         struct vcpu_info *vcpu_info = __get_cpu_var(xen_vcpu);
         static DEFINE_PER_CPU(unsigned, nesting_count);
         unsigned count;
 
+        exit_idle();
+        irq_enter();
+
         do {
                 unsigned long pending_words;
 
@@ -550,7 +641,7 @@ void xen_evtchn_do_upcall(struct pt_regs *regs)
                                 int irq = evtchn_to_irq[port];
 
                                 if (irq != -1)
-                                        xen_do_IRQ(irq, regs);
+                                        handle_irq(irq, regs);
                         }
                 }
 
@@ -561,12 +652,17 @@ void xen_evtchn_do_upcall(struct pt_regs *regs)
         } while(count != 1);
 
 out:
+        irq_exit();
+        set_irq_regs(old_regs);
+
         put_cpu();
 }
 
 /* Rebind a new event channel to an existing irq. */
 void rebind_evtchn_irq(int evtchn, int irq)
 {
+        struct irq_info *info = info_for_irq(irq);
+
         /* Make sure the irq is masked, since the new event channel
            will also be masked. */
         disable_irq(irq);
@@ -576,11 +672,11 @@ void rebind_evtchn_irq(int evtchn, int irq)
         /* After resume the irq<->evtchn mappings are all cleared out */
         BUG_ON(evtchn_to_irq[evtchn] != -1);
         /* Expect irq to have been bound before,
-           so the bindcount should be non-0 */
-        BUG_ON(irq_bindcount[irq] == 0);
+           so there should be a proper type */
+        BUG_ON(info->type == IRQT_UNBOUND);
 
         evtchn_to_irq[evtchn] = irq;
-        irq_info[irq] = mk_irq_info(IRQT_EVTCHN, 0, evtchn);
+        irq_info[irq] = mk_evtchn_info(evtchn);
 
         spin_unlock(&irq_mapping_update_lock);
 
@@ -690,8 +786,7 @@ static void restore_cpu_virqs(unsigned int cpu)
                 if ((irq = per_cpu(virq_to_irq, cpu)[virq]) == -1)
                         continue;
 
-                BUG_ON(irq_info[irq].type != IRQT_VIRQ);
-                BUG_ON(irq_info[irq].index != virq);
+                BUG_ON(virq_from_irq(irq) != virq);
 
                 /* Get a new binding from Xen. */
                 bind_virq.virq = virq;
@@ -703,7 +798,7 @@ static void restore_cpu_virqs(unsigned int cpu)
 
                 /* Record the new mapping. */
                 evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_irq_info(IRQT_VIRQ, virq, evtchn);
+                irq_info[irq] = mk_virq_info(evtchn, virq);
                 bind_evtchn_to_cpu(evtchn, cpu);
 
                 /* Ready for use. */
@@ -720,8 +815,7 @@ static void restore_cpu_ipis(unsigned int cpu)
                 if ((irq = per_cpu(ipi_to_irq, cpu)[ipi]) == -1)
                         continue;
 
-                BUG_ON(irq_info[irq].type != IRQT_IPI);
-                BUG_ON(irq_info[irq].index != ipi);
+                BUG_ON(ipi_from_irq(irq) != ipi);
 
                 /* Get a new binding from Xen. */
                 bind_ipi.vcpu = cpu;
@@ -732,7 +826,7 @@ static void restore_cpu_ipis(unsigned int cpu)
 
                 /* Record the new mapping. */
                 evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_irq_info(IRQT_IPI, ipi, evtchn);
+                irq_info[irq] = mk_ipi_info(evtchn, ipi);
                 bind_evtchn_to_cpu(evtchn, cpu);
 
                 /* Ready for use. */
@@ -812,8 +906,11 @@ void xen_irq_resume(void)
 
 static struct irq_chip xen_dynamic_chip __read_mostly = {
         .name           = "xen-dyn",
+
+        .disable        = disable_dynirq,
         .mask           = disable_dynirq,
         .unmask         = enable_dynirq,
+
         .ack            = ack_dynirq,
         .set_affinity   = set_affinity_irq,
         .retrigger      = retrigger_dynirq,
@@ -822,6 +919,10 @@ static struct irq_chip xen_dynamic_chip __read_mostly = {
 void __init xen_init_IRQ(void)
 {
         int i;
+        size_t size = nr_cpu_ids * sizeof(struct cpu_evtchn_s);
+
+        cpu_evtchn_mask_p = alloc_bootmem(size);
+        BUG_ON(cpu_evtchn_mask_p == NULL);
 
         init_evtchn_cpu_bindings();
 
@@ -829,9 +930,5 @@ void __init xen_init_IRQ(void)
         for (i = 0; i < NR_EVENT_CHANNELS; i++)
                 mask_evtchn(i);
 
-        /* Dynamic IRQ space is currently unbound. Zero the refcnts. */
-        for (i = 0; i < nr_irqs; i++)
-                irq_bindcount[i] = 0;
-
         irq_ctx_init(smp_processor_id());
 }
diff --git a/drivers/xen/manage.c b/drivers/xen/manage.c
index 9b91617b958..e7e83b65c18 100644
--- a/drivers/xen/manage.c
+++ b/drivers/xen/manage.c
@@ -100,7 +100,7 @@ static void do_suspend(void)
         /* XXX use normal device tree? */
         xenbus_suspend();
 
-        err = stop_machine(xen_suspend, &cancelled, &cpumask_of_cpu(0));
+        err = stop_machine(xen_suspend, &cancelled, cpumask_of(0));
         if (err) {
                 printk(KERN_ERR "failed to start xen_suspend: %d\n", err);
                 goto out;
diff --git a/fs/binfmt_elf.c b/fs/binfmt_elf.c
index e3ff2b9e602..33b7235f853 100644
--- a/fs/binfmt_elf.c
+++ b/fs/binfmt_elf.c
@@ -1208,9 +1208,11 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
          * check for an ELF header.  If we find one, dump the first page to
          * aid in determining what was mapped here.
          */
-        if (FILTER(ELF_HEADERS) && vma->vm_file != NULL && vma->vm_pgoff == 0) {
+        if (FILTER(ELF_HEADERS) &&
+            vma->vm_pgoff == 0 && (vma->vm_flags & VM_READ)) {
                 u32 __user *header = (u32 __user *) vma->vm_start;
                 u32 word;
+                mm_segment_t fs = get_fs();
                 /*
                  * Doing it this way gets the constant folded by GCC.
                  */
@@ -1223,7 +1225,15 @@ static unsigned long vma_dump_size(struct vm_area_struct *vma,
                 magic.elfmag[EI_MAG1] = ELFMAG1;
                 magic.elfmag[EI_MAG2] = ELFMAG2;
                 magic.elfmag[EI_MAG3] = ELFMAG3;
-                if (get_user(word, header) == 0 && word == magic.cmp)
+                /*
+                 * Switch to the user "segment" for get_user(),
+                 * then put back what elf_core_dump() had in place.
+                 */
+                set_fs(USER_DS);
+                if (unlikely(get_user(word, header)))
+                        word = 0;
+                set_fs(fs);
+                if (word == magic.cmp)
                         return PAGE_SIZE;
         }
 
diff --git a/fs/bio-integrity.c b/fs/bio-integrity.c
index 77ebc3c263d..549b0144da1 100644
--- a/fs/bio-integrity.c
+++ b/fs/bio-integrity.c
@@ -140,7 +140,6 @@ int bio_integrity_add_page(struct bio *bio, struct page *page,
 
         iv = bip_vec_idx(bip, bip->bip_vcnt);
         BUG_ON(iv == NULL);
-        BUG_ON(iv->bv_page != NULL);
 
         iv->bv_page = page;
         iv->bv_len = len;
@@ -465,7 +464,7 @@ static int bio_integrity_verify(struct bio *bio)
 
                 if (ret) {
                         kunmap_atomic(kaddr, KM_USER0);
-                        break;
+                        return ret;
                 }
 
                 sectors = bv->bv_len / bi->sector_size;
@@ -493,18 +492,13 @@ static void bio_integrity_verify_fn(struct work_struct *work)
         struct bio_integrity_payload *bip =
                 container_of(work, struct bio_integrity_payload, bip_work);
         struct bio *bio = bip->bip_bio;
-        int error = bip->bip_error;
+        int error;
 
-        if (bio_integrity_verify(bio)) {
-                clear_bit(BIO_UPTODATE, &bio->bi_flags);
-                error = -EIO;
-        }
+        error = bio_integrity_verify(bio);
 
         /* Restore original bio completion handler */
         bio->bi_end_io = bip->bip_end_io;
-
-        if (bio->bi_end_io)
-                bio->bi_end_io(bio, error);
+        bio_endio(bio, error);
 }
 
 /**
@@ -525,7 +519,17 @@ void bio_integrity_endio(struct bio *bio, int error)
 
         BUG_ON(bip->bip_bio != bio);
 
-        bip->bip_error = error;
+        /* In case of an I/O error there is no point in verifying the
+         * integrity metadata.  Restore original bio end_io handler
+         * and run it.
+         */
+        if (error) {
+                bio->bi_end_io = bip->bip_end_io;
+                bio_endio(bio, error);
+
+                return;
+        }
+
         INIT_WORK(&bip->bip_work, bio_integrity_verify_fn);
         queue_work(kintegrityd_wq, &bip->bip_work);
 }
diff --git a/fs/btrfs/Kconfig b/fs/btrfs/Kconfig
index f8fcf999ea1..7bb3c020e57 100644
--- a/fs/btrfs/Kconfig
+++ b/fs/btrfs/Kconfig
@@ -16,3 +16,16 @@ config BTRFS_FS
           module will be called btrfs.
 
           If unsure, say N.
+
+config BTRFS_FS_POSIX_ACL
+        bool "Btrfs POSIX Access Control Lists"
+        depends on BTRFS_FS
+        select FS_POSIX_ACL
+        help
+          POSIX Access Control Lists (ACLs) support permissions for users and
+          groups beyond the owner/group/world scheme.
+
+          To learn more about Access Control Lists, visit the POSIX ACLs for
+          Linux website <http://acl.bestbits.at/>.
+
+          If you don't know what Access Control Lists are, say N
diff --git a/fs/btrfs/async-thread.c b/fs/btrfs/async-thread.c
index 8e2fec05dbe..c84ca1f5259 100644
--- a/fs/btrfs/async-thread.c
+++ b/fs/btrfs/async-thread.c
@@ -16,11 +16,11 @@
  * Boston, MA 021110-1307, USA.
  */
 
-#include <linux/version.h>
 #include <linux/kthread.h>
 #include <linux/list.h>
 #include <linux/spinlock.h>
-# include <linux/freezer.h>
+#include <linux/freezer.h>
+#include <linux/ftrace.h>
 #include "async-thread.h"
 
 #define WORK_QUEUED_BIT 0
@@ -143,6 +143,7 @@ static int worker_loop(void *arg)
         struct btrfs_work *work;
         do {
                 spin_lock_irq(&worker->lock);
+again_locked:
                 while (!list_empty(&worker->pending)) {
                         cur = worker->pending.next;
                         work = list_entry(cur, struct btrfs_work, list);
@@ -165,14 +166,50 @@ static int worker_loop(void *arg)
                         check_idle_worker(worker);
 
                 }
-                worker->working = 0;
                 if (freezing(current)) {
+                        worker->working = 0;
+                        spin_unlock_irq(&worker->lock);
                         refrigerator();
                 } else {
-                        set_current_state(TASK_INTERRUPTIBLE);
                         spin_unlock_irq(&worker->lock);
-                        if (!kthread_should_stop())
+                        if (!kthread_should_stop()) {
+                                cpu_relax();
+                                /*
+                                 * we've dropped the lock, did someone else
+                                 * jump_in?
+                                 */
+                                smp_mb();
+                                if (!list_empty(&worker->pending))
+                                        continue;
+
+                                /*
+                                 * this short schedule allows more work to
+                                 * come in without the queue functions
+                                 * needing to go through wake_up_process()
+                                 *
+                                 * worker->working is still 1, so nobody
+                                 * is going to try and wake us up
+                                 */
+                                schedule_timeout(1);
+                                smp_mb();
+                                if (!list_empty(&worker->pending))
+                                        continue;
+
+                                /* still no more work?, sleep for real */
+                                spin_lock_irq(&worker->lock);
+                                set_current_state(TASK_INTERRUPTIBLE);
+                                if (!list_empty(&worker->pending))
+                                        goto again_locked;
+
+                                /*
+                                 * this makes sure we get a wakeup when someone
+                                 * adds something new to the queue
+                                 */
+                                worker->working = 0;
+                                spin_unlock_irq(&worker->lock);
+
                                 schedule();
+                        }
                         __set_current_state(TASK_RUNNING);
                 }
         } while (!kthread_should_stop());
@@ -350,13 +387,14 @@ int btrfs_requeue_work(struct btrfs_work *work)
 {
         struct btrfs_worker_thread *worker = work->worker;
         unsigned long flags;
+        int wake = 0;
 
         if (test_and_set_bit(WORK_QUEUED_BIT, &work->flags))
                 goto out;
 
         spin_lock_irqsave(&worker->lock, flags);
-        atomic_inc(&worker->num_pending);
         list_add_tail(&work->list, &worker->pending);
+        atomic_inc(&worker->num_pending);
 
         /* by definition we're busy, take ourselves off the idle
          * list
@@ -368,10 +406,16 @@ int btrfs_requeue_work(struct btrfs_work *work)
                                &worker->workers->worker_list);
                 spin_unlock_irqrestore(&worker->workers->lock, flags);
         }
+        if (!worker->working) {
+                wake = 1;
+                worker->working = 1;
+        }
 
         spin_unlock_irqrestore(&worker->lock, flags);
-
+        if (wake)
+                wake_up_process(worker->task);
 out:
+
         return 0;
 }
 
@@ -398,9 +442,10 @@ int btrfs_queue_worker(struct btrfs_workers *workers, struct btrfs_work *work)
         }
 
         spin_lock_irqsave(&worker->lock, flags);
+
+        list_add_tail(&work->list, &worker->pending);
         atomic_inc(&worker->num_pending);
         check_busy_worker(worker);
-        list_add_tail(&work->list, &worker->pending);
 
         /*
          * avoid calling into wake_up_process if this thread has already
diff --git a/fs/btrfs/compression.c b/fs/btrfs/compression.c
index ee848d8585d..ab07627084f 100644
--- a/fs/btrfs/compression.c
+++ b/fs/btrfs/compression.c
@@ -32,7 +32,6 @@
 #include <linux/swap.h>
 #include <linux/writeback.h>
 #include <linux/bit_spinlock.h>
-#include <linux/version.h>
 #include <linux/pagevec.h>
 #include "compat.h"
 #include "ctree.h"
diff --git a/fs/btrfs/ctree.c b/fs/btrfs/ctree.c
index 9e46c077681..35443cc4b9a 100644
--- a/fs/btrfs/ctree.c
+++ b/fs/btrfs/ctree.c
@@ -54,6 +54,31 @@ struct btrfs_path *btrfs_alloc_path(void)
         return path;
 }
 
+/*
+ * set all locked nodes in the path to blocking locks.  This should
+ * be done before scheduling
+ */
+noinline void btrfs_set_path_blocking(struct btrfs_path *p)
+{
+        int i;
+        for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
+                if (p->nodes[i] && p->locks[i])
+                        btrfs_set_lock_blocking(p->nodes[i]);
+        }
+}
+
+/*
+ * reset all the locked nodes in the patch to spinning locks.
+ */
+noinline void btrfs_clear_path_blocking(struct btrfs_path *p)
+{
+        int i;
+        for (i = 0; i < BTRFS_MAX_LEVEL; i++) {
+                if (p->nodes[i] && p->locks[i])
+                        btrfs_clear_lock_blocking(p->nodes[i]);
+        }
+}
+
 /* this also releases the path */
 void btrfs_free_path(struct btrfs_path *p)
 {
@@ -272,6 +297,8 @@ static noinline int __btrfs_cow_block(struct btrfs_trans_handle *trans,
         if (IS_ERR(cow))
                 return PTR_ERR(cow);
 
+        /* cow is set to blocking by btrfs_init_new_buffer */
+
         copy_extent_buffer(cow, buf, 0, 0, cow->len);
         btrfs_set_header_bytenr(cow, cow->start);
         btrfs_set_header_generation(cow, trans->transid);
@@ -388,17 +415,20 @@ noinline int btrfs_cow_block(struct btrfs_trans_handle *trans,
                 WARN_ON(1);
         }
 
-        spin_lock(&root->fs_info->hash_lock);
         if (btrfs_header_generation(buf) == trans->transid &&
             btrfs_header_owner(buf) == root->root_key.objectid &&
             !btrfs_header_flag(buf, BTRFS_HEADER_FLAG_WRITTEN)) {
                 *cow_ret = buf;
-                spin_unlock(&root->fs_info->hash_lock);
                 WARN_ON(prealloc_dest);
                 return 0;
         }
-        spin_unlock(&root->fs_info->hash_lock);
+
         search_start = buf->start & ~((u64)(1024 * 1024 * 1024) - 1);
+
+        if (parent)
+                btrfs_set_lock_blocking(parent);
+        btrfs_set_lock_blocking(buf);
+
         ret = __btrfs_cow_block(trans, root, buf, parent,
                                  parent_slot, cow_ret, search_start, 0,
                                  prealloc_dest);
@@ -504,6 +534,8 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
         if (parent_nritems == 1)
                 return 0;
 
+        btrfs_set_lock_blocking(parent);
+
         for (i = start_slot; i < end_slot; i++) {
                 int close = 1;
 
@@ -564,6 +596,7 @@ int btrfs_realloc_node(struct btrfs_trans_handle *trans,
                         search_start = last_block;
 
                 btrfs_tree_lock(cur);
+                btrfs_set_lock_blocking(cur);
                 err = __btrfs_cow_block(trans, root, cur, parent, i,
                                         &cur, search_start,
                                         min(16 * blocksize,
@@ -862,6 +895,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 return 0;
 
         mid = path->nodes[level];
+
         WARN_ON(!path->locks[level]);
         WARN_ON(btrfs_header_generation(mid) != trans->transid);
 
@@ -884,6 +918,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
                 /* promote the child to a root */
                 child = read_node_slot(root, mid, 0);
                 btrfs_tree_lock(child);
+                btrfs_set_lock_blocking(child);
                 BUG_ON(!child);
                 ret = btrfs_cow_block(trans, root, child, mid, 0, &child, 0);
                 BUG_ON(ret);
@@ -900,6 +935,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
 
                 add_root_to_dirty_list(root);
                 btrfs_tree_unlock(child);
+
                 path->locks[level] = 0;
                 path->nodes[level] = NULL;
                 clean_tree_block(trans, root, mid);
@@ -924,6 +960,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
         left = read_node_slot(root, parent, pslot - 1);
         if (left) {
                 btrfs_tree_lock(left);
+                btrfs_set_lock_blocking(left);
                 wret = btrfs_cow_block(trans, root, left,
                                        parent, pslot - 1, &left, 0);
                 if (wret) {
@@ -934,6 +971,7 @@ static noinline int balance_level(struct btrfs_trans_handle *trans,
         right = read_node_slot(root, parent, pslot + 1);
         if (right) {
                 btrfs_tree_lock(right);
+                btrfs_set_lock_blocking(right);
                 wret = btrfs_cow_block(trans, root, right,
                                        parent, pslot + 1, &right, 0);
                 if (wret) {
@@ -1109,6 +1147,8 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans,
                 u32 left_nr;
 
                 btrfs_tree_lock(left);
+                btrfs_set_lock_blocking(left);
+
                 left_nr = btrfs_header_nritems(left);
                 if (left_nr >= BTRFS_NODEPTRS_PER_BLOCK(root) - 1) {
                         wret = 1;
@@ -1155,7 +1195,10 @@ static noinline int push_nodes_for_insert(struct btrfs_trans_handle *trans,
          */
         if (right) {
                 u32 right_nr;
+
                 btrfs_tree_lock(right);
+                btrfs_set_lock_blocking(right);
+
                 right_nr = btrfs_header_nritems(right);
                 if (right_nr >= BTRFS_NODEPTRS_PER_BLOCK(root) - 1) {
                         wret = 1;
@@ -1210,8 +1253,7 @@ static noinline void reada_for_search(struct btrfs_root *root,
         struct btrfs_disk_key disk_key;
         u32 nritems;
         u64 search;
-        u64 lowest_read;
-        u64 highest_read;
+        u64 target;
         u64 nread = 0;
         int direction = path->reada;
         struct extent_buffer *eb;
@@ -1235,8 +1277,7 @@ static noinline void reada_for_search(struct btrfs_root *root,
                 return;
         }
 
-        highest_read = search;
-        lowest_read = search;
+        target = search;
 
         nritems = btrfs_header_nritems(node);
         nr = slot;
@@ -1256,27 +1297,80 @@ static noinline void reada_for_search(struct btrfs_root *root,
                                 break;
                 }
                 search = btrfs_node_blockptr(node, nr);
-                if ((search >= lowest_read && search <= highest_read) ||
-                    (search < lowest_read && lowest_read - search <= 16384) ||
-                    (search > highest_read && search - highest_read <= 16384)) {
+                if ((search <= target && target - search <= 65536) ||
+                    (search > target && search - target <= 65536)) {
                         readahead_tree_block(root, search, blocksize,
                                      btrfs_node_ptr_generation(node, nr));
                         nread += blocksize;
                 }
                 nscan++;
-                if (path->reada < 2 && (nread > (64 * 1024) || nscan > 32))
+                if ((nread > 65536 || nscan > 32))
                         break;
+        }
+}
 
-                if (nread > (256 * 1024) || nscan > 128)
-                        break;
+/*
+ * returns -EAGAIN if it had to drop the path, or zero if everything was in
+ * cache
+ */
+static noinline int reada_for_balance(struct btrfs_root *root,
+                                      struct btrfs_path *path, int level)
+{
+        int slot;
+        int nritems;
+        struct extent_buffer *parent;
+        struct extent_buffer *eb;
+        u64 gen;
+        u64 block1 = 0;
+        u64 block2 = 0;
+        int ret = 0;
+        int blocksize;
 
-                if (search < lowest_read)
-                        lowest_read = search;
-                if (search > highest_read)
-                        highest_read = search;
+        parent = path->nodes[level - 1];
+        if (!parent)
+                return 0;
+
+        nritems = btrfs_header_nritems(parent);
+        slot = path->slots[level];
+        blocksize = btrfs_level_size(root, level);
+
+        if (slot > 0) {
+                block1 = btrfs_node_blockptr(parent, slot - 1);
+                gen = btrfs_node_ptr_generation(parent, slot - 1);
+                eb = btrfs_find_tree_block(root, block1, blocksize);
+                if (eb && btrfs_buffer_uptodate(eb, gen))
+                        block1 = 0;
+                free_extent_buffer(eb);
+        }
+        if (slot < nritems) {
+                block2 = btrfs_node_blockptr(parent, slot + 1);
+                gen = btrfs_node_ptr_generation(parent, slot + 1);
+                eb = btrfs_find_tree_block(root, block2, blocksize);
+                if (eb && btrfs_buffer_uptodate(eb, gen))
+                        block2 = 0;
+                free_extent_buffer(eb);
+        }
+        if (block1 || block2) {
+                ret = -EAGAIN;
+                btrfs_release_path(root, path);
+                if (block1)
+                        readahead_tree_block(root, block1, blocksize, 0);
+                if (block2)
+                        readahead_tree_block(root, block2, blocksize, 0);
+
+                if (block1) {
+                        eb = read_tree_block(root, block1, blocksize, 0);
+                        free_extent_buffer(eb);
+                }
+                if (block1) {
+                        eb = read_tree_block(root, block2, blocksize, 0);
+                        free_extent_buffer(eb);
+                }
         }
+        return ret;
 }
 
+
 /*
  * when we walk down the tree, it is usually safe to unlock the higher layers
  * in the tree.  The exceptions are when our path goes through slot 0, because
@@ -1328,6 +1422,32 @@ static noinline void unlock_up(struct btrfs_path *path, int level,
 }
 
 /*
+ * This releases any locks held in the path starting at level and
+ * going all the way up to the root.
+ *
+ * btrfs_search_slot will keep the lock held on higher nodes in a few
+ * corner cases, such as COW of the block at slot zero in the node.  This
+ * ignores those rules, and it should only be called when there are no
+ * more updates to be done higher up in the tree.
+ */
+noinline void btrfs_unlock_up_safe(struct btrfs_path *path, int level)
+{
+        int i;
+
+        if (path->keep_locks || path->lowest_level)
+                return;
+
+        for (i = level; i < BTRFS_MAX_LEVEL; i++) {
+                if (!path->nodes[i])
+                        continue;
+                if (!path->locks[i])
+                        continue;
+                btrfs_tree_unlock(path->nodes[i]);
+                path->locks[i] = 0;
+        }
+}
+
+/*
  * look for key in the tree.  path is filled in with nodes along the way
  * if key is found, we return zero and you can find the item in the leaf
  * level of the path (level 0)
@@ -1387,32 +1507,30 @@ again:
                         int wret;
 
                         /* is a cow on this block not required */
-                        spin_lock(&root->fs_info->hash_lock);
                         if (btrfs_header_generation(b) == trans->transid &&
                             btrfs_header_owner(b) == root->root_key.objectid &&
                             !btrfs_header_flag(b, BTRFS_HEADER_FLAG_WRITTEN)) {
-                                spin_unlock(&root->fs_info->hash_lock);
                                 goto cow_done;
                         }
-                        spin_unlock(&root->fs_info->hash_lock);
 
                         /* ok, we have to cow, is our old prealloc the right
                          * size?
                          */
                         if (prealloc_block.objectid &&
                             prealloc_block.offset != b->len) {
+                                btrfs_release_path(root, p);
                                 btrfs_free_reserved_extent(root,
                                            prealloc_block.objectid,
                                            prealloc_block.offset);
                                 prealloc_block.objectid = 0;
+                                goto again;
                         }
 
                         /*
                          * for higher level blocks, try not to allocate blocks
                          * with the block and the parent locks held.
                          */
-                        if (level > 1 && !prealloc_block.objectid &&
-                            btrfs_path_lock_waiting(p, level)) {
+                        if (level > 0 && !prealloc_block.objectid) {
                                 u32 size = b->len;
                                 u64 hint = b->start;
 
@@ -1425,6 +1543,8 @@ again:
                                 goto again;
                         }
 
+                        btrfs_set_path_blocking(p);
+
                         wret = btrfs_cow_block(trans, root, b,
                                                p->nodes[level + 1],
                                                p->slots[level + 1],
@@ -1446,6 +1566,22 @@ cow_done:
                 if (!p->skip_locking)
                         p->locks[level] = 1;
 
+                btrfs_clear_path_blocking(p);
+
+                /*
+                 * we have a lock on b and as long as we aren't changing
+                 * the tree, there is no way to for the items in b to change.
+                 * It is safe to drop the lock on our parent before we
+                 * go through the expensive btree search on b.
+                 *
+                 * If cow is true, then we might be changing slot zero,
+                 * which may require changing the parent.  So, we can't
+                 * drop the lock until after we know which slot we're
+                 * operating on.
+                 */
+                if (!cow)
+                        btrfs_unlock_up_safe(p, level + 1);
+
                 ret = check_block(root, p, level);
                 if (ret) {
                         ret = -1;
@@ -1453,6 +1589,7 @@ cow_done:
                 }
 
                 ret = bin_search(b, key, level, &slot);
+
                 if (level != 0) {
                         if (ret && slot > 0)
                                 slot -= 1;
@@ -1460,7 +1597,16 @@ cow_done:
                         if ((p->search_for_split || ins_len > 0) &&
                             btrfs_header_nritems(b) >=
                             BTRFS_NODEPTRS_PER_BLOCK(root) - 3) {
-                                int sret = split_node(trans, root, p, level);
+                                int sret;
+
+                                sret = reada_for_balance(root, p, level);
+                                if (sret)
+                                        goto again;
+
+                                btrfs_set_path_blocking(p);
+                                sret = split_node(trans, root, p, level);
+                                btrfs_clear_path_blocking(p);
+
                                 BUG_ON(sret > 0);
                                 if (sret) {
                                         ret = sret;
@@ -1468,9 +1614,19 @@ cow_done:
                                 }
                                 b = p->nodes[level];
                                 slot = p->slots[level];
-                        } else if (ins_len < 0) {
-                                int sret = balance_level(trans, root, p,
-                                                         level);
+                        } else if (ins_len < 0 &&
+                                   btrfs_header_nritems(b) <
+                                   BTRFS_NODEPTRS_PER_BLOCK(root) / 4) {
+                                int sret;
+
+                                sret = reada_for_balance(root, p, level);
+                                if (sret)
+                                        goto again;
+
+                                btrfs_set_path_blocking(p);
+                                sret = balance_level(trans, root, p, level);
+                                btrfs_clear_path_blocking(p);
+
                                 if (sret) {
                                         ret = sret;
                                         goto done;
@@ -1504,7 +1660,7 @@ cow_done:
                                  * of the btree by dropping locks before
                                  * we read.
                                  */
-                                if (level > 1) {
+                                if (level > 0) {
                                         btrfs_release_path(NULL, p);
                                         if (tmp)
                                                 free_extent_buffer(tmp);
@@ -1519,6 +1675,7 @@ cow_done:
                                                 free_extent_buffer(tmp);
                                         goto again;
                                 } else {
+                                        btrfs_set_path_blocking(p);
                                         if (tmp)
                                                 free_extent_buffer(tmp);
                                         if (should_reada)
@@ -1528,14 +1685,29 @@ cow_done:
                                         b = read_node_slot(root, b, slot);
                                 }
                         }
-                        if (!p->skip_locking)
-                                btrfs_tree_lock(b);
+                        if (!p->skip_locking) {
+                                int lret;
+
+                                btrfs_clear_path_blocking(p);
+                                lret = btrfs_try_spin_lock(b);
+
+                                if (!lret) {
+                                        btrfs_set_path_blocking(p);
+                                        btrfs_tree_lock(b);
+                                        btrfs_clear_path_blocking(p);
+                                }
+                        }
                 } else {
                         p->slots[level] = slot;
                         if (ins_len > 0 &&
                             btrfs_leaf_free_space(root, b) < ins_len) {
-                                int sret = split_leaf(trans, root, key,
+                                int sret;
+
+                                btrfs_set_path_blocking(p);
+                                sret = split_leaf(trans, root, key,
                                                       p, ins_len, ret == 0);
+                                btrfs_clear_path_blocking(p);
+
                                 BUG_ON(sret > 0);
                                 if (sret) {
                                         ret = sret;
@@ -1549,12 +1721,16 @@ cow_done:
         }
         ret = 1;
 done:
+        /*
+         * we don't really know what they plan on doing with the path
+         * from here on, so for now just mark it as blocking
+         */
+        btrfs_set_path_blocking(p);
         if (prealloc_block.objectid) {
                 btrfs_free_reserved_extent(root,
                            prealloc_block.objectid,
                            prealloc_block.offset);
         }
-
         return ret;
 }
 
@@ -1578,6 +1754,8 @@ int btrfs_merge_path(struct btrfs_trans_handle *trans,
         ret = btrfs_cow_block(trans, root, eb, NULL, 0, &eb, 0);
         BUG_ON(ret);
 
+        btrfs_set_lock_blocking(eb);
+
         parent = eb;
         while (1) {
                 level = btrfs_header_level(parent);
@@ -1602,6 +1780,7 @@ int btrfs_merge_path(struct btrfs_trans_handle *trans,
                         eb = read_tree_block(root, bytenr, blocksize,
                                              generation);
                         btrfs_tree_lock(eb);
+                        btrfs_set_lock_blocking(eb);
                 }
 
                 /*
@@ -1626,6 +1805,7 @@ int btrfs_merge_path(struct btrfs_trans_handle *trans,
                                 eb = read_tree_block(root, bytenr, blocksize,
                                                 generation);
                                 btrfs_tree_lock(eb);
+                                btrfs_set_lock_blocking(eb);
                         }
 
                         ret = btrfs_cow_block(trans, root, eb, parent, slot,
@@ -2172,6 +2352,8 @@ static int push_leaf_right(struct btrfs_trans_handle *trans, struct btrfs_root
 
         right = read_node_slot(root, upper, slot + 1);
         btrfs_tree_lock(right);
+        btrfs_set_lock_blocking(right);
+
         free_space = btrfs_leaf_free_space(root, right);
         if (free_space < data_size)
                 goto out_unlock;
@@ -2367,6 +2549,8 @@ static int push_leaf_left(struct btrfs_trans_handle *trans, struct btrfs_root
 
         left = read_node_slot(root, path->nodes[1], slot - 1);
         btrfs_tree_lock(left);
+        btrfs_set_lock_blocking(left);
+
         free_space = btrfs_leaf_free_space(root, left);
         if (free_space < data_size) {
                 ret = 1;
@@ -2825,6 +3009,12 @@ int btrfs_split_item(struct btrfs_trans_handle *trans,
         path->keep_locks = 0;
         BUG_ON(ret);
 
+        /*
+         * make sure any changes to the path from split_leaf leave it
+         * in a blocking state
+         */
+        btrfs_set_path_blocking(path);
+
         leaf = path->nodes[0];
         BUG_ON(btrfs_leaf_free_space(root, leaf) < sizeof(struct btrfs_item));
 
@@ -3354,6 +3544,7 @@ int btrfs_insert_empty_items(struct btrfs_trans_handle *trans,
                 BUG();
         }
 out:
+        btrfs_unlock_up_safe(path, 1);
         return ret;
 }
 
@@ -3441,15 +3632,22 @@ noinline int btrfs_del_leaf(struct btrfs_trans_handle *trans,
 {
         int ret;
         u64 root_gen = btrfs_header_generation(path->nodes[1]);
+        u64 parent_start = path->nodes[1]->start;
+        u64 parent_owner = btrfs_header_owner(path->nodes[1]);
 
         ret = del_ptr(trans, root, path, 1, path->slots[1]);
         if (ret)
                 return ret;
 
+        /*
+         * btrfs_free_extent is expensive, we want to make sure we
+         * aren't holding any locks when we call it
+         */
+        btrfs_unlock_up_safe(path, 0);
+
         ret = btrfs_free_extent(trans, root, bytenr,
                                 btrfs_level_size(root, 0),
-                                path->nodes[1]->start,
-                                btrfs_header_owner(path->nodes[1]),
+                                parent_start, parent_owner,
                                 root_gen, 0, 1);
         return ret;
 }
@@ -3721,12 +3919,14 @@ find_next_key:
                  */
                 if (slot >= nritems) {
                         path->slots[level] = slot;
+                        btrfs_set_path_blocking(path);
                         sret = btrfs_find_next_key(root, path, min_key, level,
                                                   cache_only, min_trans);
                         if (sret == 0) {
                                 btrfs_release_path(root, path);
                                 goto again;
                         } else {
+                                btrfs_clear_path_blocking(path);
                                 goto out;
                         }
                 }
@@ -3738,16 +3938,20 @@ find_next_key:
                         unlock_up(path, level, 1);
                         goto out;
                 }
+                btrfs_set_path_blocking(path);
                 cur = read_node_slot(root, cur, slot);
 
                 btrfs_tree_lock(cur);
+
                 path->locks[level - 1] = 1;
                 path->nodes[level - 1] = cur;
                 unlock_up(path, level, 1);
+                btrfs_clear_path_blocking(path);
         }
 out:
         if (ret == 0)
                 memcpy(min_key, &found_key, sizeof(found_key));
+        btrfs_set_path_blocking(path);
         return ret;
 }
 
@@ -3843,6 +4047,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
         if (ret < 0)
                 return ret;
 
+        btrfs_set_path_blocking(path);
         nritems = btrfs_header_nritems(path->nodes[0]);
         /*
          * by releasing the path above we dropped all our locks.  A balance
@@ -3873,6 +4078,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                         free_extent_buffer(next);
                 }
 
+                /* the path was set to blocking above */
                 if (level == 1 && (path->locks[1] || path->skip_locking) &&
                     path->reada)
                         reada_for_search(root, path, level, slot, 0);
@@ -3881,6 +4087,7 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                 if (!path->skip_locking) {
                         WARN_ON(!btrfs_tree_locked(c));
                         btrfs_tree_lock(next);
+                        btrfs_set_lock_blocking(next);
                 }
                 break;
         }
@@ -3897,12 +4104,15 @@ int btrfs_next_leaf(struct btrfs_root *root, struct btrfs_path *path)
                         path->locks[level] = 1;
                 if (!level)
                         break;
+
+                btrfs_set_path_blocking(path);
                 if (level == 1 && path->locks[1] && path->reada)
                         reada_for_search(root, path, level, slot, 0);
                 next = read_node_slot(root, next, 0);
                 if (!path->skip_locking) {
                         WARN_ON(!btrfs_tree_locked(path->nodes[level]));
                         btrfs_tree_lock(next);
+                        btrfs_set_lock_blocking(next);
                 }
         }
 done:
@@ -3927,6 +4137,7 @@ int btrfs_previous_item(struct btrfs_root *root,
 
         while (1) {
                 if (path->slots[0] == 0) {
+                        btrfs_set_path_blocking(path);
                         ret = btrfs_prev_leaf(root, path);
                         if (ret != 0)
                                 return ret;
diff --git a/fs/btrfs/ctree.h b/fs/btrfs/ctree.h
index eee060f8811..531db112c8b 100644
--- a/fs/btrfs/ctree.h
+++ b/fs/btrfs/ctree.h
@@ -454,17 +454,11 @@ struct btrfs_timespec {
         __le32 nsec;
 } __attribute__ ((__packed__));
 
-typedef enum {
+enum btrfs_compression_type {
         BTRFS_COMPRESS_NONE = 0,
         BTRFS_COMPRESS_ZLIB = 1,
         BTRFS_COMPRESS_LAST = 2,
-} btrfs_compression_type;
-
-/* we don't understand any encryption methods right now */
-typedef enum {
-        BTRFS_ENCRYPTION_NONE = 0,
-        BTRFS_ENCRYPTION_LAST = 1,
-} btrfs_encryption_type;
+};
 
 struct btrfs_inode_item {
         /* nfs style generation number */
@@ -701,9 +695,7 @@ struct btrfs_fs_info {
         struct btrfs_transaction *running_transaction;
         wait_queue_head_t transaction_throttle;
         wait_queue_head_t transaction_wait;
-
         wait_queue_head_t async_submit_wait;
-        wait_queue_head_t tree_log_wait;
 
         struct btrfs_super_block super_copy;
         struct btrfs_super_block super_for_commit;
@@ -711,7 +703,6 @@ struct btrfs_fs_info {
         struct super_block *sb;
         struct inode *btree_inode;
         struct backing_dev_info bdi;
-        spinlock_t hash_lock;
         struct mutex trans_mutex;
         struct mutex tree_log_mutex;
         struct mutex transaction_kthread_mutex;
@@ -730,10 +721,6 @@ struct btrfs_fs_info {
         atomic_t async_submit_draining;
         atomic_t nr_async_bios;
         atomic_t async_delalloc_pages;
-        atomic_t tree_log_writers;
-        atomic_t tree_log_commit;
-        unsigned long tree_log_batch;
-        u64 tree_log_transid;
 
         /*
          * this is used by the balancing code to wait for all the pending
@@ -833,7 +820,14 @@ struct btrfs_root {
         struct kobject root_kobj;
         struct completion kobj_unregister;
         struct mutex objectid_mutex;
+
         struct mutex log_mutex;
+        wait_queue_head_t log_writer_wait;
+        wait_queue_head_t log_commit_wait[2];
+        atomic_t log_writers;
+        atomic_t log_commit[2];
+        unsigned long log_transid;
+        unsigned long log_batch;
 
         u64 objectid;
         u64 last_trans;
@@ -1841,6 +1835,10 @@ void btrfs_release_path(struct btrfs_root *root, struct btrfs_path *p);
 struct btrfs_path *btrfs_alloc_path(void);
 void btrfs_free_path(struct btrfs_path *p);
 void btrfs_init_path(struct btrfs_path *p);
+void btrfs_set_path_blocking(struct btrfs_path *p);
+void btrfs_clear_path_blocking(struct btrfs_path *p);
+void btrfs_unlock_up_safe(struct btrfs_path *p, int level);
+
 int btrfs_del_items(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                    struct btrfs_path *path, int slot, int nr);
 int btrfs_del_leaf(struct btrfs_trans_handle *trans,
diff --git a/fs/btrfs/disk-io.c b/fs/btrfs/disk-io.c
index 81a313874ae..5aebddd7119 100644
--- a/fs/btrfs/disk-io.c
+++ b/fs/btrfs/disk-io.c
@@ -16,7 +16,6 @@
  * Boston, MA 021110-1307, USA.
  */
 
-#include <linux/version.h>
 #include <linux/fs.h>
 #include <linux/blkdev.h>
 #include <linux/scatterlist.h>
@@ -800,7 +799,7 @@ struct extent_buffer *read_tree_block(struct btrfs_root *root, u64 bytenr,
         ret = btree_read_extent_buffer_pages(root, buf, 0, parent_transid);
 
         if (ret == 0)
-                buf->flags |= EXTENT_UPTODATE;
+                set_bit(EXTENT_BUFFER_UPTODATE, &buf->bflags);
         else
                 WARN_ON(1);
         return buf;
@@ -814,6 +813,10 @@ int clean_tree_block(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         if (btrfs_header_generation(buf) ==
             root->fs_info->running_transaction->transid) {
                 WARN_ON(!btrfs_tree_locked(buf));
+
+                /* ugh, clear_extent_buffer_dirty can be expensive */
+                btrfs_set_lock_blocking(buf);
+
                 clear_extent_buffer_dirty(&BTRFS_I(btree_inode)->io_tree,
                                           buf);
         }
@@ -850,6 +853,14 @@ static int __setup_root(u32 nodesize, u32 leafsize, u32 sectorsize,
         spin_lock_init(&root->list_lock);
         mutex_init(&root->objectid_mutex);
         mutex_init(&root->log_mutex);
+        init_waitqueue_head(&root->log_writer_wait);
+        init_waitqueue_head(&root->log_commit_wait[0]);
+        init_waitqueue_head(&root->log_commit_wait[1]);
+        atomic_set(&root->log_commit[0], 0);
+        atomic_set(&root->log_commit[1], 0);
+        atomic_set(&root->log_writers, 0);
+        root->log_batch = 0;
+        root->log_transid = 0;
         extent_io_tree_init(&root->dirty_log_pages,
                              fs_info->btree_inode->i_mapping, GFP_NOFS);
 
@@ -934,15 +945,16 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
         return 0;
 }
 
-int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
-                             struct btrfs_fs_info *fs_info)
+static struct btrfs_root *alloc_log_tree(struct btrfs_trans_handle *trans,
+                                         struct btrfs_fs_info *fs_info)
 {
         struct btrfs_root *root;
         struct btrfs_root *tree_root = fs_info->tree_root;
+        struct extent_buffer *leaf;
 
         root = kzalloc(sizeof(*root), GFP_NOFS);
         if (!root)
-                return -ENOMEM;
+                return ERR_PTR(-ENOMEM);
 
         __setup_root(tree_root->nodesize, tree_root->leafsize,
                      tree_root->sectorsize, tree_root->stripesize,
@@ -951,12 +963,23 @@ int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
         root->root_key.objectid = BTRFS_TREE_LOG_OBJECTID;
         root->root_key.type = BTRFS_ROOT_ITEM_KEY;
         root->root_key.offset = BTRFS_TREE_LOG_OBJECTID;
+        /*
+         * log trees do not get reference counted because they go away
+         * before a real commit is actually done.  They do store pointers
+         * to file data extents, and those reference counts still get
+         * updated (along with back refs to the log tree).
+         */
         root->ref_cows = 0;
 
-        root->node = btrfs_alloc_free_block(trans, root, root->leafsize,
-                                            0, BTRFS_TREE_LOG_OBJECTID,
-                                            trans->transid, 0, 0, 0);
+        leaf = btrfs_alloc_free_block(trans, root, root->leafsize,
+                                      0, BTRFS_TREE_LOG_OBJECTID,
+                                      trans->transid, 0, 0, 0);
+        if (IS_ERR(leaf)) {
+                kfree(root);
+                return ERR_CAST(leaf);
+        }
 
+        root->node = leaf;
         btrfs_set_header_nritems(root->node, 0);
         btrfs_set_header_level(root->node, 0);
         btrfs_set_header_bytenr(root->node, root->node->start);
@@ -968,7 +991,48 @@ int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
                             BTRFS_FSID_SIZE);
         btrfs_mark_buffer_dirty(root->node);
         btrfs_tree_unlock(root->node);
-        fs_info->log_root_tree = root;
+        return root;
+}
+
+int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
+                             struct btrfs_fs_info *fs_info)
+{
+        struct btrfs_root *log_root;
+
+        log_root = alloc_log_tree(trans, fs_info);
+        if (IS_ERR(log_root))
+                return PTR_ERR(log_root);
+        WARN_ON(fs_info->log_root_tree);
+        fs_info->log_root_tree = log_root;
+        return 0;
+}
+
+int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
+                       struct btrfs_root *root)
+{
+        struct btrfs_root *log_root;
+        struct btrfs_inode_item *inode_item;
+
+        log_root = alloc_log_tree(trans, root->fs_info);
+        if (IS_ERR(log_root))
+                return PTR_ERR(log_root);
+
+        log_root->last_trans = trans->transid;
+        log_root->root_key.offset = root->root_key.objectid;
+
+        inode_item = &log_root->root_item.inode;
+        inode_item->generation = cpu_to_le64(1);
+        inode_item->size = cpu_to_le64(3);
+        inode_item->nlink = cpu_to_le32(1);
+        inode_item->nbytes = cpu_to_le64(root->leafsize);
+        inode_item->mode = cpu_to_le32(S_IFDIR | 0755);
+
+        btrfs_set_root_bytenr(&log_root->root_item, log_root->node->start);
+        btrfs_set_root_generation(&log_root->root_item, trans->transid);
+
+        WARN_ON(root->log_root);
+        root->log_root = log_root;
+        root->log_transid = 0;
         return 0;
 }
 
@@ -1136,7 +1200,6 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
 {
         struct btrfs_fs_info *info = (struct btrfs_fs_info *)congested_data;
         int ret = 0;
-        struct list_head *cur;
         struct btrfs_device *device;
         struct backing_dev_info *bdi;
 #if 0
@@ -1144,8 +1207,7 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
             btrfs_congested_async(info, 0))
                 return 1;
 #endif
-        list_for_each(cur, &info->fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, &info->fs_devices->devices, dev_list) {
                 if (!device->bdev)
                         continue;
                 bdi = blk_get_backing_dev_info(device->bdev);
@@ -1163,13 +1225,11 @@ static int btrfs_congested_fn(void *congested_data, int bdi_bits)
  */
 static void __unplug_io_fn(struct backing_dev_info *bdi, struct page *page)
 {
-        struct list_head *cur;
         struct btrfs_device *device;
         struct btrfs_fs_info *info;
 
         info = (struct btrfs_fs_info *)bdi->unplug_io_data;
-        list_for_each(cur, &info->fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, &info->fs_devices->devices, dev_list) {
                 if (!device->bdev)
                         continue;
 
@@ -1447,7 +1507,6 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         INIT_LIST_HEAD(&fs_info->dead_roots);
         INIT_LIST_HEAD(&fs_info->hashers);
         INIT_LIST_HEAD(&fs_info->delalloc_inodes);
-        spin_lock_init(&fs_info->hash_lock);
         spin_lock_init(&fs_info->delalloc_lock);
         spin_lock_init(&fs_info->new_trans_lock);
         spin_lock_init(&fs_info->ref_cache_lock);
@@ -1535,10 +1594,6 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         init_waitqueue_head(&fs_info->transaction_throttle);
         init_waitqueue_head(&fs_info->transaction_wait);
         init_waitqueue_head(&fs_info->async_submit_wait);
-        init_waitqueue_head(&fs_info->tree_log_wait);
-        atomic_set(&fs_info->tree_log_commit, 0);
-        atomic_set(&fs_info->tree_log_writers, 0);
-        fs_info->tree_log_transid = 0;
 
         __setup_root(4096, 4096, 4096, 4096, tree_root,
                      fs_info, BTRFS_ROOT_TREE_OBJECTID);
@@ -1627,6 +1682,8 @@ struct btrfs_root *open_ctree(struct super_block *sb,
          * low idle thresh
          */
         fs_info->endio_workers.idle_thresh = 4;
+        fs_info->endio_meta_workers.idle_thresh = 4;
+
         fs_info->endio_write_workers.idle_thresh = 64;
         fs_info->endio_meta_write_workers.idle_thresh = 64;
 
@@ -1740,13 +1797,13 @@ struct btrfs_root *open_ctree(struct super_block *sb,
         fs_info->system_alloc_profile = fs_info->metadata_alloc_profile;
         fs_info->cleaner_kthread = kthread_run(cleaner_kthread, tree_root,
                                                "btrfs-cleaner");
-        if (!fs_info->cleaner_kthread)
+        if (IS_ERR(fs_info->cleaner_kthread))
                 goto fail_csum_root;
 
         fs_info->transaction_kthread = kthread_run(transaction_kthread,
                                                    tree_root,
                                                    "btrfs-transaction");
-        if (!fs_info->transaction_kthread)
+        if (IS_ERR(fs_info->transaction_kthread))
                 goto fail_cleaner;
 
         if (btrfs_super_log_root(disk_super) != 0) {
@@ -1828,13 +1885,14 @@ fail_sb_buffer:
 fail_iput:
         invalidate_inode_pages2(fs_info->btree_inode->i_mapping);
         iput(fs_info->btree_inode);
-fail:
+
         btrfs_close_devices(fs_info->fs_devices);
         btrfs_mapping_tree_free(&fs_info->mapping_tree);
+        bdi_destroy(&fs_info->bdi);
 
+fail:
         kfree(extent_root);
         kfree(tree_root);
-        bdi_destroy(&fs_info->bdi);
         kfree(fs_info);
         kfree(chunk_root);
         kfree(dev_root);
@@ -1995,7 +2053,6 @@ static int write_dev_supers(struct btrfs_device *device,
 
 int write_all_supers(struct btrfs_root *root, int max_mirrors)
 {
-        struct list_head *cur;
         struct list_head *head = &root->fs_info->fs_devices->devices;
         struct btrfs_device *dev;
         struct btrfs_super_block *sb;
@@ -2011,8 +2068,7 @@ int write_all_supers(struct btrfs_root *root, int max_mirrors)
 
         sb = &root->fs_info->super_for_commit;
         dev_item = &sb->dev_item;
-        list_for_each(cur, head) {
-                dev = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(dev, head, dev_list) {
                 if (!dev->bdev) {
                         total_errors++;
                         continue;
@@ -2045,8 +2101,7 @@ int write_all_supers(struct btrfs_root *root, int max_mirrors)
         }
 
         total_errors = 0;
-        list_for_each(cur, head) {
-                dev = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(dev, head, dev_list) {
                 if (!dev->bdev)
                         continue;
                 if (!dev->in_fs_metadata || !dev->writeable)
@@ -2260,6 +2315,8 @@ void btrfs_mark_buffer_dirty(struct extent_buffer *buf)
         u64 transid = btrfs_header_generation(buf);
         struct inode *btree_inode = root->fs_info->btree_inode;
 
+        btrfs_set_lock_blocking(buf);
+
         WARN_ON(!btrfs_tree_locked(buf));
         if (transid != root->fs_info->generation) {
                 printk(KERN_CRIT "btrfs transid mismatch buffer %llu, "
@@ -2302,14 +2359,13 @@ int btrfs_read_buffer(struct extent_buffer *buf, u64 parent_transid)
         int ret;
         ret = btree_read_extent_buffer_pages(root, buf, 0, parent_transid);
         if (ret == 0)
-                buf->flags |= EXTENT_UPTODATE;
+                set_bit(EXTENT_BUFFER_UPTODATE, &buf->bflags);
         return ret;
 }
 
 int btree_lock_page_hook(struct page *page)
 {
         struct inode *inode = page->mapping->host;
-        struct btrfs_root *root = BTRFS_I(inode)->root;
         struct extent_io_tree *io_tree = &BTRFS_I(inode)->io_tree;
         struct extent_buffer *eb;
         unsigned long len;
@@ -2324,9 +2380,7 @@ int btree_lock_page_hook(struct page *page)
                 goto out;
 
         btrfs_tree_lock(eb);
-        spin_lock(&root->fs_info->hash_lock);
         btrfs_set_header_flag(eb, BTRFS_HEADER_FLAG_WRITTEN);
-        spin_unlock(&root->fs_info->hash_lock);
         btrfs_tree_unlock(eb);
         free_extent_buffer(eb);
 out:
diff --git a/fs/btrfs/disk-io.h b/fs/btrfs/disk-io.h
index c0ff404c31b..494a56eb298 100644
--- a/fs/btrfs/disk-io.h
+++ b/fs/btrfs/disk-io.h
@@ -98,5 +98,7 @@ int btrfs_free_log_root_tree(struct btrfs_trans_handle *trans,
                              struct btrfs_fs_info *fs_info);
 int btrfs_init_log_root_tree(struct btrfs_trans_handle *trans,
                              struct btrfs_fs_info *fs_info);
+int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
+                       struct btrfs_root *root);
 int btree_lock_page_hook(struct page *page);
 #endif
diff --git a/fs/btrfs/extent-tree.c b/fs/btrfs/extent-tree.c
index 293da650873..7527523c2d2 100644
--- a/fs/btrfs/extent-tree.c
+++ b/fs/btrfs/extent-tree.c
@@ -19,7 +19,7 @@
 #include <linux/pagemap.h>
 #include <linux/writeback.h>
 #include <linux/blkdev.h>
-#include <linux/version.h>
+#include <linux/sort.h>
 #include "compat.h"
 #include "hash.h"
 #include "crc32c.h"
@@ -30,7 +30,6 @@
 #include "volumes.h"
 #include "locking.h"
 #include "ref-cache.h"
-#include "compat.h"
 
 #define PENDING_EXTENT_INSERT 0
 #define PENDING_EXTENT_DELETE 1
@@ -326,10 +325,8 @@ static struct btrfs_space_info *__find_space_info(struct btrfs_fs_info *info,
                                                   u64 flags)
 {
         struct list_head *head = &info->space_info;
-        struct list_head *cur;
         struct btrfs_space_info *found;
-        list_for_each(cur, head) {
-                found = list_entry(cur, struct btrfs_space_info, list);
+        list_for_each_entry(found, head, list) {
                 if (found->flags == flags)
                         return found;
         }
@@ -1525,15 +1522,55 @@ out:
         return ret;
 }
 
-int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
-                  struct extent_buffer *orig_buf, struct extent_buffer *buf,
-                  u32 *nr_extents)
+/* when a block goes through cow, we update the reference counts of
+ * everything that block points to.  The internal pointers of the block
+ * can be in just about any order, and it is likely to have clusters of
+ * things that are close together and clusters of things that are not.
+ *
+ * To help reduce the seeks that come with updating all of these reference
+ * counts, sort them by byte number before actual updates are done.
+ *
+ * struct refsort is used to match byte number to slot in the btree block.
+ * we sort based on the byte number and then use the slot to actually
+ * find the item.
+ *
+ * struct refsort is smaller than strcut btrfs_item and smaller than
+ * struct btrfs_key_ptr.  Since we're currently limited to the page size
+ * for a btree block, there's no way for a kmalloc of refsorts for a
+ * single node to be bigger than a page.
+ */
+struct refsort {
+        u64 bytenr;
+        u32 slot;
+};
+
+/*
+ * for passing into sort()
+ */
+static int refsort_cmp(const void *a_void, const void *b_void)
+{
+        const struct refsort *a = a_void;
+        const struct refsort *b = b_void;
+
+        if (a->bytenr < b->bytenr)
+                return -1;
+        if (a->bytenr > b->bytenr)
+                return 1;
+        return 0;
+}
+
+
+noinline int btrfs_inc_ref(struct btrfs_trans_handle *trans,
+                           struct btrfs_root *root,
+                           struct extent_buffer *orig_buf,
+                           struct extent_buffer *buf, u32 *nr_extents)
 {
         u64 bytenr;
         u64 ref_root;
         u64 orig_root;
         u64 ref_generation;
         u64 orig_generation;
+        struct refsort *sorted;
         u32 nritems;
         u32 nr_file_extents = 0;
         struct btrfs_key key;
@@ -1542,6 +1579,8 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         int level;
         int ret = 0;
         int faili = 0;
+        int refi = 0;
+        int slot;
         int (*process_func)(struct btrfs_trans_handle *, struct btrfs_root *,
                             u64, u64, u64, u64, u64, u64, u64, u64);
 
@@ -1553,6 +1592,9 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
         nritems = btrfs_header_nritems(buf);
         level = btrfs_header_level(buf);
 
+        sorted = kmalloc(sizeof(struct refsort) * nritems, GFP_NOFS);
+        BUG_ON(!sorted);
+
         if (root->ref_cows) {
                 process_func = __btrfs_inc_extent_ref;
         } else {
@@ -1565,6 +1607,11 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                 process_func = __btrfs_update_extent_ref;
         }
 
+        /*
+         * we make two passes through the items.  In the first pass we
+         * only record the byte number and slot.  Then we sort based on
+         * byte number and do the actual work based on the sorted results
+         */
         for (i = 0; i < nritems; i++) {
                 cond_resched();
                 if (level == 0) {
@@ -1581,6 +1628,32 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                 continue;
 
                         nr_file_extents++;
+                        sorted[refi].bytenr = bytenr;
+                        sorted[refi].slot = i;
+                        refi++;
+                } else {
+                        bytenr = btrfs_node_blockptr(buf, i);
+                        sorted[refi].bytenr = bytenr;
+                        sorted[refi].slot = i;
+                        refi++;
+                }
+        }
+        /*
+         * if refi == 0, we didn't actually put anything into the sorted
+         * array and we're done
+         */
+        if (refi == 0)
+                goto out;
+
+        sort(sorted, refi, sizeof(struct refsort), refsort_cmp, NULL);
+
+        for (i = 0; i < refi; i++) {
+                cond_resched();
+                slot = sorted[i].slot;
+                bytenr = sorted[i].bytenr;
+
+                if (level == 0) {
+                        btrfs_item_key_to_cpu(buf, &key, slot);
 
                         ret = process_func(trans, root, bytenr,
                                            orig_buf->start, buf->start,
@@ -1589,25 +1662,25 @@ int btrfs_inc_ref(struct btrfs_trans_handle *trans, struct btrfs_root *root,
                                            key.objectid);
 
                         if (ret) {
-                                faili = i;
+                                faili = slot;
                                 WARN_ON(1);
                                 goto fail;
                         }
                 } else {
-                        bytenr = btrfs_node_blockptr(buf, i);
                         ret = process_func(trans, root, bytenr,
                                            orig_buf->start, buf->start,
                                            orig_root, ref_root,
                                            orig_generation, ref_generation,
                                            level - 1);
                         if (ret) {
-                                faili = i;
+                                faili = slot;
                                 WARN_ON(1);
                                 goto fail;
                         }
                 }
         }
 out:
+        kfree(sorted);
         if (nr_extents) {
                 if (level == 0)
                         *nr_extents = nr_file_extents;
@@ -1616,6 +1689,7 @@ out:
         }
         return 0;
 fail:
+        kfree(sorted);
         WARN_ON(1);
         return ret;
 }
@@ -2159,7 +2233,8 @@ again:
                 ret = find_first_extent_bit(&info->extent_ins, search, &start,
                                             &end, EXTENT_WRITEBACK);
                 if (ret) {
-                        if (skipped && all && !num_inserts) {
+                        if (skipped && all && !num_inserts &&
+                            list_empty(&update_list)) {
                                 skipped = 0;
                                 search = 0;
                                 continue;
@@ -2547,6 +2622,7 @@ again:
                 if (ret) {
                         if (all && skipped && !nr) {
                                 search = 0;
+                                skipped = 0;
                                 continue;
                         }
                         mutex_unlock(&info->extent_ins_mutex);
@@ -2700,13 +2776,9 @@ static int __btrfs_free_extent(struct btrfs_trans_handle *trans,
         /* if metadata always pin */
         if (owner_objectid < BTRFS_FIRST_FREE_OBJECTID) {
                 if (root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID) {
-                        struct btrfs_block_group_cache *cache;
-
-                        /* btrfs_free_reserved_extent */
-                        cache = btrfs_lookup_block_group(root->fs_info, bytenr);
-                        BUG_ON(!cache);
-                        btrfs_add_free_space(cache, bytenr, num_bytes);
-                        put_block_group(cache);
+                        mutex_lock(&root->fs_info->pinned_mutex);
+                        btrfs_update_pinned_extents(root, bytenr, num_bytes, 1);
+                        mutex_unlock(&root->fs_info->pinned_mutex);
                         update_reserved_extents(root, bytenr, num_bytes, 0);
                         return 0;
                 }
@@ -3014,7 +3086,6 @@ loop_check:
 static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
 {
         struct btrfs_block_group_cache *cache;
-        struct list_head *l;
 
         printk(KERN_INFO "space_info has %llu free, is %sfull\n",
                (unsigned long long)(info->total_bytes - info->bytes_used -
@@ -3022,8 +3093,7 @@ static void dump_space_info(struct btrfs_space_info *info, u64 bytes)
                (info->full) ? "" : "not ");
 
         down_read(&info->groups_sem);
-        list_for_each(l, &info->block_groups) {
-                cache = list_entry(l, struct btrfs_block_group_cache, list);
+        list_for_each_entry(cache, &info->block_groups, list) {
                 spin_lock(&cache->lock);
                 printk(KERN_INFO "block group %llu has %llu bytes, %llu used "
                        "%llu pinned %llu reserved\n",
@@ -3342,7 +3412,10 @@ struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
         btrfs_set_header_generation(buf, trans->transid);
         btrfs_tree_lock(buf);
         clean_tree_block(trans, root, buf);
+
+        btrfs_set_lock_blocking(buf);
         btrfs_set_buffer_uptodate(buf);
+
         if (root->root_key.objectid == BTRFS_TREE_LOG_OBJECTID) {
                 set_extent_dirty(&root->dirty_log_pages, buf->start,
                          buf->start + buf->len - 1, GFP_NOFS);
@@ -3351,6 +3424,7 @@ struct extent_buffer *btrfs_init_new_buffer(struct btrfs_trans_handle *trans,
                          buf->start + buf->len - 1, GFP_NOFS);
         }
         trans->blocks_used++;
+        /* this returns a buffer locked for blocking */
         return buf;
 }
 
@@ -3388,36 +3462,73 @@ int btrfs_drop_leaf_ref(struct btrfs_trans_handle *trans,
 {
         u64 leaf_owner;
         u64 leaf_generation;
+        struct refsort *sorted;
         struct btrfs_key key;
         struct btrfs_file_extent_item *fi;
         int i;
         int nritems;
         int ret;
+        int refi = 0;
+        int slot;
 
         BUG_ON(!btrfs_is_leaf(leaf));
         nritems = btrfs_header_nritems(leaf);
         leaf_owner = btrfs_header_owner(leaf);
         leaf_generation = btrfs_header_generation(leaf);
 
+        sorted = kmalloc(sizeof(*sorted) * nritems, GFP_NOFS);
+        /* we do this loop twice.  The first time we build a list
+         * of the extents we have a reference on, then we sort the list
+         * by bytenr.  The second time around we actually do the
+         * extent freeing.
+         */
         for (i = 0; i < nritems; i++) {
                 u64 disk_bytenr;
                 cond_resched();
 
                 btrfs_item_key_to_cpu(leaf, &key, i);
+
+                /* only extents have references, skip everything else */
                 if (btrfs_key_type(&key) != BTRFS_EXTENT_DATA_KEY)
                         continue;
+
                 fi = btrfs_item_ptr(leaf, i, struct btrfs_file_extent_item);
+
+                /* inline extents live in the btree, they don't have refs */
                 if (btrfs_file_extent_type(leaf, fi) ==
                     BTRFS_FILE_EXTENT_INLINE)
                         continue;
-                /*
-                 * FIXME make sure to insert a trans record that
-                 * repeats the snapshot del on crash
-                 */
+
                 disk_bytenr = btrfs_file_extent_disk_bytenr(leaf, fi);
+
+                /* holes don't have refs */
                 if (disk_bytenr == 0)
                         continue;
 
+                sorted[refi].bytenr = disk_bytenr;
+                sorted[refi].slot = i;
+                refi++;
+        }
+
+        if (refi == 0)
+                goto out;
+
+        sort(sorted, refi, sizeof(struct refsort), refsort_cmp, NULL);
+
+        for (i = 0; i < refi; i++) {
+                u64 disk_bytenr;
+
+                disk_bytenr = sorted[i].bytenr;
+                slot = sorted[i].slot;
+
+                cond_resched();
+
+                btrfs_item_key_to_cpu(leaf, &key, slot);
+                if (btrfs_key_type(&key) != BTRFS_EXTENT_DATA_KEY)
+                        continue;
+
+                fi = btrfs_item_ptr(leaf, slot, struct btrfs_file_extent_item);
+
                 ret = __btrfs_free_extent(trans, root, disk_bytenr,
                                 btrfs_file_extent_disk_num_bytes(leaf, fi),
                                 leaf->start, leaf_owner, leaf_generation,
@@ -3428,6 +3539,8 @@ int btrfs_drop_leaf_ref(struct btrfs_trans_handle *trans,
                 wake_up(&root->fs_info->transaction_throttle);
                 cond_resched();
         }
+out:
+        kfree(sorted);
         return 0;
 }
 
@@ -3437,9 +3550,25 @@ static noinline int cache_drop_leaf_ref(struct btrfs_trans_handle *trans,
 {
         int i;
         int ret;
-        struct btrfs_extent_info *info = ref->extents;
+        struct btrfs_extent_info *info;
+        struct refsort *sorted;
+
+        if (ref->nritems == 0)
+                return 0;
 
+        sorted = kmalloc(sizeof(*sorted) * ref->nritems, GFP_NOFS);
         for (i = 0; i < ref->nritems; i++) {
+                sorted[i].bytenr = ref->extents[i].bytenr;
+                sorted[i].slot = i;
+        }
+        sort(sorted, ref->nritems, sizeof(struct refsort), refsort_cmp, NULL);
+
+        /*
+         * the items in the ref were sorted when the ref was inserted
+         * into the ref cache, so this is already in order
+         */
+        for (i = 0; i < ref->nritems; i++) {
+                info = ref->extents + sorted[i].slot;
                 ret = __btrfs_free_extent(trans, root, info->bytenr,
                                           info->num_bytes, ref->bytenr,
                                           ref->owner, ref->generation,
@@ -3453,6 +3582,7 @@ static noinline int cache_drop_leaf_ref(struct btrfs_trans_handle *trans,
                 info++;
         }
 
+        kfree(sorted);
         return 0;
 }
 
@@ -3497,6 +3627,152 @@ static int drop_snap_lookup_refcount(struct btrfs_root *root, u64 start,
 }
 
 /*
+ * this is used while deleting old snapshots, and it drops the refs
+ * on a whole subtree starting from a level 1 node.
+ *
+ * The idea is to sort all the leaf pointers, and then drop the
+ * ref on all the leaves in order.  Most of the time the leaves
+ * will have ref cache entries, so no leaf IOs will be required to
+ * find the extents they have references on.
+ *
+ * For each leaf, any references it has are also dropped in order
+ *
+ * This ends up dropping the references in something close to optimal
+ * order for reading and modifying the extent allocation tree.
+ */
+static noinline int drop_level_one_refs(struct btrfs_trans_handle *trans,
+                                        struct btrfs_root *root,
+                                        struct btrfs_path *path)
+{
+        u64 bytenr;
+        u64 root_owner;
+        u64 root_gen;
+        struct extent_buffer *eb = path->nodes[1];
+        struct extent_buffer *leaf;
+        struct btrfs_leaf_ref *ref;
+        struct refsort *sorted = NULL;
+        int nritems = btrfs_header_nritems(eb);
+        int ret;
+        int i;
+        int refi = 0;
+        int slot = path->slots[1];
+        u32 blocksize = btrfs_level_size(root, 0);
+        u32 refs;
+
+        if (nritems == 0)
+                goto out;
+
+        root_owner = btrfs_header_owner(eb);
+        root_gen = btrfs_header_generation(eb);
+        sorted = kmalloc(sizeof(*sorted) * nritems, GFP_NOFS);
+
+        /*
+         * step one, sort all the leaf pointers so we don't scribble
+         * randomly into the extent allocation tree
+         */
+        for (i = slot; i < nritems; i++) {
+                sorted[refi].bytenr = btrfs_node_blockptr(eb, i);
+                sorted[refi].slot = i;
+                refi++;
+        }
+
+        /*
+         * nritems won't be zero, but if we're picking up drop_snapshot
+         * after a crash, slot might be > 0, so double check things
+         * just in case.
+         */
+        if (refi == 0)
+                goto out;
+
+        sort(sorted, refi, sizeof(struct refsort), refsort_cmp, NULL);
+
+        /*
+         * the first loop frees everything the leaves point to
+         */
+        for (i = 0; i < refi; i++) {
+                u64 ptr_gen;
+
+                bytenr = sorted[i].bytenr;
+
+                /*
+                 * check the reference count on this leaf.  If it is > 1
+                 * we just decrement it below and don't update any
+                 * of the refs the leaf points to.
+                 */
+                ret = drop_snap_lookup_refcount(root, bytenr, blocksize, &refs);
+                BUG_ON(ret);
+                if (refs != 1)
+                        continue;
+
+                ptr_gen = btrfs_node_ptr_generation(eb, sorted[i].slot);
+
+                /*
+                 * the leaf only had one reference, which means the
+                 * only thing pointing to this leaf is the snapshot
+                 * we're deleting.  It isn't possible for the reference
+                 * count to increase again later
+                 *
+                 * The reference cache is checked for the leaf,
+                 * and if found we'll be able to drop any refs held by
+                 * the leaf without needing to read it in.
+                 */
+                ref = btrfs_lookup_leaf_ref(root, bytenr);
+                if (ref && ref->generation != ptr_gen) {
+                        btrfs_free_leaf_ref(root, ref);
+                        ref = NULL;
+                }
+                if (ref) {
+                        ret = cache_drop_leaf_ref(trans, root, ref);
+                        BUG_ON(ret);
+                        btrfs_remove_leaf_ref(root, ref);
+                        btrfs_free_leaf_ref(root, ref);
+                } else {
+                        /*
+                         * the leaf wasn't in the reference cache, so
+                         * we have to read it.
+                         */
+                        leaf = read_tree_block(root, bytenr, blocksize,
+                                               ptr_gen);
+                        ret = btrfs_drop_leaf_ref(trans, root, leaf);
+                        BUG_ON(ret);
+                        free_extent_buffer(leaf);
+                }
+                atomic_inc(&root->fs_info->throttle_gen);
+                wake_up(&root->fs_info->transaction_throttle);
+                cond_resched();
+        }
+
+        /*
+         * run through the loop again to free the refs on the leaves.
+         * This is faster than doing it in the loop above because
+         * the leaves are likely to be clustered together.  We end up
+         * working in nice chunks on the extent allocation tree.
+         */
+        for (i = 0; i < refi; i++) {
+                bytenr = sorted[i].bytenr;
+                ret = __btrfs_free_extent(trans, root, bytenr,
+                                        blocksize, eb->start,
+                                        root_owner, root_gen, 0, 1);
+                BUG_ON(ret);
+
+                atomic_inc(&root->fs_info->throttle_gen);
+                wake_up(&root->fs_info->transaction_throttle);
+                cond_resched();
+        }
+out:
+        kfree(sorted);
+
+        /*
+         * update the path to show we've processed the entire level 1
+         * node.  This will get saved into the root's drop_snapshot_progress
+         * field so these drops are not repeated again if this transaction
+         * commits.
+         */
+        path->slots[1] = nritems;
+        return 0;
+}
+
+/*
  * helper function for drop_snapshot, this walks down the tree dropping ref
  * counts as it goes.
  */
@@ -3511,7 +3787,6 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
         struct extent_buffer *next;
         struct extent_buffer *cur;
         struct extent_buffer *parent;
-        struct btrfs_leaf_ref *ref;
         u32 blocksize;
         int ret;
         u32 refs;
@@ -3538,17 +3813,46 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
                 if (path->slots[*level] >=
                     btrfs_header_nritems(cur))
                         break;
+
+                /* the new code goes down to level 1 and does all the
+                 * leaves pointed to that node in bulk.  So, this check
+                 * for level 0 will always be false.
+                 *
+                 * But, the disk format allows the drop_snapshot_progress
+                 * field in the root to leave things in a state where
+                 * a leaf will need cleaning up here.  If someone crashes
+                 * with the old code and then boots with the new code,
+                 * we might find a leaf here.
+                 */
                 if (*level == 0) {
                         ret = btrfs_drop_leaf_ref(trans, root, cur);
                         BUG_ON(ret);
                         break;
                 }
+
+                /*
+                 * once we get to level one, process the whole node
+                 * at once, including everything below it.
+                 */
+                if (*level == 1) {
+                        ret = drop_level_one_refs(trans, root, path);
+                        BUG_ON(ret);
+                        break;
+                }
+
                 bytenr = btrfs_node_blockptr(cur, path->slots[*level]);
                 ptr_gen = btrfs_node_ptr_generation(cur, path->slots[*level]);
                 blocksize = btrfs_level_size(root, *level - 1);
 
                 ret = drop_snap_lookup_refcount(root, bytenr, blocksize, &refs);
                 BUG_ON(ret);
+
+                /*
+                 * if there is more than one reference, we don't need
+                 * to read that node to drop any references it has.  We
+                 * just drop the ref we hold on that node and move on to the
+                 * next slot in this level.
+                 */
                 if (refs != 1) {
                         parent = path->nodes[*level];
                         root_owner = btrfs_header_owner(parent);
@@ -3567,46 +3871,12 @@ static noinline int walk_down_tree(struct btrfs_trans_handle *trans,
 
                         continue;
                 }
+
                 /*
-                 * at this point, we have a single ref, and since the
-                 * only place referencing this extent is a dead root
-                 * the reference count should never go higher.
-                 * So, we don't need to check it again
+                 * we need to keep freeing things in the next level down.
+                 * read the block and loop around to process it
                  */
-                if (*level == 1) {
-                        ref = btrfs_lookup_leaf_ref(root, bytenr);
-                        if (ref && ref->generation != ptr_gen) {
-                                btrfs_free_leaf_ref(root, ref);
-                                ref = NULL;
-                        }
-                        if (ref) {
-                                ret = cache_drop_leaf_ref(trans, root, ref);
-                                BUG_ON(ret);
-                                btrfs_remove_leaf_ref(root, ref);
-                                btrfs_free_leaf_ref(root, ref);
-                                *level = 0;
-                                break;
-                        }
-                }
-                next = btrfs_find_tree_block(root, bytenr, blocksize);
-                if (!next || !btrfs_buffer_uptodate(next, ptr_gen)) {
-                        free_extent_buffer(next);
-
-                        next = read_tree_block(root, bytenr, blocksize,
-                                               ptr_gen);
-                        cond_resched();
-#if 0
-                        /*
-                         * this is a debugging check and can go away
-                         * the ref should never go all the way down to 1
-                         * at this point
-                         */
-                        ret = lookup_extent_ref(NULL, root, bytenr, blocksize,
-                                                &refs);
-                        BUG_ON(ret);
-                        WARN_ON(refs != 1);
-#endif
-                }
+                next = read_tree_block(root, bytenr, blocksize, ptr_gen);
                 WARN_ON(*level <= 0);
                 if (path->nodes[*level-1])
                         free_extent_buffer(path->nodes[*level-1]);
@@ -3631,11 +3901,16 @@ out:
         root_owner = btrfs_header_owner(parent);
         root_gen = btrfs_header_generation(parent);
 
+        /*
+         * cleanup and free the reference on the last node
+         * we processed
+         */
         ret = __btrfs_free_extent(trans, root, bytenr, blocksize,
                                   parent->start, root_owner, root_gen,
                                   *level, 1);
         free_extent_buffer(path->nodes[*level]);
         path->nodes[*level] = NULL;
+
         *level += 1;
         BUG_ON(ret);
 
@@ -3687,6 +3962,7 @@ static noinline int walk_down_subtree(struct btrfs_trans_handle *trans,
 
                 next = read_tree_block(root, bytenr, blocksize, ptr_gen);
                 btrfs_tree_lock(next);
+                btrfs_set_lock_blocking(next);
 
                 ret = btrfs_lookup_extent_ref(trans, root, bytenr, blocksize,
                                               &refs);
@@ -3754,6 +4030,13 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
                 if (slot < btrfs_header_nritems(path->nodes[i]) - 1) {
                         struct extent_buffer *node;
                         struct btrfs_disk_key disk_key;
+
+                        /*
+                         * there is more work to do in this level.
+                         * Update the drop_progress marker to reflect
+                         * the work we've done so far, and then bump
+                         * the slot number
+                         */
                         node = path->nodes[i];
                         path->slots[i]++;
                         *level = i;
@@ -3765,6 +4048,11 @@ static noinline int walk_up_tree(struct btrfs_trans_handle *trans,
                         return 0;
                 } else {
                         struct extent_buffer *parent;
+
+                        /*
+                         * this whole node is done, free our reference
+                         * on it and go up one level
+                         */
                         if (path->nodes[*level] == root->node)
                                 parent = path->nodes[*level];
                         else
@@ -4444,7 +4732,7 @@ static noinline int replace_one_extent(struct btrfs_trans_handle *trans,
         u64 lock_end = 0;
         u64 num_bytes;
         u64 ext_offset;
-        u64 first_pos;
+        u64 search_end = (u64)-1;
         u32 nritems;
         int nr_scaned = 0;
         int extent_locked = 0;
@@ -4452,7 +4740,6 @@ static noinline int replace_one_extent(struct btrfs_trans_handle *trans,
         int ret;
 
         memcpy(&key, leaf_key, sizeof(key));
-        first_pos = INT_LIMIT(loff_t) - extent_key->offset;
         if (ref_path->owner_objectid != BTRFS_MULTIPLE_OBJECTIDS) {
                 if (key.objectid < ref_path->owner_objectid ||
                     (key.objectid == ref_path->owner_objectid &&
@@ -4501,7 +4788,7 @@ next:
                         if ((key.objectid > ref_path->owner_objectid) ||
                             (key.objectid == ref_path->owner_objectid &&
                              key.type > BTRFS_EXTENT_DATA_KEY) ||
-                            (key.offset >= first_pos + extent_key->offset))
+                            key.offset >= search_end)
                                 break;
                 }
 
@@ -4534,8 +4821,10 @@ next:
                 num_bytes = btrfs_file_extent_num_bytes(leaf, fi);
                 ext_offset = btrfs_file_extent_offset(leaf, fi);
 
-                if (first_pos > key.offset - ext_offset)
-                        first_pos = key.offset - ext_offset;
+                if (search_end == (u64)-1) {
+                        search_end = key.offset - ext_offset +
+                                btrfs_file_extent_ram_bytes(leaf, fi);
+                }
 
                 if (!extent_locked) {
                         lock_start = key.offset;
@@ -4724,7 +5013,7 @@ next:
                 }
 skip:
                 if (ref_path->owner_objectid != BTRFS_MULTIPLE_OBJECTIDS &&
-                    key.offset >= first_pos + extent_key->offset)
+                    key.offset >= search_end)
                         break;
 
                 cond_resched();
@@ -4778,6 +5067,7 @@ int btrfs_reloc_tree_cache_ref(struct btrfs_trans_handle *trans,
                 ref->bytenr = buf->start;
                 ref->owner = btrfs_header_owner(buf);
                 ref->generation = btrfs_header_generation(buf);
+
                 ret = btrfs_add_leaf_ref(root, ref, 0);
                 WARN_ON(ret);
                 btrfs_free_leaf_ref(root, ref);
@@ -5957,9 +6247,11 @@ int btrfs_remove_block_group(struct btrfs_trans_handle *trans,
         path = btrfs_alloc_path();
         BUG_ON(!path);
 
-        btrfs_remove_free_space_cache(block_group);
+        spin_lock(&root->fs_info->block_group_cache_lock);
         rb_erase(&block_group->cache_node,
                  &root->fs_info->block_group_cache_tree);
+        spin_unlock(&root->fs_info->block_group_cache_lock);
+        btrfs_remove_free_space_cache(block_group);
         down_write(&block_group->space_info->groups_sem);
         list_del(&block_group->list);
         up_write(&block_group->space_info->groups_sem);
diff --git a/fs/btrfs/extent_io.c b/fs/btrfs/extent_io.c
index e086d407f1f..37d43b516b7 100644
--- a/fs/btrfs/extent_io.c
+++ b/fs/btrfs/extent_io.c
@@ -9,7 +9,6 @@
 #include <linux/spinlock.h>
 #include <linux/blkdev.h>
 #include <linux/swap.h>
-#include <linux/version.h>
 #include <linux/writeback.h>
 #include <linux/pagevec.h>
 #include "extent_io.h"
@@ -31,7 +30,7 @@ static LIST_HEAD(buffers);
 static LIST_HEAD(states);
 
 #define LEAK_DEBUG 0
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
 static DEFINE_SPINLOCK(leak_lock);
 #endif
 
@@ -120,7 +119,7 @@ void extent_io_tree_init(struct extent_io_tree *tree,
 static struct extent_state *alloc_extent_state(gfp_t mask)
 {
         struct extent_state *state;
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         unsigned long flags;
 #endif
 
@@ -130,7 +129,7 @@ static struct extent_state *alloc_extent_state(gfp_t mask)
         state->state = 0;
         state->private = 0;
         state->tree = NULL;
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         spin_lock_irqsave(&leak_lock, flags);
         list_add(&state->leak_list, &states);
         spin_unlock_irqrestore(&leak_lock, flags);
@@ -145,11 +144,11 @@ static void free_extent_state(struct extent_state *state)
         if (!state)
                 return;
         if (atomic_dec_and_test(&state->refs)) {
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
                 unsigned long flags;
 #endif
                 WARN_ON(state->tree);
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
                 spin_lock_irqsave(&leak_lock, flags);
                 list_del(&state->leak_list);
                 spin_unlock_irqrestore(&leak_lock, flags);
@@ -2378,11 +2377,6 @@ static int extent_write_cache_pages(struct extent_io_tree *tree,
         int scanned = 0;
         int range_whole = 0;
 
-        if (wbc->nonblocking && bdi_write_congested(bdi)) {
-                wbc->encountered_congestion = 1;
-                return 0;
-        }
-
         pagevec_init(&pvec, 0);
         if (wbc->range_cyclic) {
                 index = mapping->writeback_index; /* Start from prev offset */
@@ -2855,6 +2849,98 @@ out:
         return sector;
 }
 
+int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+                __u64 start, __u64 len, get_extent_t *get_extent)
+{
+        int ret;
+        u64 off = start;
+        u64 max = start + len;
+        u32 flags = 0;
+        u64 disko = 0;
+        struct extent_map *em = NULL;
+        int end = 0;
+        u64 em_start = 0, em_len = 0;
+        unsigned long emflags;
+        ret = 0;
+
+        if (len == 0)
+                return -EINVAL;
+
+        lock_extent(&BTRFS_I(inode)->io_tree, start, start + len,
+                GFP_NOFS);
+        em = get_extent(inode, NULL, 0, off, max - off, 0);
+        if (!em)
+                goto out;
+        if (IS_ERR(em)) {
+                ret = PTR_ERR(em);
+                goto out;
+        }
+        while (!end) {
+                off = em->start + em->len;
+                if (off >= max)
+                        end = 1;
+
+                em_start = em->start;
+                em_len = em->len;
+
+                disko = 0;
+                flags = 0;
+
+                switch (em->block_start) {
+                case EXTENT_MAP_LAST_BYTE:
+                        end = 1;
+                        flags |= FIEMAP_EXTENT_LAST;
+                        break;
+                case EXTENT_MAP_HOLE:
+                        flags |= FIEMAP_EXTENT_UNWRITTEN;
+                        break;
+                case EXTENT_MAP_INLINE:
+                        flags |= (FIEMAP_EXTENT_DATA_INLINE |
+                                  FIEMAP_EXTENT_NOT_ALIGNED);
+                        break;
+                case EXTENT_MAP_DELALLOC:
+                        flags |= (FIEMAP_EXTENT_DELALLOC |
+                                  FIEMAP_EXTENT_UNKNOWN);
+                        break;
+                default:
+                        disko = em->block_start;
+                        break;
+                }
+                if (test_bit(EXTENT_FLAG_COMPRESSED, &em->flags))
+                        flags |= FIEMAP_EXTENT_ENCODED;
+
+                emflags = em->flags;
+                free_extent_map(em);
+                em = NULL;
+
+                if (!end) {
+                        em = get_extent(inode, NULL, 0, off, max - off, 0);
+                        if (!em)
+                                goto out;
+                        if (IS_ERR(em)) {
+                                ret = PTR_ERR(em);
+                                goto out;
+                        }
+                        emflags = em->flags;
+                }
+                if (test_bit(EXTENT_FLAG_VACANCY, &emflags)) {
+                        flags |= FIEMAP_EXTENT_LAST;
+                        end = 1;
+                }
+
+                ret = fiemap_fill_next_extent(fieinfo, em_start, disko,
+                                        em_len, flags);
+                if (ret)
+                        goto out_free;
+        }
+out_free:
+        free_extent_map(em);
+out:
+        unlock_extent(&BTRFS_I(inode)->io_tree, start, start + len,
+                        GFP_NOFS);
+        return ret;
+}
+
 static inline struct page *extent_buffer_page(struct extent_buffer *eb,
                                               unsigned long i)
 {
@@ -2892,15 +2978,17 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_io_tree *tree,
                                                    gfp_t mask)
 {
         struct extent_buffer *eb = NULL;
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         unsigned long flags;
 #endif
 
         eb = kmem_cache_zalloc(extent_buffer_cache, mask);
         eb->start = start;
         eb->len = len;
-        mutex_init(&eb->mutex);
-#ifdef LEAK_DEBUG
+        spin_lock_init(&eb->lock);
+        init_waitqueue_head(&eb->lock_wq);
+
+#if LEAK_DEBUG
         spin_lock_irqsave(&leak_lock, flags);
         list_add(&eb->leak_list, &buffers);
         spin_unlock_irqrestore(&leak_lock, flags);
@@ -2912,7 +3000,7 @@ static struct extent_buffer *__alloc_extent_buffer(struct extent_io_tree *tree,
 
 static void __free_extent_buffer(struct extent_buffer *eb)
 {
-#ifdef LEAK_DEBUG
+#if LEAK_DEBUG
         unsigned long flags;
         spin_lock_irqsave(&leak_lock, flags);
         list_del(&eb->leak_list);
@@ -2980,8 +3068,7 @@ struct extent_buffer *alloc_extent_buffer(struct extent_io_tree *tree,
                 unlock_page(p);
         }
         if (uptodate)
-                eb->flags |= EXTENT_UPTODATE;
-        eb->flags |= EXTENT_BUFFER_FILLED;
+                set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
         spin_lock(&tree->buffer_lock);
         exists = buffer_tree_insert(tree, start, &eb->rb_node);
@@ -3135,7 +3222,7 @@ int clear_extent_buffer_uptodate(struct extent_io_tree *tree,
         unsigned long num_pages;
 
         num_pages = num_extent_pages(eb->start, eb->len);
-        eb->flags &= ~EXTENT_UPTODATE;
+        clear_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
 
         clear_extent_uptodate(tree, eb->start, eb->start + eb->len - 1,
                               GFP_NOFS);
@@ -3206,7 +3293,7 @@ int extent_buffer_uptodate(struct extent_io_tree *tree,
         struct page *page;
         int pg_uptodate = 1;
 
-        if (eb->flags & EXTENT_UPTODATE)
+        if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))
                 return 1;
 
         ret = test_range_bit(tree, eb->start, eb->start + eb->len - 1,
@@ -3242,7 +3329,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         struct bio *bio = NULL;
         unsigned long bio_flags = 0;
 
-        if (eb->flags & EXTENT_UPTODATE)
+        if (test_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags))
                 return 0;
 
         if (test_range_bit(tree, eb->start, eb->start + eb->len - 1,
@@ -3273,7 +3360,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         }
         if (all_uptodate) {
                 if (start_i == 0)
-                        eb->flags |= EXTENT_UPTODATE;
+                        set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
                 goto unlock_exit;
         }
 
@@ -3309,7 +3396,7 @@ int read_extent_buffer_pages(struct extent_io_tree *tree,
         }
 
         if (!ret)
-                eb->flags |= EXTENT_UPTODATE;
+                set_bit(EXTENT_BUFFER_UPTODATE, &eb->bflags);
         return ret;
 
 unlock_exit:
@@ -3406,7 +3493,6 @@ int map_extent_buffer(struct extent_buffer *eb, unsigned long start,
                 unmap_extent_buffer(eb, eb->map_token, km);
                 eb->map_token = NULL;
                 save = 1;
-                WARN_ON(!mutex_is_locked(&eb->mutex));
         }
         err = map_private_extent_buffer(eb, start, min_len, token, map,
                                        map_start, map_len, km);
diff --git a/fs/btrfs/extent_io.h b/fs/btrfs/extent_io.h
index c5b483a7913..1f9df88afbf 100644
--- a/fs/btrfs/extent_io.h
+++ b/fs/btrfs/extent_io.h
@@ -22,6 +22,10 @@
 /* flags for bio submission */
 #define EXTENT_BIO_COMPRESSED 1
 
+/* these are bit numbers for test/set bit */
+#define EXTENT_BUFFER_UPTODATE 0
+#define EXTENT_BUFFER_BLOCKING 1
+
 /*
  * page->private values.  Every page that is controlled by the extent
  * map has page->private set to one.
@@ -95,11 +99,19 @@ struct extent_buffer {
         unsigned long map_start;
         unsigned long map_len;
         struct page *first_page;
+        unsigned long bflags;
         atomic_t refs;
-        int flags;
         struct list_head leak_list;
         struct rb_node rb_node;
-        struct mutex mutex;
+
+        /* the spinlock is used to protect most operations */
+        spinlock_t lock;
+
+        /*
+         * when we keep the lock held while blocking, waiters go onto
+         * the wq
+         */
+        wait_queue_head_t lock_wq;
 };
 
 struct extent_map_tree;
@@ -193,6 +205,8 @@ int extent_commit_write(struct extent_io_tree *tree,
                         unsigned from, unsigned to);
 sector_t extent_bmap(struct address_space *mapping, sector_t iblock,
                 get_extent_t *get_extent);
+int extent_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+                __u64 start, __u64 len, get_extent_t *get_extent);
 int set_range_dirty(struct extent_io_tree *tree, u64 start, u64 end);
 int set_state_private(struct extent_io_tree *tree, u64 start, u64 private);
 int get_state_private(struct extent_io_tree *tree, u64 start, u64 *private);
diff --git a/fs/btrfs/extent_map.c b/fs/btrfs/extent_map.c
index 4a83e33ada3..50da69da20c 100644
--- a/fs/btrfs/extent_map.c
+++ b/fs/btrfs/extent_map.c
@@ -3,7 +3,6 @@
 #include <linux/slab.h>
 #include <linux/module.h>
 #include <linux/spinlock.h>
-#include <linux/version.h>
 #include <linux/hardirq.h>
 #include "extent_map.h"
 
diff --git a/fs/btrfs/file.c b/fs/btrfs/file.c
index 90268334145..3e8023efaff 100644
--- a/fs/btrfs/file.c
+++ b/fs/btrfs/file.c
@@ -29,7 +29,6 @@
 #include <linux/writeback.h>
 #include <linux/statfs.h>
 #include <linux/compat.h>
-#include <linux/version.h>
 #include "ctree.h"
 #include "disk-io.h"
 #include "transaction.h"
@@ -1215,10 +1214,10 @@ int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync)
         }
         mutex_unlock(&root->fs_info->trans_mutex);
 
-        root->fs_info->tree_log_batch++;
+        root->log_batch++;
         filemap_fdatawrite(inode->i_mapping);
         btrfs_wait_ordered_range(inode, 0, (u64)-1);
-        root->fs_info->tree_log_batch++;
+        root->log_batch++;
 
         /*
          * ok we haven't committed the transaction yet, lets do a commit
diff --git a/fs/btrfs/inode.c b/fs/btrfs/inode.c
index 8adfe059ab4..8f0706210a4 100644
--- a/fs/btrfs/inode.c
+++ b/fs/btrfs/inode.c
@@ -34,7 +34,6 @@
 #include <linux/statfs.h>
 #include <linux/compat.h>
 #include <linux/bit_spinlock.h>
-#include <linux/version.h>
 #include <linux/xattr.h>
 #include <linux/posix_acl.h>
 #include <linux/falloc.h>
@@ -51,6 +50,7 @@
 #include "tree-log.h"
 #include "ref-cache.h"
 #include "compression.h"
+#include "locking.h"
 
 struct btrfs_iget_args {
         u64 ino;
@@ -91,6 +91,16 @@ static noinline int cow_file_range(struct inode *inode,
                                    u64 start, u64 end, int *page_started,
                                    unsigned long *nr_written, int unlock);
 
+static int btrfs_init_inode_security(struct inode *inode,  struct inode *dir)
+{
+        int err;
+
+        err = btrfs_init_acl(inode, dir);
+        if (!err)
+                err = btrfs_xattr_security_init(inode, dir);
+        return err;
+}
+
 /*
  * a very lame attempt at stopping writes when the FS is 85% full.  There
  * are countless ways this is incorrect, but it is better than nothing.
@@ -350,6 +360,19 @@ again:
         nr_pages = (end >> PAGE_CACHE_SHIFT) - (start >> PAGE_CACHE_SHIFT) + 1;
         nr_pages = min(nr_pages, (128 * 1024UL) / PAGE_CACHE_SIZE);
 
+        /*
+         * we don't want to send crud past the end of i_size through
+         * compression, that's just a waste of CPU time.  So, if the
+         * end of the file is before the start of our current
+         * requested range of bytes, we bail out to the uncompressed
+         * cleanup code that can deal with all of this.
+         *
+         * It isn't really the fastest way to fix things, but this is a
+         * very uncommon corner.
+         */
+        if (actual_end <= start)
+                goto cleanup_and_bail_uncompressed;
+
         total_compressed = actual_end - start;
 
         /* we want to make sure that amount of ram required to uncompress
@@ -494,6 +517,7 @@ again:
                         goto again;
                 }
         } else {
+cleanup_and_bail_uncompressed:
                 /*
                  * No compression, but we still need to write the pages in
                  * the file we've been given so far.  redirty the locked
@@ -1324,12 +1348,11 @@ static noinline int add_pending_csums(struct btrfs_trans_handle *trans,
                              struct inode *inode, u64 file_offset,
                              struct list_head *list)
 {
-        struct list_head *cur;
         struct btrfs_ordered_sum *sum;
 
         btrfs_set_trans_block_group(trans, inode);
-        list_for_each(cur, list) {
-                sum = list_entry(cur, struct btrfs_ordered_sum, list);
+
+        list_for_each_entry(sum, list, list) {
                 btrfs_csum_file_blocks(trans,
                        BTRFS_I(inode)->root->fs_info->csum_root, sum);
         }
@@ -2013,6 +2036,7 @@ void btrfs_read_locked_inode(struct inode *inode)
         BTRFS_I(inode)->flags = btrfs_inode_flags(leaf, inode_item);
 
         alloc_group_block = btrfs_inode_block_group(leaf, inode_item);
+
         BTRFS_I(inode)->block_group = btrfs_find_block_group(root, 0,
                                                 alloc_group_block, 0);
         btrfs_free_path(path);
@@ -2039,6 +2063,7 @@ void btrfs_read_locked_inode(struct inode *inode)
                 inode->i_mapping->backing_dev_info = &root->fs_info->bdi;
                 break;
         default:
+                inode->i_op = &btrfs_special_inode_operations;
                 init_special_inode(inode, inode->i_mode, rdev);
                 break;
         }
@@ -2108,6 +2133,7 @@ noinline int btrfs_update_inode(struct btrfs_trans_handle *trans,
                 goto failed;
         }
 
+        btrfs_unlock_up_safe(path, 1);
         leaf = path->nodes[0];
         inode_item = btrfs_item_ptr(leaf, path->slots[0],
                                   struct btrfs_inode_item);
@@ -2429,6 +2455,8 @@ next_node:
                         ref->generation = leaf_gen;
                         ref->nritems = 0;
 
+                        btrfs_sort_leaf_ref(ref);
+
                         ret = btrfs_add_leaf_ref(root, ref, 0);
                         WARN_ON(ret);
                         btrfs_free_leaf_ref(root, ref);
@@ -2476,7 +2504,7 @@ noinline int btrfs_truncate_inode_items(struct btrfs_trans_handle *trans,
         struct btrfs_path *path;
         struct btrfs_key key;
         struct btrfs_key found_key;
-        u32 found_type;
+        u32 found_type = (u8)-1;
         struct extent_buffer *leaf;
         struct btrfs_file_extent_item *fi;
         u64 extent_start = 0;
@@ -2663,6 +2691,8 @@ next:
                         if (pending_del_nr)
                                 goto del_pending;
                         btrfs_release_path(root, path);
+                        if (found_type == BTRFS_INODE_ITEM_KEY)
+                                break;
                         goto search_again;
                 }
 
@@ -2679,6 +2709,8 @@ del_pending:
                         BUG_ON(ret);
                         pending_del_nr = 0;
                         btrfs_release_path(root, path);
+                        if (found_type == BTRFS_INODE_ITEM_KEY)
+                                break;
                         goto search_again;
                 }
         }
@@ -3265,7 +3297,7 @@ skip:
 
         /* Reached end of directory/root. Bump pos past the last item. */
         if (key_type == BTRFS_DIR_INDEX_KEY)
-                filp->f_pos = INT_LIMIT(typeof(filp->f_pos));
+                filp->f_pos = INT_LIMIT(off_t);
         else
                 filp->f_pos++;
 nopos:
@@ -3458,7 +3490,14 @@ static struct inode *btrfs_new_inode(struct btrfs_trans_handle *trans,
                 root->highest_inode = objectid;
 
         inode->i_uid = current_fsuid();
-        inode->i_gid = current_fsgid();
+
+        if (dir && (dir->i_mode & S_ISGID)) {
+                inode->i_gid = dir->i_gid;
+                if (S_ISDIR(mode))
+                        mode |= S_ISGID;
+        } else
+                inode->i_gid = current_fsgid();
+
         inode->i_mode = mode;
         inode->i_ino = objectid;
         inode_set_bytes(inode, 0);
@@ -3586,7 +3625,7 @@ static int btrfs_mknod(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 goto out_unlock;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err) {
                 drop_inode = 1;
                 goto out_unlock;
@@ -3649,7 +3688,7 @@ static int btrfs_create(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 goto out_unlock;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err) {
                 drop_inode = 1;
                 goto out_unlock;
@@ -3772,7 +3811,7 @@ static int btrfs_mkdir(struct inode *dir, struct dentry *dentry, int mode)
 
         drop_on_err = 1;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err)
                 goto out_fail;
 
@@ -4158,9 +4197,10 @@ static ssize_t btrfs_direct_IO(int rw, struct kiocb *iocb,
         return -EINVAL;
 }
 
-static sector_t btrfs_bmap(struct address_space *mapping, sector_t iblock)
+static int btrfs_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
+                __u64 start, __u64 len)
 {
-        return extent_bmap(mapping, iblock, btrfs_get_extent);
+        return extent_fiemap(inode, fieinfo, start, len, btrfs_get_extent);
 }
 
 int btrfs_readpage(struct file *file, struct page *page)
@@ -4733,7 +4773,7 @@ static int btrfs_symlink(struct inode *dir, struct dentry *dentry,
         if (IS_ERR(inode))
                 goto out_unlock;
 
-        err = btrfs_init_acl(inode, dir);
+        err = btrfs_init_inode_security(inode, dir);
         if (err) {
                 drop_inode = 1;
                 goto out_unlock;
@@ -4987,13 +5027,24 @@ static struct extent_io_ops btrfs_extent_io_ops = {
         .clear_bit_hook = btrfs_clear_bit_hook,
 };
 
+/*
+ * btrfs doesn't support the bmap operation because swapfiles
+ * use bmap to make a mapping of extents in the file.  They assume
+ * these extents won't change over the life of the file and they
+ * use the bmap result to do IO directly to the drive.
+ *
+ * the btrfs bmap call would return logical addresses that aren't
+ * suitable for IO and they also will change frequently as COW
+ * operations happen.  So, swapfile + btrfs == corruption.
+ *
+ * For now we're avoiding this by dropping bmap.
+ */
 static struct address_space_operations btrfs_aops = {
         .readpage       = btrfs_readpage,
         .writepage      = btrfs_writepage,
         .writepages     = btrfs_writepages,
         .readpages      = btrfs_readpages,
         .sync_page      = block_sync_page,
-        .bmap           = btrfs_bmap,
         .direct_IO      = btrfs_direct_IO,
         .invalidatepage = btrfs_invalidatepage,
         .releasepage    = btrfs_releasepage,
@@ -5017,6 +5068,7 @@ static struct inode_operations btrfs_file_inode_operations = {
         .removexattr    = btrfs_removexattr,
         .permission     = btrfs_permission,
         .fallocate      = btrfs_fallocate,
+        .fiemap         = btrfs_fiemap,
 };
 static struct inode_operations btrfs_special_inode_operations = {
         .getattr        = btrfs_getattr,
@@ -5032,4 +5084,8 @@ static struct inode_operations btrfs_symlink_inode_operations = {
         .follow_link    = page_follow_link_light,
         .put_link       = page_put_link,
         .permission     = btrfs_permission,
+        .setxattr       = btrfs_setxattr,
+        .getxattr       = btrfs_getxattr,
+        .listxattr      = btrfs_listxattr,
+        .removexattr    = btrfs_removexattr,
 };
diff --git a/fs/btrfs/ioctl.c b/fs/btrfs/ioctl.c
index c2aa33e3feb..988fdc8b49e 100644
--- a/fs/btrfs/ioctl.c
+++ b/fs/btrfs/ioctl.c
@@ -38,7 +38,6 @@
 #include <linux/compat.h>
 #include <linux/bit_spinlock.h>
 #include <linux/security.h>
-#include <linux/version.h>
 #include <linux/xattr.h>
 #include <linux/vmalloc.h>
 #include "compat.h"
diff --git a/fs/btrfs/locking.c b/fs/btrfs/locking.c
index 39bae7761db..9ebe9385129 100644
--- a/fs/btrfs/locking.c
+++ b/fs/btrfs/locking.c
@@ -26,63 +26,213 @@
 #include "locking.h"
 
 /*
- * locks the per buffer mutex in an extent buffer.  This uses adaptive locks
- * and the spin is not tuned very extensively.  The spinning does make a big
- * difference in almost every workload, but spinning for the right amount of
- * time needs some help.
- *
- * In general, we want to spin as long as the lock holder is doing btree
- * searches, and we should give up if they are in more expensive code.
+ * btrfs_header_level() isn't free, so don't call it when lockdep isn't
+ * on
  */
+#ifdef CONFIG_DEBUG_LOCK_ALLOC
+static inline void spin_nested(struct extent_buffer *eb)
+{
+        spin_lock_nested(&eb->lock, BTRFS_MAX_LEVEL - btrfs_header_level(eb));
+}
+#else
+static inline void spin_nested(struct extent_buffer *eb)
+{
+        spin_lock(&eb->lock);
+}
+#endif
 
-int btrfs_tree_lock(struct extent_buffer *eb)
+/*
+ * Setting a lock to blocking will drop the spinlock and set the
+ * flag that forces other procs who want the lock to wait.  After
+ * this you can safely schedule with the lock held.
+ */
+void btrfs_set_lock_blocking(struct extent_buffer *eb)
 {
-        int i;
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags)) {
+                set_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags);
+                spin_unlock(&eb->lock);
+        }
+        /* exit with the spin lock released and the bit set */
+}
 
-        if (mutex_trylock(&eb->mutex))
-                return 0;
+/*
+ * clearing the blocking flag will take the spinlock again.
+ * After this you can't safely schedule
+ */
+void btrfs_clear_lock_blocking(struct extent_buffer *eb)
+{
+        if (test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags)) {
+                spin_nested(eb);
+                clear_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags);
+                smp_mb__after_clear_bit();
+        }
+        /* exit with the spin lock held */
+}
+
+/*
+ * unfortunately, many of the places that currently set a lock to blocking
+ * don't end up blocking for every long, and often they don't block
+ * at all.  For a dbench 50 run, if we don't spin one the blocking bit
+ * at all, the context switch rate can jump up to 400,000/sec or more.
+ *
+ * So, we're still stuck with this crummy spin on the blocking bit,
+ * at least until the most common causes of the short blocks
+ * can be dealt with.
+ */
+static int btrfs_spin_on_block(struct extent_buffer *eb)
+{
+        int i;
         for (i = 0; i < 512; i++) {
                 cpu_relax();
-                if (mutex_trylock(&eb->mutex))
-                        return 0;
+                if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        return 1;
+                if (need_resched())
+                        break;
         }
-        cpu_relax();
-        mutex_lock_nested(&eb->mutex, BTRFS_MAX_LEVEL - btrfs_header_level(eb));
         return 0;
 }
 
-int btrfs_try_tree_lock(struct extent_buffer *eb)
+/*
+ * This is somewhat different from trylock.  It will take the
+ * spinlock but if it finds the lock is set to blocking, it will
+ * return without the lock held.
+ *
+ * returns 1 if it was able to take the lock and zero otherwise
+ *
+ * After this call, scheduling is not safe without first calling
+ * btrfs_set_lock_blocking()
+ */
+int btrfs_try_spin_lock(struct extent_buffer *eb)
 {
-        return mutex_trylock(&eb->mutex);
+        int i;
+
+        spin_nested(eb);
+        if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                return 1;
+        spin_unlock(&eb->lock);
+
+        /* spin for a bit on the BLOCKING flag */
+        for (i = 0; i < 2; i++) {
+                if (!btrfs_spin_on_block(eb))
+                        break;
+
+                spin_nested(eb);
+                if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        return 1;
+                spin_unlock(&eb->lock);
+        }
+        return 0;
 }
 
-int btrfs_tree_unlock(struct extent_buffer *eb)
+/*
+ * the autoremove wake function will return 0 if it tried to wake up
+ * a process that was already awake, which means that process won't
+ * count as an exclusive wakeup.  The waitq code will continue waking
+ * procs until it finds one that was actually sleeping.
+ *
+ * For btrfs, this isn't quite what we want.  We want a single proc
+ * to be notified that the lock is ready for taking.  If that proc
+ * already happen to be awake, great, it will loop around and try for
+ * the lock.
+ *
+ * So, btrfs_wake_function always returns 1, even when the proc that we
+ * tried to wake up was already awake.
+ */
+static int btrfs_wake_function(wait_queue_t *wait, unsigned mode,
+                               int sync, void *key)
 {
-        mutex_unlock(&eb->mutex);
-        return 0;
+        autoremove_wake_function(wait, mode, sync, key);
+        return 1;
 }
 
-int btrfs_tree_locked(struct extent_buffer *eb)
+/*
+ * returns with the extent buffer spinlocked.
+ *
+ * This will spin and/or wait as required to take the lock, and then
+ * return with the spinlock held.
+ *
+ * After this call, scheduling is not safe without first calling
+ * btrfs_set_lock_blocking()
+ */
+int btrfs_tree_lock(struct extent_buffer *eb)
 {
-        return mutex_is_locked(&eb->mutex);
+        DEFINE_WAIT(wait);
+        wait.func = btrfs_wake_function;
+
+        while(1) {
+                spin_nested(eb);
+
+                /* nobody is blocking, exit with the spinlock held */
+                if (!test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        return 0;
+
+                /*
+                 * we have the spinlock, but the real owner is blocking.
+                 * wait for them
+                 */
+                spin_unlock(&eb->lock);
+
+                /*
+                 * spin for a bit, and if the blocking flag goes away,
+                 * loop around
+                 */
+                if (btrfs_spin_on_block(eb))
+                        continue;
+
+                prepare_to_wait_exclusive(&eb->lock_wq, &wait,
+                                          TASK_UNINTERRUPTIBLE);
+
+                if (test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                        schedule();
+
+                finish_wait(&eb->lock_wq, &wait);
+        }
+        return 0;
 }
 
 /*
- * btrfs_search_slot uses this to decide if it should drop its locks
- * before doing something expensive like allocating free blocks for cow.
+ * Very quick trylock, this does not spin or schedule.  It returns
+ * 1 with the spinlock held if it was able to take the lock, or it
+ * returns zero if it was unable to take the lock.
+ *
+ * After this call, scheduling is not safe without first calling
+ * btrfs_set_lock_blocking()
  */
-int btrfs_path_lock_waiting(struct btrfs_path *path, int level)
+int btrfs_try_tree_lock(struct extent_buffer *eb)
 {
-        int i;
-        struct extent_buffer *eb;
-        for (i = level; i <= level + 1 && i < BTRFS_MAX_LEVEL; i++) {
-                eb = path->nodes[i];
-                if (!eb)
-                        break;
-                smp_mb();
-                if (!list_empty(&eb->mutex.wait_list))
-                        return 1;
+        if (spin_trylock(&eb->lock)) {
+                if (test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags)) {
+                        /*
+                         * we've got the spinlock, but the real owner is
+                         * blocking.  Drop the spinlock and return failure
+                         */
+                        spin_unlock(&eb->lock);
+                        return 0;
+                }
+                return 1;
         }
+        /* someone else has the spinlock giveup */
         return 0;
 }
 
+int btrfs_tree_unlock(struct extent_buffer *eb)
+{
+        /*
+         * if we were a blocking owner, we don't have the spinlock held
+         * just clear the bit and look for waiters
+         */
+        if (test_and_clear_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags))
+                smp_mb__after_clear_bit();
+        else
+                spin_unlock(&eb->lock);
+
+        if (waitqueue_active(&eb->lock_wq))
+                wake_up(&eb->lock_wq);
+        return 0;
+}
+
+int btrfs_tree_locked(struct extent_buffer *eb)
+{
+        return test_bit(EXTENT_BUFFER_BLOCKING, &eb->bflags) ||
+                        spin_is_locked(&eb->lock);
+}
diff --git a/fs/btrfs/locking.h b/fs/btrfs/locking.h
index bc1faef1251..6bb0afbff92 100644
--- a/fs/btrfs/locking.h
+++ b/fs/btrfs/locking.h
@@ -22,6 +22,10 @@
 int btrfs_tree_lock(struct extent_buffer *eb);
 int btrfs_tree_unlock(struct extent_buffer *eb);
 int btrfs_tree_locked(struct extent_buffer *eb);
+
 int btrfs_try_tree_lock(struct extent_buffer *eb);
-int btrfs_path_lock_waiting(struct btrfs_path *path, int level);
+int btrfs_try_spin_lock(struct extent_buffer *eb);
+
+void btrfs_set_lock_blocking(struct extent_buffer *eb);
+void btrfs_clear_lock_blocking(struct extent_buffer *eb);
 #endif
diff --git a/fs/btrfs/ordered-data.c b/fs/btrfs/ordered-data.c
index a2094017027..77c2411a5f0 100644
--- a/fs/btrfs/ordered-data.c
+++ b/fs/btrfs/ordered-data.c
@@ -613,7 +613,6 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
         struct btrfs_sector_sum *sector_sums;
         struct btrfs_ordered_extent *ordered;
         struct btrfs_ordered_inode_tree *tree = &BTRFS_I(inode)->ordered_tree;
-        struct list_head *cur;
         unsigned long num_sectors;
         unsigned long i;
         u32 sectorsize = BTRFS_I(inode)->root->sectorsize;
@@ -624,8 +623,7 @@ int btrfs_find_ordered_sum(struct inode *inode, u64 offset, u64 disk_bytenr,
                 return 1;
 
         mutex_lock(&tree->mutex);
-        list_for_each_prev(cur, &ordered->list) {
-                ordered_sum = list_entry(cur, struct btrfs_ordered_sum, list);
+        list_for_each_entry_reverse(ordered_sum, &ordered->list, list) {
                 if (disk_bytenr >= ordered_sum->bytenr) {
                         num_sectors = ordered_sum->len / sectorsize;
                         sector_sums = ordered_sum->sums;
diff --git a/fs/btrfs/ref-cache.c b/fs/btrfs/ref-cache.c
index 6f0acc4c9ea..d0cc62bccb9 100644
--- a/fs/btrfs/ref-cache.c
+++ b/fs/btrfs/ref-cache.c
@@ -17,6 +17,7 @@
  */
 
 #include <linux/sched.h>
+#include <linux/sort.h>
 #include "ctree.h"
 #include "ref-cache.h"
 #include "transaction.h"
diff --git a/fs/btrfs/ref-cache.h b/fs/btrfs/ref-cache.h
index 16f3183d7c5..bc283ad2db7 100644
--- a/fs/btrfs/ref-cache.h
+++ b/fs/btrfs/ref-cache.h
@@ -73,5 +73,4 @@ int btrfs_add_leaf_ref(struct btrfs_root *root, struct btrfs_leaf_ref *ref,
 int btrfs_remove_leaf_refs(struct btrfs_root *root, u64 max_root_gen,
                            int shared);
 int btrfs_remove_leaf_ref(struct btrfs_root *root, struct btrfs_leaf_ref *ref);
-
 #endif
diff --git a/fs/btrfs/super.c b/fs/btrfs/super.c
index db9fb3bc1e3..f3fd7e2cbc3 100644
--- a/fs/btrfs/super.c
+++ b/fs/btrfs/super.c
@@ -37,7 +37,6 @@
 #include <linux/ctype.h>
 #include <linux/namei.h>
 #include <linux/miscdevice.h>
-#include <linux/version.h>
 #include <linux/magic.h>
 #include "compat.h"
 #include "ctree.h"
@@ -583,17 +582,18 @@ static long btrfs_control_ioctl(struct file *file, unsigned int cmd,
         struct btrfs_ioctl_vol_args *vol;
         struct btrfs_fs_devices *fs_devices;
         int ret = -ENOTTY;
-        int len;
 
         if (!capable(CAP_SYS_ADMIN))
                 return -EPERM;
 
         vol = kmalloc(sizeof(*vol), GFP_KERNEL);
+        if (!vol)
+                return -ENOMEM;
+
         if (copy_from_user(vol, (void __user *)arg, sizeof(*vol))) {
                 ret = -EFAULT;
                 goto out;
         }
-        len = strnlen(vol->name, BTRFS_PATH_NAME_MAX);
 
         switch (cmd) {
         case BTRFS_IOC_SCAN_DEV:
diff --git a/fs/btrfs/transaction.c b/fs/btrfs/transaction.c
index 8a08f944334..919172de5c9 100644
--- a/fs/btrfs/transaction.c
+++ b/fs/btrfs/transaction.c
@@ -852,11 +852,9 @@ static noinline int create_pending_snapshots(struct btrfs_trans_handle *trans,
 {
         struct btrfs_pending_snapshot *pending;
         struct list_head *head = &trans->transaction->pending_snapshots;
-        struct list_head *cur;
         int ret;
 
-        list_for_each(cur, head) {
-                pending = list_entry(cur, struct btrfs_pending_snapshot, list);
+        list_for_each_entry(pending, head, list) {
                 ret = create_pending_snapshot(trans, fs_info, pending);
                 BUG_ON(ret);
         }
diff --git a/fs/btrfs/tree-defrag.c b/fs/btrfs/tree-defrag.c
index 3e8358c3616..98d25fa4570 100644
--- a/fs/btrfs/tree-defrag.c
+++ b/fs/btrfs/tree-defrag.c
@@ -74,6 +74,7 @@ int btrfs_defrag_leaves(struct btrfs_trans_handle *trans,
                 u32 nritems;
 
                 root_node = btrfs_lock_root_node(root);
+                btrfs_set_lock_blocking(root_node);
                 nritems = btrfs_header_nritems(root_node);
                 root->defrag_max.objectid = 0;
                 /* from above we know this is not a leaf */
diff --git a/fs/btrfs/tree-log.c b/fs/btrfs/tree-log.c
index d81cda2e077..20794290256 100644
--- a/fs/btrfs/tree-log.c
+++ b/fs/btrfs/tree-log.c
@@ -78,104 +78,6 @@ static int link_to_fixup_dir(struct btrfs_trans_handle *trans,
  */
 
 /*
- * btrfs_add_log_tree adds a new per-subvolume log tree into the
- * tree of log tree roots.  This must be called with a tree log transaction
- * running (see start_log_trans).
- */
-static int btrfs_add_log_tree(struct btrfs_trans_handle *trans,
-                      struct btrfs_root *root)
-{
-        struct btrfs_key key;
-        struct btrfs_root_item root_item;
-        struct btrfs_inode_item *inode_item;
-        struct extent_buffer *leaf;
-        struct btrfs_root *new_root = root;
-        int ret;
-        u64 objectid = root->root_key.objectid;
-
-        leaf = btrfs_alloc_free_block(trans, root, root->leafsize, 0,
-                                      BTRFS_TREE_LOG_OBJECTID,
-                                      trans->transid, 0, 0, 0);
-        if (IS_ERR(leaf)) {
-                ret = PTR_ERR(leaf);
-                return ret;
-        }
-
-        btrfs_set_header_nritems(leaf, 0);
-        btrfs_set_header_level(leaf, 0);
-        btrfs_set_header_bytenr(leaf, leaf->start);
-        btrfs_set_header_generation(leaf, trans->transid);
-        btrfs_set_header_owner(leaf, BTRFS_TREE_LOG_OBJECTID);
-
-        write_extent_buffer(leaf, root->fs_info->fsid,
-                            (unsigned long)btrfs_header_fsid(leaf),
-                            BTRFS_FSID_SIZE);
-        btrfs_mark_buffer_dirty(leaf);
-
-        inode_item = &root_item.inode;
-        memset(inode_item, 0, sizeof(*inode_item));
-        inode_item->generation = cpu_to_le64(1);
-        inode_item->size = cpu_to_le64(3);
-        inode_item->nlink = cpu_to_le32(1);
-        inode_item->nbytes = cpu_to_le64(root->leafsize);
-        inode_item->mode = cpu_to_le32(S_IFDIR | 0755);
-
-        btrfs_set_root_bytenr(&root_item, leaf->start);
-        btrfs_set_root_generation(&root_item, trans->transid);
-        btrfs_set_root_level(&root_item, 0);
-        btrfs_set_root_refs(&root_item, 0);
-        btrfs_set_root_used(&root_item, 0);
-
-        memset(&root_item.drop_progress, 0, sizeof(root_item.drop_progress));
-        root_item.drop_level = 0;
-
-        btrfs_tree_unlock(leaf);
-        free_extent_buffer(leaf);
-        leaf = NULL;
-
-        btrfs_set_root_dirid(&root_item, 0);
-
-        key.objectid = BTRFS_TREE_LOG_OBJECTID;
-        key.offset = objectid;
-        btrfs_set_key_type(&key, BTRFS_ROOT_ITEM_KEY);
-        ret = btrfs_insert_root(trans, root->fs_info->log_root_tree, &key,
-                                &root_item);
-        if (ret)
-                goto fail;
-
-        new_root = btrfs_read_fs_root_no_radix(root->fs_info->log_root_tree,
-                                               &key);
-        BUG_ON(!new_root);
-
-        WARN_ON(root->log_root);
-        root->log_root = new_root;
-
-        /*
-         * log trees do not get reference counted because they go away
-         * before a real commit is actually done.  They do store pointers
-         * to file data extents, and those reference counts still get
-         * updated (along with back refs to the log tree).
-         */
-        new_root->ref_cows = 0;
-        new_root->last_trans = trans->transid;
-
-        /*
-         * we need to make sure the root block for this new tree
-         * is marked as dirty in the dirty_log_pages tree.  This
-         * is how it gets flushed down to disk at tree log commit time.
-         *
-         * the tree logging mutex keeps others from coming in and changing
-         * the new_root->node, so we can safely access it here
-         */
-        set_extent_dirty(&new_root->dirty_log_pages, new_root->node->start,
-                         new_root->node->start + new_root->node->len - 1,
-                         GFP_NOFS);
-
-fail:
-        return ret;
-}
-
-/*
  * start a sub transaction and setup the log tree
  * this increments the log tree writer count to make the people
  * syncing the tree wait for us to finish
@@ -184,6 +86,14 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
                            struct btrfs_root *root)
 {
         int ret;
+
+        mutex_lock(&root->log_mutex);
+        if (root->log_root) {
+                root->log_batch++;
+                atomic_inc(&root->log_writers);
+                mutex_unlock(&root->log_mutex);
+                return 0;
+        }
         mutex_lock(&root->fs_info->tree_log_mutex);
         if (!root->fs_info->log_root_tree) {
                 ret = btrfs_init_log_root_tree(trans, root->fs_info);
@@ -193,9 +103,10 @@ static int start_log_trans(struct btrfs_trans_handle *trans,
                 ret = btrfs_add_log_tree(trans, root);
                 BUG_ON(ret);
         }
-        atomic_inc(&root->fs_info->tree_log_writers);
-        root->fs_info->tree_log_batch++;
         mutex_unlock(&root->fs_info->tree_log_mutex);
+        root->log_batch++;
+        atomic_inc(&root->log_writers);
+        mutex_unlock(&root->log_mutex);
         return 0;
 }
 
@@ -212,13 +123,12 @@ static int join_running_log_trans(struct btrfs_root *root)
         if (!root->log_root)
                 return -ENOENT;
 
-        mutex_lock(&root->fs_info->tree_log_mutex);
+        mutex_lock(&root->log_mutex);
         if (root->log_root) {
                 ret = 0;
-                atomic_inc(&root->fs_info->tree_log_writers);
-                root->fs_info->tree_log_batch++;
+                atomic_inc(&root->log_writers);
         }
-        mutex_unlock(&root->fs_info->tree_log_mutex);
+        mutex_unlock(&root->log_mutex);
         return ret;
 }
 
@@ -228,10 +138,11 @@ static int join_running_log_trans(struct btrfs_root *root)
  */
 static int end_log_trans(struct btrfs_root *root)
 {
-        atomic_dec(&root->fs_info->tree_log_writers);
-        smp_mb();
-        if (waitqueue_active(&root->fs_info->tree_log_wait))
-                wake_up(&root->fs_info->tree_log_wait);
+        if (atomic_dec_and_test(&root->log_writers)) {
+                smp_mb();
+                if (waitqueue_active(&root->log_writer_wait))
+                        wake_up(&root->log_writer_wait);
+        }
         return 0;
 }
 
@@ -1704,6 +1615,7 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
 
                                 btrfs_tree_lock(next);
                                 clean_tree_block(trans, root, next);
+                                btrfs_set_lock_blocking(next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
 
@@ -1750,6 +1662,7 @@ static noinline int walk_down_log_tree(struct btrfs_trans_handle *trans,
                 next = path->nodes[*level];
                 btrfs_tree_lock(next);
                 clean_tree_block(trans, root, next);
+                btrfs_set_lock_blocking(next);
                 btrfs_wait_tree_block_writeback(next);
                 btrfs_tree_unlock(next);
 
@@ -1807,6 +1720,7 @@ static noinline int walk_up_log_tree(struct btrfs_trans_handle *trans,
 
                                 btrfs_tree_lock(next);
                                 clean_tree_block(trans, root, next);
+                                btrfs_set_lock_blocking(next);
                                 btrfs_wait_tree_block_writeback(next);
                                 btrfs_tree_unlock(next);
 
@@ -1879,6 +1793,7 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
 
                         btrfs_tree_lock(next);
                         clean_tree_block(trans, log, next);
+                        btrfs_set_lock_blocking(next);
                         btrfs_wait_tree_block_writeback(next);
                         btrfs_tree_unlock(next);
 
@@ -1902,26 +1817,65 @@ static int walk_log_tree(struct btrfs_trans_handle *trans,
                 }
         }
         btrfs_free_path(path);
-        if (wc->free)
-                free_extent_buffer(log->node);
         return ret;
 }
 
-static int wait_log_commit(struct btrfs_root *log)
+/*
+ * helper function to update the item for a given subvolumes log root
+ * in the tree of log roots
+ */
+static int update_log_root(struct btrfs_trans_handle *trans,
+                           struct btrfs_root *log)
+{
+        int ret;
+
+        if (log->log_transid == 1) {
+                /* insert root item on the first sync */
+                ret = btrfs_insert_root(trans, log->fs_info->log_root_tree,
+                                &log->root_key, &log->root_item);
+        } else {
+                ret = btrfs_update_root(trans, log->fs_info->log_root_tree,
+                                &log->root_key, &log->root_item);
+        }
+        return ret;
+}
+
+static int wait_log_commit(struct btrfs_root *root, unsigned long transid)
 {
         DEFINE_WAIT(wait);
-        u64 transid = log->fs_info->tree_log_transid;
+        int index = transid % 2;
 
+        /*
+         * we only allow two pending log transactions at a time,
+         * so we know that if ours is more than 2 older than the
+         * current transaction, we're done
+         */
         do {
-                prepare_to_wait(&log->fs_info->tree_log_wait, &wait,
-                                TASK_UNINTERRUPTIBLE);
-                mutex_unlock(&log->fs_info->tree_log_mutex);
-                if (atomic_read(&log->fs_info->tree_log_commit))
+                prepare_to_wait(&root->log_commit_wait[index],
+                                &wait, TASK_UNINTERRUPTIBLE);
+                mutex_unlock(&root->log_mutex);
+                if (root->log_transid < transid + 2 &&
+                    atomic_read(&root->log_commit[index]))
                         schedule();
-                finish_wait(&log->fs_info->tree_log_wait, &wait);
-                mutex_lock(&log->fs_info->tree_log_mutex);
-        } while (transid == log->fs_info->tree_log_transid &&
-                atomic_read(&log->fs_info->tree_log_commit));
+                finish_wait(&root->log_commit_wait[index], &wait);
+                mutex_lock(&root->log_mutex);
+        } while (root->log_transid < transid + 2 &&
+                 atomic_read(&root->log_commit[index]));
+        return 0;
+}
+
+static int wait_for_writer(struct btrfs_root *root)
+{
+        DEFINE_WAIT(wait);
+        while (atomic_read(&root->log_writers)) {
+                prepare_to_wait(&root->log_writer_wait,
+                                &wait, TASK_UNINTERRUPTIBLE);
+                mutex_unlock(&root->log_mutex);
+                if (atomic_read(&root->log_writers))
+                        schedule();
+                mutex_lock(&root->log_mutex);
+                finish_wait(&root->log_writer_wait, &wait);
+        }
         return 0;
 }
 
@@ -1933,57 +1887,114 @@ static int wait_log_commit(struct btrfs_root *log)
 int btrfs_sync_log(struct btrfs_trans_handle *trans,
                    struct btrfs_root *root)
 {
+        int index1;
+        int index2;
         int ret;
-        unsigned long batch;
         struct btrfs_root *log = root->log_root;
+        struct btrfs_root *log_root_tree = root->fs_info->log_root_tree;
 
-        mutex_lock(&log->fs_info->tree_log_mutex);
-        if (atomic_read(&log->fs_info->tree_log_commit)) {
-                wait_log_commit(log);
-                goto out;
+        mutex_lock(&root->log_mutex);
+        index1 = root->log_transid % 2;
+        if (atomic_read(&root->log_commit[index1])) {
+                wait_log_commit(root, root->log_transid);
+                mutex_unlock(&root->log_mutex);
+                return 0;
         }
-        atomic_set(&log->fs_info->tree_log_commit, 1);
+        atomic_set(&root->log_commit[index1], 1);
+
+        /* wait for previous tree log sync to complete */
+        if (atomic_read(&root->log_commit[(index1 + 1) % 2]))
+                wait_log_commit(root, root->log_transid - 1);
 
         while (1) {
-                batch = log->fs_info->tree_log_batch;
-                mutex_unlock(&log->fs_info->tree_log_mutex);
+                unsigned long batch = root->log_batch;
+                mutex_unlock(&root->log_mutex);
                 schedule_timeout_uninterruptible(1);
-                mutex_lock(&log->fs_info->tree_log_mutex);
-
-                while (atomic_read(&log->fs_info->tree_log_writers)) {
-                        DEFINE_WAIT(wait);
-                        prepare_to_wait(&log->fs_info->tree_log_wait, &wait,
-                                        TASK_UNINTERRUPTIBLE);
-                        mutex_unlock(&log->fs_info->tree_log_mutex);
-                        if (atomic_read(&log->fs_info->tree_log_writers))
-                                schedule();
-                        mutex_lock(&log->fs_info->tree_log_mutex);
-                        finish_wait(&log->fs_info->tree_log_wait, &wait);
-                }
-                if (batch == log->fs_info->tree_log_batch)
+                mutex_lock(&root->log_mutex);
+                wait_for_writer(root);
+                if (batch == root->log_batch)
                         break;
         }
 
         ret = btrfs_write_and_wait_marked_extents(log, &log->dirty_log_pages);
         BUG_ON(ret);
-        ret = btrfs_write_and_wait_marked_extents(root->fs_info->log_root_tree,
-                               &root->fs_info->log_root_tree->dirty_log_pages);
+
+        btrfs_set_root_bytenr(&log->root_item, log->node->start);
+        btrfs_set_root_generation(&log->root_item, trans->transid);
+        btrfs_set_root_level(&log->root_item, btrfs_header_level(log->node));
+
+        root->log_batch = 0;
+        root->log_transid++;
+        log->log_transid = root->log_transid;
+        smp_mb();
+        /*
+         * log tree has been flushed to disk, new modifications of
+         * the log will be written to new positions. so it's safe to
+         * allow log writers to go in.
+         */
+        mutex_unlock(&root->log_mutex);
+
+        mutex_lock(&log_root_tree->log_mutex);
+        log_root_tree->log_batch++;
+        atomic_inc(&log_root_tree->log_writers);
+        mutex_unlock(&log_root_tree->log_mutex);
+
+        ret = update_log_root(trans, log);
+        BUG_ON(ret);
+
+        mutex_lock(&log_root_tree->log_mutex);
+        if (atomic_dec_and_test(&log_root_tree->log_writers)) {
+                smp_mb();
+                if (waitqueue_active(&log_root_tree->log_writer_wait))
+                        wake_up(&log_root_tree->log_writer_wait);
+        }
+
+        index2 = log_root_tree->log_transid % 2;
+        if (atomic_read(&log_root_tree->log_commit[index2])) {
+                wait_log_commit(log_root_tree, log_root_tree->log_transid);
+                mutex_unlock(&log_root_tree->log_mutex);
+                goto out;
+        }
+        atomic_set(&log_root_tree->log_commit[index2], 1);
+
+        if (atomic_read(&log_root_tree->log_commit[(index2 + 1) % 2]))
+                wait_log_commit(log_root_tree, log_root_tree->log_transid - 1);
+
+        wait_for_writer(log_root_tree);
+
+        ret = btrfs_write_and_wait_marked_extents(log_root_tree,
+                                &log_root_tree->dirty_log_pages);
         BUG_ON(ret);
 
         btrfs_set_super_log_root(&root->fs_info->super_for_commit,
-                                 log->fs_info->log_root_tree->node->start);
+                                log_root_tree->node->start);
         btrfs_set_super_log_root_level(&root->fs_info->super_for_commit,
-                       btrfs_header_level(log->fs_info->log_root_tree->node));
+                                btrfs_header_level(log_root_tree->node));
+
+        log_root_tree->log_batch = 0;
+        log_root_tree->log_transid++;
+        smp_mb();
+
+        mutex_unlock(&log_root_tree->log_mutex);
+
+        /*
+         * nobody else is going to jump in and write the the ctree
+         * super here because the log_commit atomic below is protecting
+         * us.  We must be called with a transaction handle pinning
+         * the running transaction open, so a full commit can't hop
+         * in and cause problems either.
+         */
+        write_ctree_super(trans, root->fs_info->tree_root, 2);
 
-        write_ctree_super(trans, log->fs_info->tree_root, 2);
-        log->fs_info->tree_log_transid++;
-        log->fs_info->tree_log_batch = 0;
-        atomic_set(&log->fs_info->tree_log_commit, 0);
+        atomic_set(&log_root_tree->log_commit[index2], 0);
         smp_mb();
-        if (waitqueue_active(&log->fs_info->tree_log_wait))
-                wake_up(&log->fs_info->tree_log_wait);
+        if (waitqueue_active(&log_root_tree->log_commit_wait[index2]))
+                wake_up(&log_root_tree->log_commit_wait[index2]);
 out:
-        mutex_unlock(&log->fs_info->tree_log_mutex);
+        atomic_set(&root->log_commit[index1], 0);
+        smp_mb();
+        if (waitqueue_active(&root->log_commit_wait[index1]))
+                wake_up(&root->log_commit_wait[index1]);
         return 0;
 }
 
@@ -2019,38 +2030,18 @@ int btrfs_free_log(struct btrfs_trans_handle *trans, struct btrfs_root *root)
                                    start, end, GFP_NOFS);
         }
 
-        log = root->log_root;
-        ret = btrfs_del_root(trans, root->fs_info->log_root_tree,
-                             &log->root_key);
-        BUG_ON(ret);
+        if (log->log_transid > 0) {
+                ret = btrfs_del_root(trans, root->fs_info->log_root_tree,
+                                     &log->root_key);
+                BUG_ON(ret);
+        }
         root->log_root = NULL;
-        kfree(root->log_root);
+        free_extent_buffer(log->node);
+        kfree(log);
         return 0;
 }
 
 /*
- * helper function to update the item for a given subvolumes log root
- * in the tree of log roots
- */
-static int update_log_root(struct btrfs_trans_handle *trans,
-                           struct btrfs_root *log)
-{
-        u64 bytenr = btrfs_root_bytenr(&log->root_item);
-        int ret;
-
-        if (log->node->start == bytenr)
-                return 0;
-
-        btrfs_set_root_bytenr(&log->root_item, log->node->start);
-        btrfs_set_root_generation(&log->root_item, trans->transid);
-        btrfs_set_root_level(&log->root_item, btrfs_header_level(log->node));
-        ret = btrfs_update_root(trans, log->fs_info->log_root_tree,
-                                &log->root_key, &log->root_item);
-        BUG_ON(ret);
-        return ret;
-}
-
-/*
  * If both a file and directory are logged, and unlinks or renames are
  * mixed in, we have a few interesting corners:
  *
@@ -2711,11 +2702,6 @@ next_slot:
 
         btrfs_free_path(path);
         btrfs_free_path(dst_path);
-
-        mutex_lock(&root->fs_info->tree_log_mutex);
-        ret = update_log_root(trans, log);
-        BUG_ON(ret);
-        mutex_unlock(&root->fs_info->tree_log_mutex);
 out:
         return 0;
 }
diff --git a/fs/btrfs/volumes.c b/fs/btrfs/volumes.c
index 3451e1cca2b..bcd14ebccae 100644
--- a/fs/btrfs/volumes.c
+++ b/fs/btrfs/volumes.c
@@ -20,7 +20,6 @@
 #include <linux/buffer_head.h>
 #include <linux/blkdev.h>
 #include <linux/random.h>
-#include <linux/version.h>
 #include <asm/div64.h>
 #include "compat.h"
 #include "ctree.h"
@@ -104,10 +103,8 @@ static noinline struct btrfs_device *__find_device(struct list_head *head,
                                                    u64 devid, u8 *uuid)
 {
         struct btrfs_device *dev;
-        struct list_head *cur;
 
-        list_for_each(cur, head) {
-                dev = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(dev, head, dev_list) {
                 if (dev->devid == devid &&
                     (!uuid || !memcmp(dev->uuid, uuid, BTRFS_UUID_SIZE))) {
                         return dev;
@@ -118,11 +115,9 @@ static noinline struct btrfs_device *__find_device(struct list_head *head,
 
 static noinline struct btrfs_fs_devices *find_fsid(u8 *fsid)
 {
-        struct list_head *cur;
         struct btrfs_fs_devices *fs_devices;
 
-        list_for_each(cur, &fs_uuids) {
-                fs_devices = list_entry(cur, struct btrfs_fs_devices, list);
+        list_for_each_entry(fs_devices, &fs_uuids, list) {
                 if (memcmp(fsid, fs_devices->fsid, BTRFS_FSID_SIZE) == 0)
                         return fs_devices;
         }
@@ -159,6 +154,7 @@ static noinline int run_scheduled_bios(struct btrfs_device *device)
 loop:
         spin_lock(&device->io_lock);
 
+loop_lock:
         /* take all the bios off the list at once and process them
          * later on (without the lock held).  But, remember the
          * tail and other pointers so the bios can be properly reinserted
@@ -208,7 +204,7 @@ loop:
                  * is now congested.  Back off and let other work structs
                  * run instead
                  */
-                if (pending && bdi_write_congested(bdi) &&
+                if (pending && bdi_write_congested(bdi) && num_run > 16 &&
                     fs_info->fs_devices->open_devices > 1) {
                         struct bio *old_head;
 
@@ -220,7 +216,8 @@ loop:
                                 tail->bi_next = old_head;
                         else
                                 device->pending_bio_tail = tail;
-                        device->running_pending = 0;
+
+                        device->running_pending = 1;
 
                         spin_unlock(&device->io_lock);
                         btrfs_requeue_work(&device->work);
@@ -229,6 +226,11 @@ loop:
         }
         if (again)
                 goto loop;
+
+        spin_lock(&device->io_lock);
+        if (device->pending_bios)
+                goto loop_lock;
+        spin_unlock(&device->io_lock);
 done:
         return 0;
 }
@@ -345,14 +347,11 @@ error:
 
 int btrfs_close_extra_devices(struct btrfs_fs_devices *fs_devices)
 {
-        struct list_head *tmp;
-        struct list_head *cur;
-        struct btrfs_device *device;
+        struct btrfs_device *device, *next;
 
         mutex_lock(&uuid_mutex);
 again:
-        list_for_each_safe(cur, tmp, &fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry_safe(device, next, &fs_devices->devices, dev_list) {
                 if (device->in_fs_metadata)
                         continue;
 
@@ -383,14 +382,12 @@ again:
 
 static int __btrfs_close_devices(struct btrfs_fs_devices *fs_devices)
 {
-        struct list_head *cur;
         struct btrfs_device *device;
 
         if (--fs_devices->opened > 0)
                 return 0;
 
-        list_for_each(cur, &fs_devices->devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, &fs_devices->devices, dev_list) {
                 if (device->bdev) {
                         close_bdev_exclusive(device->bdev, device->mode);
                         fs_devices->open_devices--;
@@ -439,7 +436,6 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
 {
         struct block_device *bdev;
         struct list_head *head = &fs_devices->devices;
-        struct list_head *cur;
         struct btrfs_device *device;
         struct block_device *latest_bdev = NULL;
         struct buffer_head *bh;
@@ -450,8 +446,7 @@ static int __btrfs_open_devices(struct btrfs_fs_devices *fs_devices,
         int seeding = 1;
         int ret = 0;
 
-        list_for_each(cur, head) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, head, dev_list) {
                 if (device->bdev)
                         continue;
                 if (!device->name)
@@ -578,7 +573,7 @@ int btrfs_scan_one_device(const char *path, fmode_t flags, void *holder,
                        *(unsigned long long *)disk_super->fsid,
                        *(unsigned long long *)(disk_super->fsid + 8));
         }
-        printk(KERN_INFO "devid %llu transid %llu %s\n",
+        printk(KERN_CONT "devid %llu transid %llu %s\n",
                (unsigned long long)devid, (unsigned long long)transid, path);
         ret = device_list_add(path, disk_super, devid, fs_devices_ret);
 
@@ -1017,14 +1012,12 @@ int btrfs_rm_device(struct btrfs_root *root, char *device_path)
         }
 
         if (strcmp(device_path, "missing") == 0) {
-                struct list_head *cur;
                 struct list_head *devices;
                 struct btrfs_device *tmp;
 
                 device = NULL;
                 devices = &root->fs_info->fs_devices->devices;
-                list_for_each(cur, devices) {
-                        tmp = list_entry(cur, struct btrfs_device, dev_list);
+                list_for_each_entry(tmp, devices, dev_list) {
                         if (tmp->in_fs_metadata && !tmp->bdev) {
                                 device = tmp;
                                 break;
@@ -1280,7 +1273,6 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         struct btrfs_trans_handle *trans;
         struct btrfs_device *device;
         struct block_device *bdev;
-        struct list_head *cur;
         struct list_head *devices;
         struct super_block *sb = root->fs_info->sb;
         u64 total_bytes;
@@ -1304,8 +1296,7 @@ int btrfs_init_new_device(struct btrfs_root *root, char *device_path)
         mutex_lock(&root->fs_info->volume_mutex);
 
         devices = &root->fs_info->fs_devices->devices;
-        list_for_each(cur, devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, devices, dev_list) {
                 if (device->bdev == bdev) {
                         ret = -EEXIST;
                         goto error;
@@ -1704,7 +1695,6 @@ static u64 div_factor(u64 num, int factor)
 int btrfs_balance(struct btrfs_root *dev_root)
 {
         int ret;
-        struct list_head *cur;
         struct list_head *devices = &dev_root->fs_info->fs_devices->devices;
         struct btrfs_device *device;
         u64 old_size;
@@ -1723,8 +1713,7 @@ int btrfs_balance(struct btrfs_root *dev_root)
         dev_root = dev_root->fs_info->dev_root;
 
         /* step one make some room on all the devices */
-        list_for_each(cur, devices) {
-                device = list_entry(cur, struct btrfs_device, dev_list);
+        list_for_each_entry(device, devices, dev_list) {
                 old_size = device->total_bytes;
                 size_to_free = div_factor(old_size, 1);
                 size_to_free = min(size_to_free, (u64)1 * 1024 * 1024);
diff --git a/fs/btrfs/xattr.c b/fs/btrfs/xattr.c
index 7f332e27089..a9d3bf4d268 100644
--- a/fs/btrfs/xattr.c
+++ b/fs/btrfs/xattr.c
@@ -21,6 +21,7 @@
 #include <linux/slab.h>
 #include <linux/rwsem.h>
 #include <linux/xattr.h>
+#include <linux/security.h>
 #include "ctree.h"
 #include "btrfs_inode.h"
 #include "transaction.h"
@@ -45,9 +46,12 @@ ssize_t __btrfs_getxattr(struct inode *inode, const char *name,
         /* lookup the xattr by name */
         di = btrfs_lookup_xattr(NULL, root, path, inode->i_ino, name,
                                 strlen(name), 0);
-        if (!di || IS_ERR(di)) {
+        if (!di) {
                 ret = -ENODATA;
                 goto out;
+        } else if (IS_ERR(di)) {
+                ret = PTR_ERR(di);
+                goto out;
         }
 
         leaf = path->nodes[0];
@@ -62,6 +66,14 @@ ssize_t __btrfs_getxattr(struct inode *inode, const char *name,
                 ret = -ERANGE;
                 goto out;
         }
+
+        /*
+         * The way things are packed into the leaf is like this
+         * |struct btrfs_dir_item|name|data|
+         * where name is the xattr name, so security.foo, and data is the
+         * content of the xattr.  data_ptr points to the location in memory
+         * where the data starts in the in memory leaf
+         */
         data_ptr = (unsigned long)((char *)(di + 1) +
                                    btrfs_dir_name_len(leaf, di));
         read_extent_buffer(leaf, buffer, data_ptr,
@@ -86,7 +98,7 @@ int __btrfs_setxattr(struct inode *inode, const char *name,
         if (!path)
                 return -ENOMEM;
 
-        trans = btrfs_start_transaction(root, 1);
+        trans = btrfs_join_transaction(root, 1);
         btrfs_set_trans_block_group(trans, inode);
 
         /* first lets see if we already have this xattr */
@@ -176,7 +188,6 @@ ssize_t btrfs_listxattr(struct dentry *dentry, char *buffer, size_t size)
         ret = btrfs_search_slot(NULL, root, &key, path, 0, 0);
         if (ret < 0)
                 goto err;
-        ret = 0;
         advance = 0;
         while (1) {
                 leaf = path->nodes[0];
@@ -320,3 +331,34 @@ int btrfs_removexattr(struct dentry *dentry, const char *name)
                 return -EOPNOTSUPP;
         return __btrfs_setxattr(dentry->d_inode, name, NULL, 0, XATTR_REPLACE);
 }
+
+int btrfs_xattr_security_init(struct inode *inode, struct inode *dir)
+{
+        int err;
+        size_t len;
+        void *value;
+        char *suffix;
+        char *name;
+
+        err = security_inode_init_security(inode, dir, &suffix, &value, &len);
+        if (err) {
+                if (err == -EOPNOTSUPP)
+                        return 0;
+                return err;
+        }
+
+        name = kmalloc(XATTR_SECURITY_PREFIX_LEN + strlen(suffix) + 1,
+                       GFP_NOFS);
+        if (!name) {
+                err = -ENOMEM;
+        } else {
+                strcpy(name, XATTR_SECURITY_PREFIX);
+                strcpy(name + XATTR_SECURITY_PREFIX_LEN, suffix);
+                err = __btrfs_setxattr(inode, name, value, len, 0);
+                kfree(name);
+        }
+
+        kfree(suffix);
+        kfree(value);
+        return err;
+}
diff --git a/fs/btrfs/xattr.h b/fs/btrfs/xattr.h
index 5b1d08f8e68..c71e9c3cf3f 100644
--- a/fs/btrfs/xattr.h
+++ b/fs/btrfs/xattr.h
@@ -36,4 +36,6 @@ extern int btrfs_setxattr(struct dentry *dentry, const char *name,
                 const void *value, size_t size, int flags);
 extern int btrfs_removexattr(struct dentry *dentry, const char *name);
 
+extern int btrfs_xattr_security_init(struct inode *inode, struct inode *dir);
+
 #endif /* __XATTR__ */
diff --git a/fs/buffer.c b/fs/buffer.c
index b58208f1640..665d446b25b 100644
--- a/fs/buffer.c
+++ b/fs/buffer.c
@@ -2688,7 +2688,7 @@ int nobh_write_end(struct file *file, struct address_space *mapping,
         struct buffer_head *bh;
         BUG_ON(fsdata != NULL && page_has_buffers(page));
 
-        if (unlikely(copied < len) && !page_has_buffers(page))
+        if (unlikely(copied < len) && head)
                 attach_nobh_buffers(page, head);
         if (page_has_buffers(page))
                 return generic_write_end(file, mapping, pos, len,
diff --git a/fs/compat.c b/fs/compat.c
index 65a070e705a..d0145ca2757 100644
--- a/fs/compat.c
+++ b/fs/compat.c
@@ -1407,7 +1407,7 @@ int compat_do_execve(char * filename,
         bprm->cred = prepare_exec_creds();
         if (!bprm->cred)
                 goto out_unlock;
-        check_unsafe_exec(bprm);
+        check_unsafe_exec(bprm, current->files);
 
         file = open_exec(filename);
         retval = PTR_ERR(file);
diff --git a/fs/compat_ioctl.c b/fs/compat_ioctl.c
index 5235c67e759..9c6d815dd19 100644
--- a/fs/compat_ioctl.c
+++ b/fs/compat_ioctl.c
@@ -538,6 +538,7 @@ static int dev_ifsioc(unsigned int fd, unsigned int cmd, unsigned long arg)
                  * cannot be fixed without breaking all existing apps.
                  */
                 case TUNSETIFF:
+                case TUNGETIFF:
                 case SIOCGIFFLAGS:
                 case SIOCGIFMETRIC:
                 case SIOCGIFMTU:
@@ -784,7 +785,7 @@ static int sg_ioctl_trans(unsigned int fd, unsigned int cmd, unsigned long arg)
 
         if (copy_in_user(&sgio->status, &sgio32->status,
                          (4 * sizeof(unsigned char)) +
-                         (2 * sizeof(unsigned (short))) +
+                         (2 * sizeof(unsigned short)) +
                          (3 * sizeof(int))))
                 return -EFAULT;
 
@@ -1982,6 +1983,11 @@ COMPATIBLE_IOCTL(TUNSETNOCSUM)
 COMPATIBLE_IOCTL(TUNSETDEBUG)
 COMPATIBLE_IOCTL(TUNSETPERSIST)
 COMPATIBLE_IOCTL(TUNSETOWNER)
+COMPATIBLE_IOCTL(TUNSETLINK)
+COMPATIBLE_IOCTL(TUNSETGROUP)
+COMPATIBLE_IOCTL(TUNGETFEATURES)
+COMPATIBLE_IOCTL(TUNSETOFFLOAD)
+COMPATIBLE_IOCTL(TUNSETTXFILTER)
 /* Big V */
 COMPATIBLE_IOCTL(VT_SETMODE)
 COMPATIBLE_IOCTL(VT_GETMODE)
@@ -2573,6 +2579,7 @@ HANDLE_IOCTL(SIOCGIFPFLAGS, dev_ifsioc)
 HANDLE_IOCTL(SIOCGIFTXQLEN, dev_ifsioc)
 HANDLE_IOCTL(SIOCSIFTXQLEN, dev_ifsioc)
 HANDLE_IOCTL(TUNSETIFF, dev_ifsioc)
+HANDLE_IOCTL(TUNGETIFF, dev_ifsioc)
 HANDLE_IOCTL(SIOCETHTOOL, ethtool_ioctl)
 HANDLE_IOCTL(SIOCBONDENSLAVE, bond_ioctl)
 HANDLE_IOCTL(SIOCBONDRELEASE, bond_ioctl)
diff --git a/fs/ecryptfs/crypto.c b/fs/ecryptfs/crypto.c
index c01e043670e..f6caeb1d110 100644
--- a/fs/ecryptfs/crypto.c
+++ b/fs/ecryptfs/crypto.c
@@ -1716,7 +1716,7 @@ static int ecryptfs_copy_filename(char **copied_name, size_t *copied_name_size,
 {
         int rc = 0;
 
-        (*copied_name) = kmalloc((name_size + 2), GFP_KERNEL);
+        (*copied_name) = kmalloc((name_size + 1), GFP_KERNEL);
         if (!(*copied_name)) {
                 rc = -ENOMEM;
                 goto out;
@@ -1726,7 +1726,7 @@ static int ecryptfs_copy_filename(char **copied_name, size_t *copied_name_size,
                                                  * in printing out the
                                                  * string in debug
                                                  * messages */
-        (*copied_name_size) = (name_size + 1);
+        (*copied_name_size) = name_size;
 out:
         return rc;
 }
diff --git a/fs/exec.c b/fs/exec.c
index 0dd60a01f1b..929b58004b7 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -1049,16 +1049,32 @@ EXPORT_SYMBOL(install_exec_creds);
  * - the caller must hold current->cred_exec_mutex to protect against
  *   PTRACE_ATTACH
  */
-void check_unsafe_exec(struct linux_binprm *bprm)
+void check_unsafe_exec(struct linux_binprm *bprm, struct files_struct *files)
 {
-        struct task_struct *p = current;
+        struct task_struct *p = current, *t;
+        unsigned long flags;
+        unsigned n_fs, n_files, n_sighand;
 
         bprm->unsafe = tracehook_unsafe_exec(p);
 
-        if (atomic_read(&p->fs->count) > 1 ||
-            atomic_read(&p->files->count) > 1 ||
-            atomic_read(&p->sighand->count) > 1)
+        n_fs = 1;
+        n_files = 1;
+        n_sighand = 1;
+        lock_task_sighand(p, &flags);
+        for (t = next_thread(p); t != p; t = next_thread(t)) {
+                if (t->fs == p->fs)
+                        n_fs++;
+                if (t->files == files)
+                        n_files++;
+                n_sighand++;
+        }
+
+        if (atomic_read(&p->fs->count) > n_fs ||
+            atomic_read(&p->files->count) > n_files ||
+            atomic_read(&p->sighand->count) > n_sighand)
                 bprm->unsafe |= LSM_UNSAFE_SHARE;
+
+        unlock_task_sighand(p, &flags);
 }
 
 /* 
@@ -1273,7 +1289,7 @@ int do_execve(char * filename,
         bprm->cred = prepare_exec_creds();
         if (!bprm->cred)
                 goto out_unlock;
-        check_unsafe_exec(bprm);
+        check_unsafe_exec(bprm, displaced);
 
         file = open_exec(filename);
         retval = PTR_ERR(file);
diff --git a/fs/ext2/super.c b/fs/ext2/super.c
index da8bdeaa2e6..7c6e3606f0e 100644
--- a/fs/ext2/super.c
+++ b/fs/ext2/super.c
@@ -1185,9 +1185,12 @@ static int ext2_remount (struct super_block * sb, int * flags, char * data)
         es = sbi->s_es;
         if (((sbi->s_mount_opt & EXT2_MOUNT_XIP) !=
             (old_mount_opt & EXT2_MOUNT_XIP)) &&
-            invalidate_inodes(sb))
-                ext2_warning(sb, __func__, "busy inodes while remounting "\
-                             "xip remain in cache (no functional problem)");
+            invalidate_inodes(sb)) {
+                ext2_warning(sb, __func__, "refusing change of xip flag "
+                             "with busy inodes while remounting");
+                sbi->s_mount_opt &= ~EXT2_MOUNT_XIP;
+                sbi->s_mount_opt |= old_mount_opt & EXT2_MOUNT_XIP;
+        }
         if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
                 return 0;
         if (*flags & MS_RDONLY) {
diff --git a/fs/ext3/namei.c b/fs/ext3/namei.c
index 69a3d19ca9f..4db4ffa1eda 100644
--- a/fs/ext3/namei.c
+++ b/fs/ext3/namei.c
@@ -1358,7 +1358,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         struct fake_dirent *fde;
 
         blocksize =  dir->i_sb->s_blocksize;
-        dxtrace(printk("Creating index\n"));
+        dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
         retval = ext3_journal_get_write_access(handle, bh);
         if (retval) {
                 ext3_std_error(dir->i_sb, retval);
@@ -1367,6 +1367,19 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         }
         root = (struct dx_root *) bh->b_data;
 
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext3_dir_entry_2 *)((char *)fde +
+                        ext3_rec_len_from_disk(fde->rec_len));
+        if ((char *) de >= (((char *) root) + blocksize)) {
+                ext3_error(dir->i_sb, __func__,
+                           "invalid rec_len for '..' in inode %lu",
+                           dir->i_ino);
+                brelse(bh);
+                return -EIO;
+        }
+        len = ((char *) root) + blocksize - (char *) de;
+
         bh2 = ext3_append (handle, dir, &block, &retval);
         if (!(bh2)) {
                 brelse(bh);
@@ -1375,11 +1388,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         EXT3_I(dir)->i_flags |= EXT3_INDEX_FL;
         data1 = bh2->b_data;
 
-        /* The 0th block becomes the root, move the dirents out */
-        fde = &root->dotdot;
-        de = (struct ext3_dir_entry_2 *)((char *)fde +
-                        ext3_rec_len_from_disk(fde->rec_len));
-        len = ((char *) root) + blocksize - (char *) de;
         memcpy (data1, de, len);
         de = (struct ext3_dir_entry_2 *) data1;
         top = data1 + len;
diff --git a/fs/ext3/super.c b/fs/ext3/super.c
index b70d90e08a3..4a970411a45 100644
--- a/fs/ext3/super.c
+++ b/fs/ext3/super.c
@@ -2428,12 +2428,13 @@ static void ext3_write_super (struct super_block * sb)
 
 static int ext3_sync_fs(struct super_block *sb, int wait)
 {
-        sb->s_dirt = 0;
-        if (wait)
-                ext3_force_commit(sb);
-        else
-                journal_start_commit(EXT3_SB(sb)->s_journal, NULL);
+        tid_t target;
 
+        sb->s_dirt = 0;
+        if (journal_start_commit(EXT3_SB(sb)->s_journal, &target)) {
+                if (wait)
+                        log_wait_commit(EXT3_SB(sb)->s_journal, target);
+        }
         return 0;
 }
 
diff --git a/fs/ext4/balloc.c b/fs/ext4/balloc.c
index 6bba06b09dd..9a50b8052dc 100644
--- a/fs/ext4/balloc.c
+++ b/fs/ext4/balloc.c
@@ -684,15 +684,15 @@ ext4_fsblk_t ext4_count_free_blocks(struct super_block *sb)
                 gdp = ext4_get_group_desc(sb, i, NULL);
                 if (!gdp)
                         continue;
-                desc_count += le16_to_cpu(gdp->bg_free_blocks_count);
+                desc_count += ext4_free_blks_count(sb, gdp);
                 brelse(bitmap_bh);
                 bitmap_bh = ext4_read_block_bitmap(sb, i);
                 if (bitmap_bh == NULL)
                         continue;
 
                 x = ext4_count_free(bitmap_bh, sb->s_blocksize);
-                printk(KERN_DEBUG "group %lu: stored = %d, counted = %u\n",
-                        i, le16_to_cpu(gdp->bg_free_blocks_count), x);
+                printk(KERN_DEBUG "group %u: stored = %d, counted = %u\n",
+                        i, ext4_free_blks_count(sb, gdp), x);
                 bitmap_count += x;
         }
         brelse(bitmap_bh);
diff --git a/fs/ext4/ext4.h b/fs/ext4/ext4.h
index c668e4377d7..aafc9eba1c2 100644
--- a/fs/ext4/ext4.h
+++ b/fs/ext4/ext4.h
@@ -1206,8 +1206,11 @@ static inline void ext4_r_blocks_count_set(struct ext4_super_block *es,
 
 static inline loff_t ext4_isize(struct ext4_inode *raw_inode)
 {
-        return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
-                le32_to_cpu(raw_inode->i_size_lo);
+        if (S_ISREG(le16_to_cpu(raw_inode->i_mode)))
+                return ((loff_t)le32_to_cpu(raw_inode->i_size_high) << 32) |
+                        le32_to_cpu(raw_inode->i_size_lo);
+        else
+                return (loff_t) le32_to_cpu(raw_inode->i_size_lo);
 }
 
 static inline void ext4_isize_set(struct ext4_inode *raw_inode, loff_t i_size)
diff --git a/fs/ext4/extents.c b/fs/ext4/extents.c
index 54bf0623a9a..e2eab196875 100644
--- a/fs/ext4/extents.c
+++ b/fs/ext4/extents.c
@@ -3048,7 +3048,7 @@ retry:
                         WARN_ON(ret <= 0);
                         printk(KERN_ERR "%s: ext4_ext_get_blocks "
                                     "returned error inode#%lu, block=%u, "
-                                    "max_blocks=%lu", __func__,
+                                    "max_blocks=%u", __func__,
                                     inode->i_ino, block, max_blocks);
 #endif
                         ext4_mark_inode_dirty(handle, inode);
diff --git a/fs/ext4/inode.c b/fs/ext4/inode.c
index a6444cee0c7..03ba20be132 100644
--- a/fs/ext4/inode.c
+++ b/fs/ext4/inode.c
@@ -360,9 +360,9 @@ static int ext4_block_to_path(struct inode *inode,
                 final = ptrs;
         } else {
                 ext4_warning(inode->i_sb, "ext4_block_to_path",
-                                "block %lu > max",
+                                "block %lu > max in inode %lu",
                                 i_block + direct_blocks +
-                                indirect_blocks + double_blocks);
+                                indirect_blocks + double_blocks, inode->i_ino);
         }
         if (boundary)
                 *boundary = final - 1 - (i_block & (ptrs - 1));
@@ -2821,9 +2821,6 @@ static sector_t ext4_bmap(struct address_space *mapping, sector_t block)
                 filemap_write_and_wait(mapping);
         }
 
-        BUG_ON(!EXT4_JOURNAL(inode) &&
-               EXT4_I(inode)->i_state & EXT4_STATE_JDATA);
-
         if (EXT4_JOURNAL(inode) && EXT4_I(inode)->i_state & EXT4_STATE_JDATA) {
                 /*
                  * This is a REALLY heavyweight approach, but the use of
@@ -3622,7 +3619,7 @@ static void ext4_free_data(handle_t *handle, struct inode *inode,
                  * block pointed to itself, it would have been detached when
                  * the block was cleared. Check for this instead of OOPSing.
                  */
-                if (bh2jh(this_bh))
+                if ((EXT4_JOURNAL(inode) == NULL) || bh2jh(this_bh))
                         ext4_handle_dirty_metadata(handle, inode, this_bh);
                 else
                         ext4_error(inode->i_sb, __func__,
diff --git a/fs/ext4/mballoc.c b/fs/ext4/mballoc.c
index 918aec0c8a1..deba54f6cbe 100644
--- a/fs/ext4/mballoc.c
+++ b/fs/ext4/mballoc.c
@@ -3025,7 +3025,7 @@ ext4_mb_mark_diskspace_used(struct ext4_allocation_context *ac,
                 goto out_err;
 
         ext4_debug("using block group %u(%d)\n", ac->ac_b_ex.fe_group,
-                        gdp->bg_free_blocks_count);
+                        ext4_free_blks_count(sb, gdp));
 
         err = ext4_journal_get_write_access(handle, gdp_bh);
         if (err)
diff --git a/fs/ext4/namei.c b/fs/ext4/namei.c
index fec0b4c2f5f..ba702bd7910 100644
--- a/fs/ext4/namei.c
+++ b/fs/ext4/namei.c
@@ -1368,7 +1368,7 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         struct fake_dirent *fde;
 
         blocksize =  dir->i_sb->s_blocksize;
-        dxtrace(printk(KERN_DEBUG "Creating index\n"));
+        dxtrace(printk(KERN_DEBUG "Creating index: inode %lu\n", dir->i_ino));
         retval = ext4_journal_get_write_access(handle, bh);
         if (retval) {
                 ext4_std_error(dir->i_sb, retval);
@@ -1377,6 +1377,20 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         }
         root = (struct dx_root *) bh->b_data;
 
+        /* The 0th block becomes the root, move the dirents out */
+        fde = &root->dotdot;
+        de = (struct ext4_dir_entry_2 *)((char *)fde +
+                ext4_rec_len_from_disk(fde->rec_len));
+        if ((char *) de >= (((char *) root) + blocksize)) {
+                ext4_error(dir->i_sb, __func__,
+                           "invalid rec_len for '..' in inode %lu",
+                           dir->i_ino);
+                brelse(bh);
+                return -EIO;
+        }
+        len = ((char *) root) + blocksize - (char *) de;
+
+        /* Allocate new block for the 0th block's dirents */
         bh2 = ext4_append(handle, dir, &block, &retval);
         if (!(bh2)) {
                 brelse(bh);
@@ -1385,11 +1399,6 @@ static int make_indexed_dir(handle_t *handle, struct dentry *dentry,
         EXT4_I(dir)->i_flags |= EXT4_INDEX_FL;
         data1 = bh2->b_data;
 
-        /* The 0th block becomes the root, move the dirents out */
-        fde = &root->dotdot;
-        de = (struct ext4_dir_entry_2 *)((char *)fde +
-                ext4_rec_len_from_disk(fde->rec_len));
-        len = ((char *) root) + blocksize - (char *) de;
         memcpy (data1, de, len);
         de = (struct ext4_dir_entry_2 *) data1;
         top = data1 + len;
diff --git a/fs/ext4/resize.c b/fs/ext4/resize.c
index c328be5d688..c06886abd65 100644
--- a/fs/ext4/resize.c
+++ b/fs/ext4/resize.c
@@ -861,12 +861,13 @@ int ext4_group_add(struct super_block *sb, struct ext4_new_group_data *input)
         gdp = (struct ext4_group_desc *)((char *)primary->b_data +
                                          gdb_off * EXT4_DESC_SIZE(sb));
 
+        memset(gdp, 0, EXT4_DESC_SIZE(sb));
         ext4_block_bitmap_set(sb, gdp, input->block_bitmap); /* LV FIXME */
         ext4_inode_bitmap_set(sb, gdp, input->inode_bitmap); /* LV FIXME */
         ext4_inode_table_set(sb, gdp, input->inode_table); /* LV FIXME */
         ext4_free_blks_set(sb, gdp, input->free_blocks_count);
         ext4_free_inodes_set(sb, gdp, EXT4_INODES_PER_GROUP(sb));
-        gdp->bg_flags |= cpu_to_le16(EXT4_BG_INODE_ZEROED);
+        gdp->bg_flags = cpu_to_le16(EXT4_BG_INODE_ZEROED);
         gdp->bg_checksum = ext4_group_desc_csum(sbi, input->group, gdp);
 
         /*
diff --git a/fs/hugetlbfs/inode.c b/fs/hugetlbfs/inode.c
index 6903d37af03..9b800d97a68 100644
--- a/fs/hugetlbfs/inode.c
+++ b/fs/hugetlbfs/inode.c
@@ -108,7 +108,8 @@ static int hugetlbfs_file_mmap(struct file *file, struct vm_area_struct *vma)
 
         if (hugetlb_reserve_pages(inode,
                                 vma->vm_pgoff >> huge_page_order(h),
-                                len >> huge_page_shift(h), vma))
+                                len >> huge_page_shift(h), vma,
+                                vma->vm_flags))
                 goto out;
 
         ret = 0;
@@ -947,7 +948,7 @@ static int can_do_hugetlb_shm(void)
                         can_do_mlock());
 }
 
-struct file *hugetlb_file_setup(const char *name, size_t size)
+struct file *hugetlb_file_setup(const char *name, size_t size, int acctflag)
 {
         int error = -ENOMEM;
         struct file *file;
@@ -981,7 +982,8 @@ struct file *hugetlb_file_setup(const char *name, size_t size)
 
         error = -ENOMEM;
         if (hugetlb_reserve_pages(inode, 0,
-                        size >> huge_page_shift(hstate_inode(inode)), NULL))
+                        size >> huge_page_shift(hstate_inode(inode)), NULL,
+                        acctflag))
                 goto out_inode;
 
         d_instantiate(dentry, inode);
diff --git a/fs/internal.h b/fs/internal.h
index 53af885f173..0d8ac497b3d 100644
--- a/fs/internal.h
+++ b/fs/internal.h
@@ -43,7 +43,7 @@ extern void __init chrdev_init(void);
 /*
  * exec.c
  */
-extern void check_unsafe_exec(struct linux_binprm *);
+extern void check_unsafe_exec(struct linux_binprm *, struct files_struct *);
 
 /*
  * namespace.c
diff --git a/fs/jbd/journal.c b/fs/jbd/journal.c
index 9e4fa52d7dc..e79c07812af 100644
--- a/fs/jbd/journal.c
+++ b/fs/jbd/journal.c
@@ -427,7 +427,7 @@ int __log_space_left(journal_t *journal)
 }
 
 /*
- * Called under j_state_lock.  Returns true if a transaction was started.
+ * Called under j_state_lock.  Returns true if a transaction commit was started.
  */
 int __log_start_commit(journal_t *journal, tid_t target)
 {
@@ -495,7 +495,8 @@ int journal_force_commit_nested(journal_t *journal)
 
 /*
  * Start a commit of the current running transaction (if any).  Returns true
- * if a transaction was started, and fills its tid in at *ptid
+ * if a transaction is going to be committed (or is currently already
+ * committing), and fills its tid in at *ptid
  */
 int journal_start_commit(journal_t *journal, tid_t *ptid)
 {
@@ -505,15 +506,19 @@ int journal_start_commit(journal_t *journal, tid_t *ptid)
         if (journal->j_running_transaction) {
                 tid_t tid = journal->j_running_transaction->t_tid;
 
-                ret = __log_start_commit(journal, tid);
-                if (ret && ptid)
+                __log_start_commit(journal, tid);
+                /* There's a running transaction and we've just made sure
+                 * it's commit has been scheduled. */
+                if (ptid)
                         *ptid = tid;
-        } else if (journal->j_committing_transaction && ptid) {
+                ret = 1;
+        } else if (journal->j_committing_transaction) {
                 /*
                  * If ext3_write_super() recently started a commit, then we
                  * have to wait for completion of that transaction
                  */
-                *ptid = journal->j_committing_transaction->t_tid;
+                if (ptid)
+                        *ptid = journal->j_committing_transaction->t_tid;
                 ret = 1;
         }
         spin_unlock(&journal->j_state_lock);
diff --git a/fs/jbd2/journal.c b/fs/jbd2/journal.c
index 56675306ed8..eb343008ede 100644
--- a/fs/jbd2/journal.c
+++ b/fs/jbd2/journal.c
@@ -37,10 +37,10 @@
 #include <linux/proc_fs.h>
 #include <linux/debugfs.h>
 #include <linux/seq_file.h>
+#include <linux/math64.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
-#include <asm/div64.h>
 
 EXPORT_SYMBOL(jbd2_journal_start);
 EXPORT_SYMBOL(jbd2_journal_restart);
@@ -846,8 +846,8 @@ static int jbd2_seq_info_show(struct seq_file *seq, void *v)
             jiffies_to_msecs(s->stats->u.run.rs_flushing / s->stats->ts_tid));
         seq_printf(seq, "  %ums logging transaction\n",
             jiffies_to_msecs(s->stats->u.run.rs_logging / s->stats->ts_tid));
-        seq_printf(seq, "  %luus average transaction commit time\n",
-                   do_div(s->journal->j_average_commit_time, 1000));
+        seq_printf(seq, "  %lluus average transaction commit time\n",
+                   div_u64(s->journal->j_average_commit_time, 1000));
         seq_printf(seq, "  %lu handles per transaction\n",
             s->stats->u.run.rs_handle_count / s->stats->ts_tid);
         seq_printf(seq, "  %lu blocks per transaction\n",
diff --git a/fs/lockd/svclock.c b/fs/lockd/svclock.c
index 6063a8e4b9f..763b78a6e9d 100644
--- a/fs/lockd/svclock.c
+++ b/fs/lockd/svclock.c
@@ -427,7 +427,7 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                         goto out;
                 case -EAGAIN:
                         ret = nlm_lck_denied;
-                        goto out;
+                        break;
                 case FILE_LOCK_DEFERRED:
                         if (wait)
                                 break;
@@ -443,6 +443,10 @@ nlmsvc_lock(struct svc_rqst *rqstp, struct nlm_file *file,
                         goto out;
         }
 
+        ret = nlm_lck_denied;
+        if (!wait)
+                goto out;
+
         ret = nlm_lck_blocked;
 
         /* Append to list of blocked */
diff --git a/fs/ocfs2/alloc.c b/fs/ocfs2/alloc.c
index d861096c9d8..60fe74035db 100644
--- a/fs/ocfs2/alloc.c
+++ b/fs/ocfs2/alloc.c
@@ -5390,6 +5390,9 @@ int ocfs2_remove_btree_range(struct inode *inode,
                 goto out;
         }
 
+        vfs_dq_free_space_nodirty(inode,
+                                  ocfs2_clusters_to_bytes(inode->i_sb, len));
+
         ret = ocfs2_remove_extent(inode, et, cpos, len, handle, meta_ac,
                                   dealloc);
         if (ret) {
diff --git a/fs/ocfs2/dcache.c b/fs/ocfs2/dcache.c
index b1cc7c381e8..e9d7c2038c0 100644
--- a/fs/ocfs2/dcache.c
+++ b/fs/ocfs2/dcache.c
@@ -38,6 +38,7 @@
 #include "dlmglue.h"
 #include "file.h"
 #include "inode.h"
+#include "super.h"
 
 
 static int ocfs2_dentry_revalidate(struct dentry *dentry,
@@ -294,6 +295,34 @@ out_attach:
         return ret;
 }
 
+static DEFINE_SPINLOCK(dentry_list_lock);
+
+/* We limit the number of dentry locks to drop in one go. We have
+ * this limit so that we don't starve other users of ocfs2_wq. */
+#define DL_INODE_DROP_COUNT 64
+
+/* Drop inode references from dentry locks */
+void ocfs2_drop_dl_inodes(struct work_struct *work)
+{
+        struct ocfs2_super *osb = container_of(work, struct ocfs2_super,
+                                               dentry_lock_work);
+        struct ocfs2_dentry_lock *dl;
+        int drop_count = DL_INODE_DROP_COUNT;
+
+        spin_lock(&dentry_list_lock);
+        while (osb->dentry_lock_list && drop_count--) {
+                dl = osb->dentry_lock_list;
+                osb->dentry_lock_list = dl->dl_next;
+                spin_unlock(&dentry_list_lock);
+                iput(dl->dl_inode);
+                kfree(dl);
+                spin_lock(&dentry_list_lock);
+        }
+        if (osb->dentry_lock_list)
+                queue_work(ocfs2_wq, &osb->dentry_lock_work);
+        spin_unlock(&dentry_list_lock);
+}
+
 /*
  * ocfs2_dentry_iput() and friends.
  *
@@ -318,16 +347,23 @@ out_attach:
 static void ocfs2_drop_dentry_lock(struct ocfs2_super *osb,
                                    struct ocfs2_dentry_lock *dl)
 {
-        iput(dl->dl_inode);
         ocfs2_simple_drop_lockres(osb, &dl->dl_lockres);
         ocfs2_lock_res_free(&dl->dl_lockres);
-        kfree(dl);
+
+        /* We leave dropping of inode reference to ocfs2_wq as that can
+         * possibly lead to inode deletion which gets tricky */
+        spin_lock(&dentry_list_lock);
+        if (!osb->dentry_lock_list)
+                queue_work(ocfs2_wq, &osb->dentry_lock_work);
+        dl->dl_next = osb->dentry_lock_list;
+        osb->dentry_lock_list = dl;
+        spin_unlock(&dentry_list_lock);
 }
 
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                            struct ocfs2_dentry_lock *dl)
 {
-        int unlock = 0;
+        int unlock;
 
         BUG_ON(dl->dl_count == 0);
 
diff --git a/fs/ocfs2/dcache.h b/fs/ocfs2/dcache.h
index c091c34d988..d06e16c0664 100644
--- a/fs/ocfs2/dcache.h
+++ b/fs/ocfs2/dcache.h
@@ -29,8 +29,13 @@
 extern struct dentry_operations ocfs2_dentry_ops;
 
 struct ocfs2_dentry_lock {
+        /* Use count of dentry lock */
         unsigned int            dl_count;
-        u64                     dl_parent_blkno;
+        union {
+                /* Linked list of dentry locks to release */
+                struct ocfs2_dentry_lock *dl_next;
+                u64                     dl_parent_blkno;
+        };
 
         /*
          * The ocfs2_dentry_lock keeps an inode reference until
@@ -47,6 +52,8 @@ int ocfs2_dentry_attach_lock(struct dentry *dentry, struct inode *inode,
 void ocfs2_dentry_lock_put(struct ocfs2_super *osb,
                            struct ocfs2_dentry_lock *dl);
 
+void ocfs2_drop_dl_inodes(struct work_struct *work);
+
 struct dentry *ocfs2_find_local_alias(struct inode *inode, u64 parent_blkno,
                                       int skip_unhashed);
 
diff --git a/fs/ocfs2/dlmglue.c b/fs/ocfs2/dlmglue.c
index b0c4cadd4c4..206a2370876 100644
--- a/fs/ocfs2/dlmglue.c
+++ b/fs/ocfs2/dlmglue.c
@@ -2860,6 +2860,10 @@ static void ocfs2_unlock_ast(void *opaque, int error)
         case OCFS2_UNLOCK_CANCEL_CONVERT:
                 mlog(0, "Cancel convert success for %s\n", lockres->l_name);
                 lockres->l_action = OCFS2_AST_INVALID;
+                /* Downconvert thread may have requeued this lock, we
+                 * need to wake it. */
+                if (lockres->l_flags & OCFS2_LOCK_BLOCKED)
+                        ocfs2_wake_downconvert_thread(ocfs2_get_lockres_osb(lockres));
                 break;
         case OCFS2_UNLOCK_DROP_LOCK:
                 lockres->l_level = DLM_LOCK_IV;
diff --git a/fs/ocfs2/ocfs2.h b/fs/ocfs2/ocfs2.h
index ad5c24a29ed..077384135f4 100644
--- a/fs/ocfs2/ocfs2.h
+++ b/fs/ocfs2/ocfs2.h
@@ -210,6 +210,7 @@ struct ocfs2_journal;
 struct ocfs2_slot_info;
 struct ocfs2_recovery_map;
 struct ocfs2_quota_recovery;
+struct ocfs2_dentry_lock;
 struct ocfs2_super
 {
         struct task_struct *commit_task;
@@ -325,6 +326,11 @@ struct ocfs2_super
         struct list_head blocked_lock_list;
         unsigned long blocked_lock_count;
 
+        /* List of dentry locks to release. Anyone can add locks to
+         * the list, ocfs2_wq processes the list  */
+        struct ocfs2_dentry_lock *dentry_lock_list;
+        struct work_struct dentry_lock_work;
+
         wait_queue_head_t               osb_mount_event;
 
         /* Truncate log info */
diff --git a/fs/ocfs2/quota_global.c b/fs/ocfs2/quota_global.c
index f4efa89baee..1ed0f7c8686 100644
--- a/fs/ocfs2/quota_global.c
+++ b/fs/ocfs2/quota_global.c
@@ -754,7 +754,9 @@ static int ocfs2_mark_dquot_dirty(struct dquot *dquot)
         if (dquot->dq_flags & mask)
                 sync = 1;
         spin_unlock(&dq_data_lock);
-        if (!sync) {
+        /* This is a slight hack but we can't afford getting global quota
+         * lock if we already have a transaction started. */
+        if (!sync || journal_current_handle()) {
                 status = ocfs2_write_dquot(dquot);
                 goto out;
         }
diff --git a/fs/ocfs2/super.c b/fs/ocfs2/super.c
index 43ed11345b5..b1cb38fbe80 100644
--- a/fs/ocfs2/super.c
+++ b/fs/ocfs2/super.c
@@ -1887,6 +1887,9 @@ static int ocfs2_initialize_super(struct super_block *sb,
         INIT_WORK(&journal->j_recovery_work, ocfs2_complete_recovery);
         journal->j_state = OCFS2_JOURNAL_FREE;
 
+        INIT_WORK(&osb->dentry_lock_work, ocfs2_drop_dl_inodes);
+        osb->dentry_lock_list = NULL;
+
         /* get some pseudo constants for clustersize bits */
         osb->s_clustersize_bits =
                 le32_to_cpu(di->id2.i_super.s_clustersize_bits);
diff --git a/fs/ocfs2/xattr.c b/fs/ocfs2/xattr.c
index e1d638af6ac..915039fffe6 100644
--- a/fs/ocfs2/xattr.c
+++ b/fs/ocfs2/xattr.c
@@ -4729,13 +4729,6 @@ static int ocfs2_xattr_bucket_value_truncate(struct inode *inode,
         vb.vb_xv = (struct ocfs2_xattr_value_root *)
                 (vb.vb_bh->b_data + offset % blocksize);
 
-        ret = ocfs2_xattr_bucket_journal_access(ctxt->handle, bucket,
-                                                OCFS2_JOURNAL_ACCESS_WRITE);
-        if (ret) {
-                mlog_errno(ret);
-                goto out;
-        }
-
         /*
          * From here on out we have to dirty the bucket.  The generic
          * value calls only modify one of the bucket's bhs, but we need
@@ -4748,12 +4741,18 @@ static int ocfs2_xattr_bucket_value_truncate(struct inode *inode,
         ret = ocfs2_xattr_value_truncate(inode, &vb, len, ctxt);
         if (ret) {
                 mlog_errno(ret);
-                goto out_dirty;
+                goto out;
+        }
+
+        ret = ocfs2_xattr_bucket_journal_access(ctxt->handle, bucket,
+                                                OCFS2_JOURNAL_ACCESS_WRITE);
+        if (ret) {
+                mlog_errno(ret);
+                goto out;
         }
 
         xe->xe_value_size = cpu_to_le64(len);
 
-out_dirty:
         ocfs2_xattr_bucket_journal_dirty(ctxt->handle, bucket);
 
 out:
diff --git a/fs/seq_file.c b/fs/seq_file.c
index b569ff1c4dc..5267098532b 100644
--- a/fs/seq_file.c
+++ b/fs/seq_file.c
@@ -54,6 +54,64 @@ int seq_open(struct file *file, const struct seq_operations *op)
 }
 EXPORT_SYMBOL(seq_open);
 
+static int traverse(struct seq_file *m, loff_t offset)
+{
+        loff_t pos = 0, index;
+        int error = 0;
+        void *p;
+
+        m->version = 0;
+        index = 0;
+        m->count = m->from = 0;
+        if (!offset) {
+                m->index = index;
+                return 0;
+        }
+        if (!m->buf) {
+                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+                if (!m->buf)
+                        return -ENOMEM;
+        }
+        p = m->op->start(m, &index);
+        while (p) {
+                error = PTR_ERR(p);
+                if (IS_ERR(p))
+                        break;
+                error = m->op->show(m, p);
+                if (error < 0)
+                        break;
+                if (unlikely(error)) {
+                        error = 0;
+                        m->count = 0;
+                }
+                if (m->count == m->size)
+                        goto Eoverflow;
+                if (pos + m->count > offset) {
+                        m->from = offset - pos;
+                        m->count -= m->from;
+                        m->index = index;
+                        break;
+                }
+                pos += m->count;
+                m->count = 0;
+                if (pos == offset) {
+                        index++;
+                        m->index = index;
+                        break;
+                }
+                p = m->op->next(m, p, &index);
+        }
+        m->op->stop(m, p);
+        m->index = index;
+        return error;
+
+Eoverflow:
+        m->op->stop(m, p);
+        kfree(m->buf);
+        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+        return !m->buf ? -ENOMEM : -EAGAIN;
+}
+
 /**
  *      seq_read -      ->read() method for sequential files.
  *      @file: the file to read from
@@ -186,63 +244,6 @@ Efault:
 }
 EXPORT_SYMBOL(seq_read);
 
-static int traverse(struct seq_file *m, loff_t offset)
-{
-        loff_t pos = 0, index;
-        int error = 0;
-        void *p;
-
-        m->version = 0;
-        index = 0;
-        m->count = m->from = 0;
-        if (!offset) {
-                m->index = index;
-                return 0;
-        }
-        if (!m->buf) {
-                m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
-                if (!m->buf)
-                        return -ENOMEM;
-        }
-        p = m->op->start(m, &index);
-        while (p) {
-                error = PTR_ERR(p);
-                if (IS_ERR(p))
-                        break;
-                error = m->op->show(m, p);
-                if (error < 0)
-                        break;
-                if (unlikely(error)) {
-                        error = 0;
-                        m->count = 0;
-                }
-                if (m->count == m->size)
-                        goto Eoverflow;
-                if (pos + m->count > offset) {
-                        m->from = offset - pos;
-                        m->count -= m->from;
-                        m->index = index;
-                        break;
-                }
-                pos += m->count;
-                m->count = 0;
-                if (pos == offset) {
-                        index++;
-                        m->index = index;
-                        break;
-                }
-                p = m->op->next(m, p, &index);
-        }
-        m->op->stop(m, p);
-        return error;
-
-Eoverflow:
-        m->op->stop(m, p);
-        kfree(m->buf);
-        m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
-        return !m->buf ? -ENOMEM : -EAGAIN;
-}
-
 /**
  *      seq_lseek -     ->llseek() method for sequential files.
  *      @file: the file in question
diff --git a/fs/super.c b/fs/super.c
index 645e5403f2a..61dce001dd5 100644
--- a/fs/super.c
+++ b/fs/super.c
@@ -301,7 +301,7 @@ void generic_shutdown_super(struct super_block *sb)
                 /*
                  * wait for asynchronous fs operations to finish before going further
                  */
-                async_synchronize_full_special(&sb->s_async_list);
+                async_synchronize_full_domain(&sb->s_async_list);
 
                 /* bad name - it should be evict_inodes() */
                 invalidate_inodes(sb);
@@ -470,7 +470,7 @@ restart:
                 sb->s_count++;
                 spin_unlock(&sb_lock);
                 down_read(&sb->s_umount);
-                async_synchronize_full_special(&sb->s_async_list);
+                async_synchronize_full_domain(&sb->s_async_list);
                 if (sb->s_root && (wait || sb->s_dirt))
                         sb->s_op->sync_fs(sb, wait);
                 up_read(&sb->s_umount);
diff --git a/fs/ubifs/budget.c b/fs/ubifs/budget.c
index 175f9c590b7..f393620890e 100644
--- a/fs/ubifs/budget.c
+++ b/fs/ubifs/budget.c
@@ -689,7 +689,7 @@ long long ubifs_reported_space(const struct ubifs_info *c, long long free)
 }
 
 /**
- * ubifs_get_free_space - return amount of free space.
+ * ubifs_get_free_space_nolock - return amount of free space.
  * @c: UBIFS file-system description object
  *
  * This function calculates amount of free space to report to user-space.
@@ -704,16 +704,14 @@ long long ubifs_reported_space(const struct ubifs_info *c, long long free)
  * traditional file-systems, because they have way less overhead than UBIFS.
  * So, to keep users happy, UBIFS tries to take the overhead into account.
  */
-long long ubifs_get_free_space(struct ubifs_info *c)
+long long ubifs_get_free_space_nolock(struct ubifs_info *c)
 {
-        int min_idx_lebs, rsvd_idx_lebs, lebs;
+        int rsvd_idx_lebs, lebs;
         long long available, outstanding, free;
 
-        spin_lock(&c->space_lock);
-        min_idx_lebs = c->min_idx_lebs;
-        ubifs_assert(min_idx_lebs == ubifs_calc_min_idx_lebs(c));
+        ubifs_assert(c->min_idx_lebs == ubifs_calc_min_idx_lebs(c));
         outstanding = c->budg_data_growth + c->budg_dd_growth;
-        available = ubifs_calc_available(c, min_idx_lebs);
+        available = ubifs_calc_available(c, c->min_idx_lebs);
 
         /*
          * When reporting free space to user-space, UBIFS guarantees that it is
@@ -726,15 +724,14 @@ long long ubifs_get_free_space(struct ubifs_info *c)
          * Note, the calculations below are similar to what we have in
          * 'do_budget_space()', so refer there for comments.
          */
-        if (min_idx_lebs > c->lst.idx_lebs)
-                rsvd_idx_lebs = min_idx_lebs - c->lst.idx_lebs;
+        if (c->min_idx_lebs > c->lst.idx_lebs)
+                rsvd_idx_lebs = c->min_idx_lebs - c->lst.idx_lebs;
         else
                 rsvd_idx_lebs = 0;
         lebs = c->lst.empty_lebs + c->freeable_cnt + c->idx_gc_cnt -
                c->lst.taken_empty_lebs;
         lebs -= rsvd_idx_lebs;
         available += lebs * (c->dark_wm - c->leb_overhead);
-        spin_unlock(&c->space_lock);
 
         if (available > outstanding)
                 free = ubifs_reported_space(c, available - outstanding);
@@ -742,3 +739,21 @@ long long ubifs_get_free_space(struct ubifs_info *c)
                 free = 0;
         return free;
 }
+
+/**
+ * ubifs_get_free_space - return amount of free space.
+ * @c: UBIFS file-system description object
+ *
+ * This function calculates and retuns amount of free space to report to
+ * user-space.
+ */
+long long ubifs_get_free_space(struct ubifs_info *c)
+{
+        long long free;
+
+        spin_lock(&c->space_lock);
+        free = ubifs_get_free_space_nolock(c);
+        spin_unlock(&c->space_lock);
+
+        return free;
+}
diff --git a/fs/ubifs/debug.c b/fs/ubifs/debug.c
index 792c5a16c18..e975bd82f38 100644
--- a/fs/ubifs/debug.c
+++ b/fs/ubifs/debug.c
@@ -620,9 +620,11 @@ void dbg_dump_budg(struct ubifs_info *c)
                c->dark_wm, c->dead_wm, c->max_idx_node_sz);
         printk(KERN_DEBUG "\tgc_lnum %d, ihead_lnum %d\n",
                c->gc_lnum, c->ihead_lnum);
-        for (i = 0; i < c->jhead_cnt; i++)
-                printk(KERN_DEBUG "\tjhead %d\t LEB %d\n",
-                       c->jheads[i].wbuf.jhead, c->jheads[i].wbuf.lnum);
+        /* If we are in R/O mode, journal heads do not exist */
+        if (c->jheads)
+                for (i = 0; i < c->jhead_cnt; i++)
+                        printk(KERN_DEBUG "\tjhead %d\t LEB %d\n",
+                               c->jheads[i].wbuf.jhead, c->jheads[i].wbuf.lnum);
         for (rb = rb_first(&c->buds); rb; rb = rb_next(rb)) {
                 bud = rb_entry(rb, struct ubifs_bud, rb);
                 printk(KERN_DEBUG "\tbud LEB %d\n", bud->lnum);
@@ -637,10 +639,7 @@ void dbg_dump_budg(struct ubifs_info *c)
         /* Print budgeting predictions */
         available = ubifs_calc_available(c, c->min_idx_lebs);
         outstanding = c->budg_data_growth + c->budg_dd_growth;
-        if (available > outstanding)
-                free = ubifs_reported_space(c, available - outstanding);
-        else
-                free = 0;
+        free = ubifs_get_free_space_nolock(c);
         printk(KERN_DEBUG "Budgeting predictions:\n");
         printk(KERN_DEBUG "\tavailable: %lld, outstanding %lld, free %lld\n",
                available, outstanding, free);
@@ -861,6 +860,65 @@ void dbg_dump_index(struct ubifs_info *c)
 }
 
 /**
+ * dbg_save_space_info - save information about flash space.
+ * @c: UBIFS file-system description object
+ *
+ * This function saves information about UBIFS free space, dirty space, etc, in
+ * order to check it later.
+ */
+void dbg_save_space_info(struct ubifs_info *c)
+{
+        struct ubifs_debug_info *d = c->dbg;
+
+        ubifs_get_lp_stats(c, &d->saved_lst);
+
+        spin_lock(&c->space_lock);
+        d->saved_free = ubifs_get_free_space_nolock(c);
+        spin_unlock(&c->space_lock);
+}
+
+/**
+ * dbg_check_space_info - check flash space information.
+ * @c: UBIFS file-system description object
+ *
+ * This function compares current flash space information with the information
+ * which was saved when the 'dbg_save_space_info()' function was called.
+ * Returns zero if the information has not changed, and %-EINVAL it it has
+ * changed.
+ */
+int dbg_check_space_info(struct ubifs_info *c)
+{
+        struct ubifs_debug_info *d = c->dbg;
+        struct ubifs_lp_stats lst;
+        long long avail, free;
+
+        spin_lock(&c->space_lock);
+        avail = ubifs_calc_available(c, c->min_idx_lebs);
+        spin_unlock(&c->space_lock);
+        free = ubifs_get_free_space(c);
+
+        if (free != d->saved_free) {
+                ubifs_err("free space changed from %lld to %lld",
+                          d->saved_free, free);
+                goto out;
+        }
+
+        return 0;
+
+out:
+        ubifs_msg("saved lprops statistics dump");
+        dbg_dump_lstats(&d->saved_lst);
+        ubifs_get_lp_stats(c, &lst);
+        ubifs_msg("current lprops statistics dump");
+        dbg_dump_lstats(&d->saved_lst);
+        spin_lock(&c->space_lock);
+        dbg_dump_budg(c);
+        spin_unlock(&c->space_lock);
+        dump_stack();
+        return -EINVAL;
+}
+
+/**
  * dbg_check_synced_i_size - check synchronized inode size.
  * @inode: inode to check
  *
@@ -1349,7 +1407,7 @@ int dbg_check_tnc(struct ubifs_info *c, int extra)
  * @c: UBIFS file-system description object
  * @leaf_cb: called for each leaf node
  * @znode_cb: called for each indexing node
- * @priv: private date which is passed to callbacks
+ * @priv: private data which is passed to callbacks
  *
  * This function walks the UBIFS index and calls the @leaf_cb for each leaf
  * node and @znode_cb for each indexing node. Returns zero in case of success
@@ -2409,7 +2467,7 @@ void ubifs_debugging_exit(struct ubifs_info *c)
  * Root directory for UBIFS stuff in debugfs. Contains sub-directories which
  * contain the stuff specific to particular file-system mounts.
  */
-static struct dentry *debugfs_rootdir;
+static struct dentry *dfs_rootdir;
 
 /**
  * dbg_debugfs_init - initialize debugfs file-system.
@@ -2421,9 +2479,9 @@ static struct dentry *debugfs_rootdir;
  */
 int dbg_debugfs_init(void)
 {
-        debugfs_rootdir = debugfs_create_dir("ubifs", NULL);
-        if (IS_ERR(debugfs_rootdir)) {
-                int err = PTR_ERR(debugfs_rootdir);
+        dfs_rootdir = debugfs_create_dir("ubifs", NULL);
+        if (IS_ERR(dfs_rootdir)) {
+                int err = PTR_ERR(dfs_rootdir);
                 ubifs_err("cannot create \"ubifs\" debugfs directory, "
                           "error %d\n", err);
                 return err;
@@ -2437,7 +2495,7 @@ int dbg_debugfs_init(void)
  */
 void dbg_debugfs_exit(void)
 {
-        debugfs_remove(debugfs_rootdir);
+        debugfs_remove(dfs_rootdir);
 }
 
 static int open_debugfs_file(struct inode *inode, struct file *file)
@@ -2452,13 +2510,13 @@ static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
         struct ubifs_info *c = file->private_data;
         struct ubifs_debug_info *d = c->dbg;
 
-        if (file->f_path.dentry == d->dump_lprops)
+        if (file->f_path.dentry == d->dfs_dump_lprops)
                 dbg_dump_lprops(c);
-        else if (file->f_path.dentry == d->dump_budg) {
+        else if (file->f_path.dentry == d->dfs_dump_budg) {
                 spin_lock(&c->space_lock);
                 dbg_dump_budg(c);
                 spin_unlock(&c->space_lock);
-        } else if (file->f_path.dentry == d->dump_tnc) {
+        } else if (file->f_path.dentry == d->dfs_dump_tnc) {
                 mutex_lock(&c->tnc_mutex);
                 dbg_dump_tnc(c);
                 mutex_unlock(&c->tnc_mutex);
@@ -2469,7 +2527,7 @@ static ssize_t write_debugfs_file(struct file *file, const char __user *buf,
         return count;
 }
 
-static const struct file_operations debugfs_fops = {
+static const struct file_operations dfs_fops = {
         .open = open_debugfs_file,
         .write = write_debugfs_file,
         .owner = THIS_MODULE,
@@ -2494,36 +2552,32 @@ int dbg_debugfs_init_fs(struct ubifs_info *c)
         struct dentry *dent;
         struct ubifs_debug_info *d = c->dbg;
 
-        sprintf(d->debugfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
-        d->debugfs_dir = debugfs_create_dir(d->debugfs_dir_name,
-                                              debugfs_rootdir);
-        if (IS_ERR(d->debugfs_dir)) {
-                err = PTR_ERR(d->debugfs_dir);
+        sprintf(d->dfs_dir_name, "ubi%d_%d", c->vi.ubi_num, c->vi.vol_id);
+        d->dfs_dir = debugfs_create_dir(d->dfs_dir_name, dfs_rootdir);
+        if (IS_ERR(d->dfs_dir)) {
+                err = PTR_ERR(d->dfs_dir);
                 ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
-                          d->debugfs_dir_name, err);
+                          d->dfs_dir_name, err);
                 goto out;
         }
 
         fname = "dump_lprops";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
-                                   &debugfs_fops);
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
         if (IS_ERR(dent))
                 goto out_remove;
-        d->dump_lprops = dent;
+        d->dfs_dump_lprops = dent;
 
         fname = "dump_budg";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
-                                   &debugfs_fops);
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
         if (IS_ERR(dent))
                 goto out_remove;
-        d->dump_budg = dent;
+        d->dfs_dump_budg = dent;
 
         fname = "dump_tnc";
-        dent = debugfs_create_file(fname, S_IWUGO, d->debugfs_dir, c,
-                                   &debugfs_fops);
+        dent = debugfs_create_file(fname, S_IWUGO, d->dfs_dir, c, &dfs_fops);
         if (IS_ERR(dent))
                 goto out_remove;
-        d->dump_tnc = dent;
+        d->dfs_dump_tnc = dent;
 
         return 0;
 
@@ -2531,7 +2585,7 @@ out_remove:
         err = PTR_ERR(dent);
         ubifs_err("cannot create \"%s\" debugfs directory, error %d\n",
                   fname, err);
-        debugfs_remove_recursive(d->debugfs_dir);
+        debugfs_remove_recursive(d->dfs_dir);
 out:
         return err;
 }
@@ -2542,7 +2596,7 @@ out:
  */
 void dbg_debugfs_exit_fs(struct ubifs_info *c)
 {
-        debugfs_remove_recursive(c->dbg->debugfs_dir);
+        debugfs_remove_recursive(c->dbg->dfs_dir);
 }
 
 #endif /* CONFIG_UBIFS_FS_DEBUG */
diff --git a/fs/ubifs/debug.h b/fs/ubifs/debug.h
index 9820d6999f7..c1cd73b2e06 100644
--- a/fs/ubifs/debug.h
+++ b/fs/ubifs/debug.h
@@ -41,15 +41,17 @@
  * @chk_lpt_wastage: used by LPT tree size checker
  * @chk_lpt_lebs: used by LPT tree size checker
  * @new_nhead_offs: used by LPT tree size checker
- * @new_ihead_lnum: used by debugging to check ihead_lnum
- * @new_ihead_offs: used by debugging to check ihead_offs
+ * @new_ihead_lnum: used by debugging to check @c->ihead_lnum
+ * @new_ihead_offs: used by debugging to check @c->ihead_offs
  *
- * debugfs_dir_name: name of debugfs directory containing this file-system's
- *                   files
- * debugfs_dir: direntry object of the file-system debugfs directory
- * dump_lprops: "dump lprops" debugfs knob
- * dump_budg: "dump budgeting information" debugfs knob
- * dump_tnc: "dump TNC" debugfs knob
+ * @saved_lst: saved lprops statistics (used by 'dbg_save_space_info()')
+ * @saved_free: saved free space (used by 'dbg_save_space_info()')
+ *
+ * dfs_dir_name: name of debugfs directory containing this file-system's files
+ * dfs_dir: direntry object of the file-system debugfs directory
+ * dfs_dump_lprops: "dump lprops" debugfs knob
+ * dfs_dump_budg: "dump budgeting information" debugfs knob
+ * dfs_dump_tnc: "dump TNC" debugfs knob
  */
 struct ubifs_debug_info {
         void *buf;
@@ -69,11 +71,14 @@ struct ubifs_debug_info {
         int new_ihead_lnum;
         int new_ihead_offs;
 
-        char debugfs_dir_name[100];
-        struct dentry *debugfs_dir;
-        struct dentry *dump_lprops;
-        struct dentry *dump_budg;
-        struct dentry *dump_tnc;
+        struct ubifs_lp_stats saved_lst;
+        long long saved_free;
+
+        char dfs_dir_name[100];
+        struct dentry *dfs_dir;
+        struct dentry *dfs_dump_lprops;
+        struct dentry *dfs_dump_budg;
+        struct dentry *dfs_dump_tnc;
 };
 
 #define ubifs_assert(expr) do {                                                \
@@ -297,7 +302,8 @@ int dbg_walk_index(struct ubifs_info *c, dbg_leaf_callback leaf_cb,
                    dbg_znode_callback znode_cb, void *priv);
 
 /* Checking functions */
-
+void dbg_save_space_info(struct ubifs_info *c);
+int dbg_check_space_info(struct ubifs_info *c);
 int dbg_check_lprops(struct ubifs_info *c);
 int dbg_old_index_check_init(struct ubifs_info *c, struct ubifs_zbranch *zroot);
 int dbg_check_old_index(struct ubifs_info *c, struct ubifs_zbranch *zroot);
@@ -439,6 +445,8 @@ void dbg_debugfs_exit_fs(struct ubifs_info *c);
 
 #define dbg_walk_index(c, leaf_cb, znode_cb, priv) 0
 #define dbg_old_index_check_init(c, zroot)         0
+#define dbg_save_space_info(c)                     ({})
+#define dbg_check_space_info(c)                    0
 #define dbg_check_old_index(c, zroot)              0
 #define dbg_check_cats(c)                          0
 #define dbg_check_ltab(c)                          0
diff --git a/fs/ubifs/dir.c b/fs/ubifs/dir.c
index f448ab1f9c3..f55d523c52b 100644
--- a/fs/ubifs/dir.c
+++ b/fs/ubifs/dir.c
@@ -482,30 +482,29 @@ static int ubifs_dir_release(struct inode *dir, struct file *file)
 }
 
 /**
- * lock_2_inodes - lock two UBIFS inodes.
+ * lock_2_inodes - a wrapper for locking two UBIFS inodes.
  * @inode1: first inode
  * @inode2: second inode
+ *
+ * We do not implement any tricks to guarantee strict lock ordering, because
+ * VFS has already done it for us on the @i_mutex. So this is just a simple
+ * wrapper function.
  */
 static void lock_2_inodes(struct inode *inode1, struct inode *inode2)
 {
-        if (inode1->i_ino < inode2->i_ino) {
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_2);
-                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_3);
-        } else {
-                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_3);
-        }
+        mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
+        mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
 }
 
 /**
- * unlock_2_inodes - unlock two UBIFS inodes inodes.
+ * unlock_2_inodes - a wrapper for unlocking two UBIFS inodes.
  * @inode1: first inode
  * @inode2: second inode
  */
 static void unlock_2_inodes(struct inode *inode1, struct inode *inode2)
 {
-        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
         mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
+        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
 }
 
 static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
@@ -527,6 +526,8 @@ static int ubifs_link(struct dentry *old_dentry, struct inode *dir,
         dbg_gen("dent '%.*s' to ino %lu (nlink %d) in dir ino %lu",
                 dentry->d_name.len, dentry->d_name.name, inode->i_ino,
                 inode->i_nlink, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
         err = dbg_check_synced_i_size(inode);
         if (err)
                 return err;
@@ -580,6 +581,8 @@ static int ubifs_unlink(struct inode *dir, struct dentry *dentry)
         dbg_gen("dent '%.*s' from ino %lu (nlink %d) in dir ino %lu",
                 dentry->d_name.len, dentry->d_name.name, inode->i_ino,
                 inode->i_nlink, dir->i_ino);
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
         err = dbg_check_synced_i_size(inode);
         if (err)
                 return err;
@@ -667,7 +670,8 @@ static int ubifs_rmdir(struct inode *dir, struct dentry *dentry)
 
         dbg_gen("directory '%.*s', ino %lu in dir ino %lu", dentry->d_name.len,
                 dentry->d_name.name, inode->i_ino, dir->i_ino);
-
+        ubifs_assert(mutex_is_locked(&dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&inode->i_mutex));
         err = check_dir_empty(c, dentry->d_inode);
         if (err)
                 return err;
@@ -922,59 +926,30 @@ out_budg:
 }
 
 /**
- * lock_3_inodes - lock three UBIFS inodes for rename.
+ * lock_3_inodes - a wrapper for locking three UBIFS inodes.
  * @inode1: first inode
  * @inode2: second inode
  * @inode3: third inode
  *
- * For 'ubifs_rename()', @inode1 may be the same as @inode2 whereas @inode3 may
- * be null.
+ * This function is used for 'ubifs_rename()' and @inode1 may be the same as
+ * @inode2 whereas @inode3 may be %NULL.
+ *
+ * We do not implement any tricks to guarantee strict lock ordering, because
+ * VFS has already done it for us on the @i_mutex. So this is just a simple
+ * wrapper function.
  */
 static void lock_3_inodes(struct inode *inode1, struct inode *inode2,
                           struct inode *inode3)
 {
-        struct inode *i1, *i2, *i3;
-
-        if (!inode3) {
-                if (inode1 != inode2) {
-                        lock_2_inodes(inode1, inode2);
-                        return;
-                }
-                mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
-                return;
-        }
-
-        if (inode1 == inode2) {
-                lock_2_inodes(inode1, inode3);
-                return;
-        }
-
-        /* 3 different inodes */
-        if (inode1 < inode2) {
-                i3 = inode2;
-                if (inode1 < inode3) {
-                        i1 = inode1;
-                        i2 = inode3;
-                } else {
-                        i1 = inode3;
-                        i2 = inode1;
-                }
-        } else {
-                i3 = inode1;
-                if (inode2 < inode3) {
-                        i1 = inode2;
-                        i2 = inode3;
-                } else {
-                        i1 = inode3;
-                        i2 = inode2;
-                }
-        }
-        mutex_lock_nested(&ubifs_inode(i1)->ui_mutex, WB_MUTEX_1);
-        lock_2_inodes(i2, i3);
+        mutex_lock_nested(&ubifs_inode(inode1)->ui_mutex, WB_MUTEX_1);
+        if (inode2 != inode1)
+                mutex_lock_nested(&ubifs_inode(inode2)->ui_mutex, WB_MUTEX_2);
+        if (inode3)
+                mutex_lock_nested(&ubifs_inode(inode3)->ui_mutex, WB_MUTEX_3);
 }
 
 /**
- * unlock_3_inodes - unlock three UBIFS inodes for rename.
+ * unlock_3_inodes - a wrapper for unlocking three UBIFS inodes for rename.
  * @inode1: first inode
  * @inode2: second inode
  * @inode3: third inode
@@ -982,11 +957,11 @@ static void lock_3_inodes(struct inode *inode1, struct inode *inode2,
 static void unlock_3_inodes(struct inode *inode1, struct inode *inode2,
                             struct inode *inode3)
 {
-        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
-        if (inode1 != inode2)
-                mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
         if (inode3)
                 mutex_unlock(&ubifs_inode(inode3)->ui_mutex);
+        if (inode1 != inode2)
+                mutex_unlock(&ubifs_inode(inode2)->ui_mutex);
+        mutex_unlock(&ubifs_inode(inode1)->ui_mutex);
 }
 
 static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
@@ -1020,6 +995,11 @@ static int ubifs_rename(struct inode *old_dir, struct dentry *old_dentry,
                 "dir ino %lu", old_dentry->d_name.len, old_dentry->d_name.name,
                 old_inode->i_ino, old_dir->i_ino, new_dentry->d_name.len,
                 new_dentry->d_name.name, new_dir->i_ino);
+        ubifs_assert(mutex_is_locked(&old_dir->i_mutex));
+        ubifs_assert(mutex_is_locked(&new_dir->i_mutex));
+        if (unlink)
+                ubifs_assert(mutex_is_locked(&new_inode->i_mutex));
+
 
         if (unlink && is_dir) {
                 err = check_dir_empty(c, new_inode);
@@ -1199,7 +1179,7 @@ int ubifs_getattr(struct vfsmount *mnt, struct dentry *dentry,
         return 0;
 }
 
-struct inode_operations ubifs_dir_inode_operations = {
+const struct inode_operations ubifs_dir_inode_operations = {
         .lookup      = ubifs_lookup,
         .create      = ubifs_create,
         .link        = ubifs_link,
@@ -1219,7 +1199,7 @@ struct inode_operations ubifs_dir_inode_operations = {
 #endif
 };
 
-struct file_operations ubifs_dir_operations = {
+const struct file_operations ubifs_dir_operations = {
         .llseek         = ubifs_dir_llseek,
         .release        = ubifs_dir_release,
         .read           = generic_read_dir,
diff --git a/fs/ubifs/file.c b/fs/ubifs/file.c
index bf37374567f..93b6de51f26 100644
--- a/fs/ubifs/file.c
+++ b/fs/ubifs/file.c
@@ -432,7 +432,6 @@ static int ubifs_write_begin(struct file *file, struct address_space *mapping,
         int uninitialized_var(err), appending = !!(pos + len > inode->i_size);
         struct page *page;
 
-
         ubifs_assert(ubifs_inode(inode)->ui_size == inode->i_size);
 
         if (unlikely(c->ro_media))
@@ -1541,7 +1540,7 @@ static int ubifs_file_mmap(struct file *file, struct vm_area_struct *vma)
         return 0;
 }
 
-struct address_space_operations ubifs_file_address_operations = {
+const struct address_space_operations ubifs_file_address_operations = {
         .readpage       = ubifs_readpage,
         .writepage      = ubifs_writepage,
         .write_begin    = ubifs_write_begin,
@@ -1551,7 +1550,7 @@ struct address_space_operations ubifs_file_address_operations = {
         .releasepage    = ubifs_releasepage,
 };
 
-struct inode_operations ubifs_file_inode_operations = {
+const struct inode_operations ubifs_file_inode_operations = {
         .setattr     = ubifs_setattr,
         .getattr     = ubifs_getattr,
 #ifdef CONFIG_UBIFS_FS_XATTR
@@ -1562,14 +1561,14 @@ struct inode_operations ubifs_file_inode_operations = {
 #endif
 };
 
-struct inode_operations ubifs_symlink_inode_operations = {
+const struct inode_operations ubifs_symlink_inode_operations = {
         .readlink    = generic_readlink,
         .follow_link = ubifs_follow_link,
         .setattr     = ubifs_setattr,
         .getattr     = ubifs_getattr,
 };
 
-struct file_operations ubifs_file_operations = {
+const struct file_operations ubifs_file_operations = {
         .llseek         = generic_file_llseek,
         .read           = do_sync_read,
         .write          = do_sync_write,
diff --git a/fs/ubifs/gc.c b/fs/ubifs/gc.c
index 9832f9abe28..a711d33b3d3 100644
--- a/fs/ubifs/gc.c
+++ b/fs/ubifs/gc.c
@@ -31,6 +31,26 @@
  * to be reused. Garbage collection will cause the number of dirty index nodes
  * to grow, however sufficient space is reserved for the index to ensure the
  * commit will never run out of space.
+ *
+ * Notes about dead watermark. At current UBIFS implementation we assume that
+ * LEBs which have less than @c->dead_wm bytes of free + dirty space are full
+ * and not worth garbage-collecting. The dead watermark is one min. I/O unit
+ * size, or min. UBIFS node size, depending on what is greater. Indeed, UBIFS
+ * Garbage Collector has to synchronize the GC head's write buffer before
+ * returning, so this is about wasting one min. I/O unit. However, UBIFS GC can
+ * actually reclaim even very small pieces of dirty space by garbage collecting
+ * enough dirty LEBs, but we do not bother doing this at this implementation.
+ *
+ * Notes about dark watermark. The results of GC work depends on how big are
+ * the UBIFS nodes GC deals with. Large nodes make GC waste more space. Indeed,
+ * if GC move data from LEB A to LEB B and nodes in LEB A are large, GC would
+ * have to waste large pieces of free space at the end of LEB B, because nodes
+ * from LEB A would not fit. And the worst situation is when all nodes are of
+ * maximum size. So dark watermark is the amount of free + dirty space in LEB
+ * which are guaranteed to be reclaimable. If LEB has less space, the GC migh
+ * be unable to reclaim it. So, LEBs with free + dirty greater than dark
+ * watermark are "good" LEBs from GC's point of few. The other LEBs are not so
+ * good, and GC takes extra care when moving them.
  */
 
 #include <linux/pagemap.h>
@@ -381,7 +401,7 @@ int ubifs_garbage_collect_leb(struct ubifs_info *c, struct ubifs_lprops *lp)
 
                 /*
                  * Don't release the LEB until after the next commit, because
-                 * it may contain date which is needed for recovery. So
+                 * it may contain data which is needed for recovery. So
                  * although we freed this LEB, it will become usable only after
                  * the commit.
                  */
@@ -810,8 +830,9 @@ out:
  * ubifs_destroy_idx_gc - destroy idx_gc list.
  * @c: UBIFS file-system description object
  *
- * This function destroys the idx_gc list. It is called when unmounting or
- * remounting read-only so locks are not needed.
+ * This function destroys the @c->idx_gc list. It is called when unmounting
+ * so locks are not needed. Returns zero in case of success and a negative
+ * error code in case of failure.
  */
 void ubifs_destroy_idx_gc(struct ubifs_info *c)
 {
@@ -824,7 +845,6 @@ void ubifs_destroy_idx_gc(struct ubifs_info *c)
                 list_del(&idx_gc->list);
                 kfree(idx_gc);
         }
-
 }
 
 /**
diff --git a/fs/ubifs/io.c b/fs/ubifs/io.c
index 01682713af6..e8e632a1dcd 100644
--- a/fs/ubifs/io.c
+++ b/fs/ubifs/io.c
@@ -29,7 +29,7 @@
  * would have been wasted for padding to the nearest minimal I/O unit boundary.
  * Instead, data first goes to the write-buffer and is flushed when the
  * buffer is full or when it is not used for some time (by timer). This is
- * similarto the mechanism is used by JFFS2.
+ * similar to the mechanism is used by JFFS2.
  *
  * Write-buffers are defined by 'struct ubifs_wbuf' objects and protected by
  * mutexes defined inside these objects. Since sometimes upper-level code
@@ -75,7 +75,7 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
  * @lnum: logical eraseblock number
  * @offs: offset within the logical eraseblock
  * @quiet: print no messages
- * @chk_crc: indicates whether to always check the CRC
+ * @must_chk_crc: indicates whether to always check the CRC
  *
  * This function checks node magic number and CRC checksum. This function also
  * validates node length to prevent UBIFS from becoming crazy when an attacker
@@ -83,11 +83,17 @@ void ubifs_ro_mode(struct ubifs_info *c, int err)
  * node length in the common header could cause UBIFS to read memory outside of
  * allocated buffer when checking the CRC checksum.
  *
- * This function returns zero in case of success %-EUCLEAN in case of bad CRC
- * or magic.
+ * This function may skip data nodes CRC checking if @c->no_chk_data_crc is
+ * true, which is controlled by corresponding UBIFS mount option. However, if
+ * @must_chk_crc is true, then @c->no_chk_data_crc is ignored and CRC is
+ * checked. Similarly, if @c->always_chk_crc is true, @c->no_chk_data_crc is
+ * ignored and CRC is checked.
+ *
+ * This function returns zero in case of success and %-EUCLEAN in case of bad
+ * CRC or magic.
  */
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet, int chk_crc)
+                     int offs, int quiet, int must_chk_crc)
 {
         int err = -EINVAL, type, node_len;
         uint32_t crc, node_crc, magic;
@@ -123,9 +129,9 @@ int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
                    node_len > c->ranges[type].max_len)
                 goto out_len;
 
-        if (!chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc)
-                if (c->no_chk_data_crc)
-                        return 0;
+        if (!must_chk_crc && type == UBIFS_DATA_NODE && !c->always_chk_crc &&
+             c->no_chk_data_crc)
+                return 0;
 
         crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
         node_crc = le32_to_cpu(ch->crc);
diff --git a/fs/ubifs/journal.c b/fs/ubifs/journal.c
index 9b7c54e0cd2..a11ca0958a2 100644
--- a/fs/ubifs/journal.c
+++ b/fs/ubifs/journal.c
@@ -208,7 +208,7 @@ again:
         offs = 0;
 
 out:
-        err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, UBI_SHORTTERM);
+        err = ubifs_wbuf_seek_nolock(wbuf, lnum, offs, wbuf->dtype);
         if (err)
                 goto out_unlock;
 
diff --git a/fs/ubifs/lprops.c b/fs/ubifs/lprops.c
index dfd2bcece27..4cdd284dea5 100644
--- a/fs/ubifs/lprops.c
+++ b/fs/ubifs/lprops.c
@@ -635,10 +635,10 @@ const struct ubifs_lprops *ubifs_change_lp(struct ubifs_info *c,
  * @c: UBIFS file-system description object
  * @st: return statistics
  */
-void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *st)
+void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *lst)
 {
         spin_lock(&c->space_lock);
-        memcpy(st, &c->lst, sizeof(struct ubifs_lp_stats));
+        memcpy(lst, &c->lst, sizeof(struct ubifs_lp_stats));
         spin_unlock(&c->space_lock);
 }
 
@@ -678,6 +678,9 @@ int ubifs_change_one_lp(struct ubifs_info *c, int lnum, int free, int dirty,
 
 out:
         ubifs_release_lprops(c);
+        if (err)
+                ubifs_err("cannot change properties of LEB %d, error %d",
+                          lnum, err);
         return err;
 }
 
@@ -714,6 +717,9 @@ int ubifs_update_one_lp(struct ubifs_info *c, int lnum, int free, int dirty,
 
 out:
         ubifs_release_lprops(c);
+        if (err)
+                ubifs_err("cannot update properties of LEB %d, error %d",
+                          lnum, err);
         return err;
 }
 
@@ -737,6 +743,8 @@ int ubifs_read_one_lp(struct ubifs_info *c, int lnum, struct ubifs_lprops *lp)
         lpp = ubifs_lpt_lookup(c, lnum);
         if (IS_ERR(lpp)) {
                 err = PTR_ERR(lpp);
+                ubifs_err("cannot read properties of LEB %d, error %d",
+                          lnum, err);
                 goto out;
         }
 
diff --git a/fs/ubifs/lpt_commit.c b/fs/ubifs/lpt_commit.c
index 96ca9570717..3216a1f277f 100644
--- a/fs/ubifs/lpt_commit.c
+++ b/fs/ubifs/lpt_commit.c
@@ -556,23 +556,23 @@ no_space:
 }
 
 /**
- * next_pnode - find next pnode.
+ * next_pnode_to_dirty - find next pnode to dirty.
  * @c: UBIFS file-system description object
  * @pnode: pnode
  *
- * This function returns the next pnode or %NULL if there are no more pnodes.
+ * This function returns the next pnode to dirty or %NULL if there are no more
+ * pnodes.  Note that pnodes that have never been written (lnum == 0) are
+ * skipped.
  */
-static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
-                                      struct ubifs_pnode *pnode)
+static struct ubifs_pnode *next_pnode_to_dirty(struct ubifs_info *c,
+                                               struct ubifs_pnode *pnode)
 {
         struct ubifs_nnode *nnode;
         int iip;
 
         /* Try to go right */
         nnode = pnode->parent;
-        iip = pnode->iip + 1;
-        if (iip < UBIFS_LPT_FANOUT) {
-                /* We assume here that LEB zero is never an LPT LEB */
+        for (iip = pnode->iip + 1; iip < UBIFS_LPT_FANOUT; iip++) {
                 if (nnode->nbranch[iip].lnum)
                         return ubifs_get_pnode(c, nnode, iip);
         }
@@ -583,8 +583,11 @@ static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
                 nnode = nnode->parent;
                 if (!nnode)
                         return NULL;
-                /* We assume here that LEB zero is never an LPT LEB */
-        } while (iip >= UBIFS_LPT_FANOUT || !nnode->nbranch[iip].lnum);
+                for (; iip < UBIFS_LPT_FANOUT; iip++) {
+                        if (nnode->nbranch[iip].lnum)
+                                break;
+                }
+       } while (iip >= UBIFS_LPT_FANOUT);
 
         /* Go right */
         nnode = ubifs_get_nnode(c, nnode, iip);
@@ -593,12 +596,29 @@ static struct ubifs_pnode *next_pnode(struct ubifs_info *c,
 
         /* Go down to level 1 */
         while (nnode->level > 1) {
-                nnode = ubifs_get_nnode(c, nnode, 0);
+                for (iip = 0; iip < UBIFS_LPT_FANOUT; iip++) {
+                        if (nnode->nbranch[iip].lnum)
+                                break;
+                }
+                if (iip >= UBIFS_LPT_FANOUT) {
+                        /*
+                         * Should not happen, but we need to keep going
+                         * if it does.
+                         */
+                        iip = 0;
+                }
+                nnode = ubifs_get_nnode(c, nnode, iip);
                 if (IS_ERR(nnode))
                         return (void *)nnode;
         }
 
-        return ubifs_get_pnode(c, nnode, 0);
+        for (iip = 0; iip < UBIFS_LPT_FANOUT; iip++)
+                if (nnode->nbranch[iip].lnum)
+                        break;
+        if (iip >= UBIFS_LPT_FANOUT)
+                /* Should not happen, but we need to keep going if it does */
+                iip = 0;
+        return ubifs_get_pnode(c, nnode, iip);
 }
 
 /**
@@ -688,7 +708,7 @@ static int make_tree_dirty(struct ubifs_info *c)
         pnode = pnode_lookup(c, 0);
         while (pnode) {
                 do_make_pnode_dirty(c, pnode);
-                pnode = next_pnode(c, pnode);
+                pnode = next_pnode_to_dirty(c, pnode);
                 if (IS_ERR(pnode))
                         return PTR_ERR(pnode);
         }
diff --git a/fs/ubifs/master.c b/fs/ubifs/master.c
index 71d5493bf56..a88f33801b9 100644
--- a/fs/ubifs/master.c
+++ b/fs/ubifs/master.c
@@ -354,7 +354,7 @@ int ubifs_write_master(struct ubifs_info *c)
         int err, lnum, offs, len;
 
         if (c->ro_media)
-                return -EINVAL;
+                return -EROFS;
 
         lnum = UBIFS_MST_LNUM;
         offs = c->mst_offs + c->mst_node_alsz;
diff --git a/fs/ubifs/orphan.c b/fs/ubifs/orphan.c
index 9e6f403f170..152a7b34a14 100644
--- a/fs/ubifs/orphan.c
+++ b/fs/ubifs/orphan.c
@@ -46,7 +46,7 @@
  * Orphans are accumulated in a rb-tree. When an inode's link count drops to
  * zero, the inode number is added to the rb-tree. It is removed from the tree
  * when the inode is deleted.  Any new orphans that are in the orphan tree when
- * the commit is run, are written to the orphan area in 1 or more orph nodes.
+ * the commit is run, are written to the orphan area in 1 or more orphan nodes.
  * If the orphan area is full, it is consolidated to make space.  There is
  * always enough space because validation prevents the user from creating more
  * than the maximum number of orphans allowed.
@@ -231,7 +231,7 @@ static int tot_avail_orphs(struct ubifs_info *c)
 }
 
 /**
- * do_write_orph_node - write a node
+ * do_write_orph_node - write a node to the orphan head.
  * @c: UBIFS file-system description object
  * @len: length of node
  * @atomic: write atomically
@@ -264,11 +264,11 @@ static int do_write_orph_node(struct ubifs_info *c, int len, int atomic)
 }
 
 /**
- * write_orph_node - write an orph node
+ * write_orph_node - write an orphan node.
  * @c: UBIFS file-system description object
  * @atomic: write atomically
  *
- * This function builds an orph node from the cnext list and writes it to the
+ * This function builds an orphan node from the cnext list and writes it to the
  * orphan head. On success, %0 is returned, otherwise a negative error code
  * is returned.
  */
@@ -326,11 +326,11 @@ static int write_orph_node(struct ubifs_info *c, int atomic)
 }
 
 /**
- * write_orph_nodes - write orph nodes until there are no more to commit
+ * write_orph_nodes - write orphan nodes until there are no more to commit.
  * @c: UBIFS file-system description object
  * @atomic: write atomically
  *
- * This function writes orph nodes for all the orphans to commit. On success,
+ * This function writes orphan nodes for all the orphans to commit. On success,
  * %0 is returned, otherwise a negative error code is returned.
  */
 static int write_orph_nodes(struct ubifs_info *c, int atomic)
@@ -478,14 +478,14 @@ int ubifs_orphan_end_commit(struct ubifs_info *c)
 }
 
 /**
- * clear_orphans - erase all LEBs used for orphans.
+ * ubifs_clear_orphans - erase all LEBs used for orphans.
  * @c: UBIFS file-system description object
  *
  * If recovery is not required, then the orphans from the previous session
  * are not needed. This function locates the LEBs used to record
  * orphans, and un-maps them.
  */
-static int clear_orphans(struct ubifs_info *c)
+int ubifs_clear_orphans(struct ubifs_info *c)
 {
         int lnum, err;
 
@@ -547,9 +547,9 @@ static int insert_dead_orphan(struct ubifs_info *c, ino_t inum)
  * do_kill_orphans - remove orphan inodes from the index.
  * @c: UBIFS file-system description object
  * @sleb: scanned LEB
- * @last_cmt_no: cmt_no of last orph node read is passed and returned here
+ * @last_cmt_no: cmt_no of last orphan node read is passed and returned here
  * @outofdate: whether the LEB is out of date is returned here
- * @last_flagged: whether the end orph node is encountered
+ * @last_flagged: whether the end orphan node is encountered
  *
  * This function is a helper to the 'kill_orphans()' function. It goes through
  * every orphan node in a LEB and for every inode number recorded, removes
@@ -580,8 +580,8 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                 /*
                  * The commit number on the master node may be less, because
                  * of a failed commit. If there are several failed commits in a
-                 * row, the commit number written on orph nodes will continue to
-                 * increase (because the commit number is adjusted here) even
+                 * row, the commit number written on orphan nodes will continue
+                 * to increase (because the commit number is adjusted here) even
                  * though the commit number on the master node stays the same
                  * because the master node has not been re-written.
                  */
@@ -589,9 +589,9 @@ static int do_kill_orphans(struct ubifs_info *c, struct ubifs_scan_leb *sleb,
                         c->cmt_no = cmt_no;
                 if (cmt_no < *last_cmt_no && *last_flagged) {
                         /*
-                         * The last orph node had a higher commit number and was
-                         * flagged as the last written for that commit number.
-                         * That makes this orph node, out of date.
+                         * The last orphan node had a higher commit number and
+                         * was flagged as the last written for that commit
+                         * number. That makes this orphan node, out of date.
                          */
                         if (!first) {
                                 ubifs_err("out of order commit number %llu in "
@@ -658,10 +658,10 @@ static int kill_orphans(struct ubifs_info *c)
         /*
          * Orph nodes always start at c->orph_first and are written to each
          * successive LEB in turn. Generally unused LEBs will have been unmapped
-         * but may contain out of date orph nodes if the unmap didn't go
-         * through. In addition, the last orph node written for each commit is
+         * but may contain out of date orphan nodes if the unmap didn't go
+         * through. In addition, the last orphan node written for each commit is
          * marked (top bit of orph->cmt_no is set to 1). It is possible that
-         * there are orph nodes from the next commit (i.e. the commit did not
+         * there are orphan nodes from the next commit (i.e. the commit did not
          * complete successfully). In that case, no orphans will have been lost
          * due to the way that orphans are written, and any orphans added will
          * be valid orphans anyway and so can be deleted.
@@ -718,7 +718,7 @@ int ubifs_mount_orphans(struct ubifs_info *c, int unclean, int read_only)
         if (unclean)
                 err = kill_orphans(c);
         else if (!read_only)
-                err = clear_orphans(c);
+                err = ubifs_clear_orphans(c);
 
         return err;
 }
diff --git a/fs/ubifs/super.c b/fs/ubifs/super.c
index 89556ee7251..1182b66a549 100644
--- a/fs/ubifs/super.c
+++ b/fs/ubifs/super.c
@@ -397,6 +397,7 @@ static int ubifs_statfs(struct dentry *dentry, struct kstatfs *buf)
         buf->f_namelen = UBIFS_MAX_NLEN;
         buf->f_fsid.val[0] = le32_to_cpu(uuid[0]) ^ le32_to_cpu(uuid[2]);
         buf->f_fsid.val[1] = le32_to_cpu(uuid[1]) ^ le32_to_cpu(uuid[3]);
+        ubifs_assert(buf->f_bfree <= c->block_cnt);
         return 0;
 }
 
@@ -432,33 +433,24 @@ static int ubifs_sync_fs(struct super_block *sb, int wait)
         int i, err;
         struct ubifs_info *c = sb->s_fs_info;
         struct writeback_control wbc = {
-                .sync_mode   = wait ? WB_SYNC_ALL : WB_SYNC_NONE,
+                .sync_mode   = WB_SYNC_ALL,
                 .range_start = 0,
                 .range_end   = LLONG_MAX,
                 .nr_to_write = LONG_MAX,
         };
 
         /*
-         * Note by akpm about WB_SYNC_NONE used above: zero @wait is just an
-         * advisory thing to help the file system shove lots of data into the
-         * queues. If some gets missed then it'll be picked up on the second
+         * Zero @wait is just an advisory thing to help the file system shove
+         * lots of data into the queues, and there will be the second
          * '->sync_fs()' call, with non-zero @wait.
          */
+        if (!wait)
+                return 0;
 
         if (sb->s_flags & MS_RDONLY)
                 return 0;
 
         /*
-         * Synchronize write buffers, because 'ubifs_run_commit()' does not
-         * do this if it waits for an already running commit.
-         */
-        for (i = 0; i < c->jhead_cnt; i++) {
-                err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
-                if (err)
-                        return err;
-        }
-
-        /*
          * VFS calls '->sync_fs()' before synchronizing all dirty inodes and
          * pages, so synchronize them first, then commit the journal. Strictly
          * speaking, it is not necessary to commit the journal here,
@@ -469,6 +461,16 @@ static int ubifs_sync_fs(struct super_block *sb, int wait)
          */
         generic_sync_sb_inodes(sb, &wbc);
 
+        /*
+         * Synchronize write buffers, because 'ubifs_run_commit()' does not
+         * do this if it waits for an already running commit.
+         */
+        for (i = 0; i < c->jhead_cnt; i++) {
+                err = ubifs_wbuf_sync(&c->jheads[i].wbuf);
+                if (err)
+                        return err;
+        }
+
         err = ubifs_run_commit(c);
         if (err)
                 return err;
@@ -572,15 +574,8 @@ static int init_constants_early(struct ubifs_info *c)
         c->ranges[UBIFS_IDX_NODE].max_len = INT_MAX;
 
         /*
-         * Initialize dead and dark LEB space watermarks.
-         *
-         * Dead space is the space which cannot be used. Its watermark is
-         * equivalent to min. I/O unit or minimum node size if it is greater
-         * then min. I/O unit.
-         *
-         * Dark space is the space which might be used, or might not, depending
-         * on which node should be written to the LEB. Its watermark is
-         * equivalent to maximum UBIFS node size.
+         * Initialize dead and dark LEB space watermarks. See gc.c for comments
+         * about these values.
          */
         c->dead_wm = ALIGN(MIN_WRITE_SZ, c->min_io_size);
         c->dark_wm = ALIGN(UBIFS_MAX_NODE_SZ, c->min_io_size);
@@ -741,12 +736,12 @@ static void init_constants_master(struct ubifs_info *c)
  * take_gc_lnum - reserve GC LEB.
  * @c: UBIFS file-system description object
  *
- * This function ensures that the LEB reserved for garbage collection is
- * unmapped and is marked as "taken" in lprops. We also have to set free space
- * to LEB size and dirty space to zero, because lprops may contain out-of-date
- * information if the file-system was un-mounted before it has been committed.
- * This function returns zero in case of success and a negative error code in
- * case of failure.
+ * This function ensures that the LEB reserved for garbage collection is marked
+ * as "taken" in lprops. We also have to set free space to LEB size and dirty
+ * space to zero, because lprops may contain out-of-date information if the
+ * file-system was un-mounted before it has been committed. This function
+ * returns zero in case of success and a negative error code in case of
+ * failure.
  */
 static int take_gc_lnum(struct ubifs_info *c)
 {
@@ -757,10 +752,6 @@ static int take_gc_lnum(struct ubifs_info *c)
                 return -EINVAL;
         }
 
-        err = ubifs_leb_unmap(c, c->gc_lnum);
-        if (err)
-                return err;
-
         /* And we have to tell lprops that this LEB is taken */
         err = ubifs_change_one_lp(c, c->gc_lnum, c->leb_size, 0,
                                   LPROPS_TAKEN, 0, 0);
@@ -966,13 +957,16 @@ static int ubifs_parse_options(struct ubifs_info *c, char *options,
 
                 token = match_token(p, tokens, args);
                 switch (token) {
+                /*
+                 * %Opt_fast_unmount and %Opt_norm_unmount options are ignored.
+                 * We accepte them in order to be backware-compatible. But this
+                 * should be removed at some point.
+                 */
                 case Opt_fast_unmount:
                         c->mount_opts.unmount_mode = 2;
-                        c->fast_unmount = 1;
                         break;
                 case Opt_norm_unmount:
                         c->mount_opts.unmount_mode = 1;
-                        c->fast_unmount = 0;
                         break;
                 case Opt_bulk_read:
                         c->mount_opts.bulk_read = 2;
@@ -1094,12 +1088,7 @@ static int check_free_space(struct ubifs_info *c)
                 ubifs_err("insufficient free space to mount in read/write mode");
                 dbg_dump_budg(c);
                 dbg_dump_lprops(c);
-                /*
-                 * We return %-EINVAL instead of %-ENOSPC because it seems to
-                 * be the closest error code mentioned in the mount function
-                 * documentation.
-                 */
-                return -EINVAL;
+                return -ENOSPC;
         }
         return 0;
 }
@@ -1286,10 +1275,19 @@ static int mount_ubifs(struct ubifs_info *c)
                         if (err)
                                 goto out_orphans;
                         err = ubifs_rcvry_gc_commit(c);
-                } else
+                } else {
                         err = take_gc_lnum(c);
-                if (err)
-                        goto out_orphans;
+                        if (err)
+                                goto out_orphans;
+
+                        /*
+                         * GC LEB may contain garbage if there was an unclean
+                         * reboot, and it should be un-mapped.
+                         */
+                        err = ubifs_leb_unmap(c, c->gc_lnum);
+                        if (err)
+                                return err;
+                }
 
                 err = dbg_check_lprops(c);
                 if (err)
@@ -1298,6 +1296,16 @@ static int mount_ubifs(struct ubifs_info *c)
                 err = ubifs_recover_size(c);
                 if (err)
                         goto out_orphans;
+        } else {
+                /*
+                 * Even if we mount read-only, we have to set space in GC LEB
+                 * to proper value because this affects UBIFS free space
+                 * reporting. We do not want to have a situation when
+                 * re-mounting from R/O to R/W changes amount of free space.
+                 */
+                err = take_gc_lnum(c);
+                if (err)
+                        goto out_orphans;
         }
 
         spin_lock(&ubifs_infos_lock);
@@ -1310,14 +1318,17 @@ static int mount_ubifs(struct ubifs_info *c)
                 else {
                         c->need_recovery = 0;
                         ubifs_msg("recovery completed");
+                        /* GC LEB has to be empty and taken at this point */
+                        ubifs_assert(c->lst.taken_empty_lebs == 1);
                 }
-        }
+        } else
+                ubifs_assert(c->lst.taken_empty_lebs == 1);
 
-        err = dbg_debugfs_init_fs(c);
+        err = dbg_check_filesystem(c);
         if (err)
                 goto out_infos;
 
-        err = dbg_check_filesystem(c);
+        err = dbg_debugfs_init_fs(c);
         if (err)
                 goto out_infos;
 
@@ -1351,7 +1362,6 @@ static int mount_ubifs(struct ubifs_info *c)
                c->uuid[4], c->uuid[5], c->uuid[6], c->uuid[7],
                c->uuid[8], c->uuid[9], c->uuid[10], c->uuid[11],
                c->uuid[12], c->uuid[13], c->uuid[14], c->uuid[15]);
-        dbg_msg("fast unmount:        %d", c->fast_unmount);
         dbg_msg("big_lpt              %d", c->big_lpt);
         dbg_msg("log LEBs:            %d (%d - %d)",
                 c->log_lebs, UBIFS_LOG_LNUM, c->log_last);
@@ -1475,10 +1485,8 @@ static int ubifs_remount_rw(struct ubifs_info *c)
 {
         int err, lnum;
 
-        if (c->ro_media)
-                return -EINVAL;
-
         mutex_lock(&c->umount_mutex);
+        dbg_save_space_info(c);
         c->remounting_rw = 1;
         c->always_chk_crc = 1;
 
@@ -1514,6 +1522,12 @@ static int ubifs_remount_rw(struct ubifs_info *c)
                 err = ubifs_recover_inl_heads(c, c->sbuf);
                 if (err)
                         goto out;
+        } else {
+                /* A readonly mount is not allowed to have orphans */
+                ubifs_assert(c->tot_orphans == 0);
+                err = ubifs_clear_orphans(c);
+                if (err)
+                        goto out;
         }
 
         if (!(c->mst_node->flags & cpu_to_le32(UBIFS_MST_DIRTY))) {
@@ -1569,7 +1583,7 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         if (c->need_recovery)
                 err = ubifs_rcvry_gc_commit(c);
         else
-                err = take_gc_lnum(c);
+                err = ubifs_leb_unmap(c, c->gc_lnum);
         if (err)
                 goto out;
 
@@ -1582,8 +1596,9 @@ static int ubifs_remount_rw(struct ubifs_info *c)
         c->vfs_sb->s_flags &= ~MS_RDONLY;
         c->remounting_rw = 0;
         c->always_chk_crc = 0;
+        err = dbg_check_space_info(c);
         mutex_unlock(&c->umount_mutex);
-        return 0;
+        return err;
 
 out:
         vfree(c->orph_buf);
@@ -1603,43 +1618,18 @@ out:
 }
 
 /**
- * commit_on_unmount - commit the journal when un-mounting.
- * @c: UBIFS file-system description object
- *
- * This function is called during un-mounting and re-mounting, and it commits
- * the journal unless the "fast unmount" mode is enabled.
- */
-static void commit_on_unmount(struct ubifs_info *c)
-{
-        struct super_block *sb = c->vfs_sb;
-        long long bud_bytes;
-
-        /*
-         * This function is called before the background thread is stopped, so
-         * we may race with ongoing commit, which means we have to take
-         * @c->bud_lock to access @c->bud_bytes.
-         */
-        spin_lock(&c->buds_lock);
-        bud_bytes = c->bud_bytes;
-        spin_unlock(&c->buds_lock);
-
-        if (!c->fast_unmount && !(sb->s_flags & MS_RDONLY) && bud_bytes)
-                ubifs_run_commit(c);
-}
-
-/**
  * ubifs_remount_ro - re-mount in read-only mode.
  * @c: UBIFS file-system description object
  *
- * We rely on VFS to have stopped writing. Possibly the background thread could
- * be running a commit, however kthread_stop will wait in that case.
+ * We assume VFS has stopped writing. Possibly the background thread could be
+ * running a commit, however kthread_stop will wait in that case.
  */
 static void ubifs_remount_ro(struct ubifs_info *c)
 {
         int i, err;
 
         ubifs_assert(!c->need_recovery);
-        commit_on_unmount(c);
+        ubifs_assert(!(c->vfs_sb->s_flags & MS_RDONLY));
 
         mutex_lock(&c->umount_mutex);
         if (c->bgt) {
@@ -1647,27 +1637,29 @@ static void ubifs_remount_ro(struct ubifs_info *c)
                 c->bgt = NULL;
         }
 
+        dbg_save_space_info(c);
+
         for (i = 0; i < c->jhead_cnt; i++) {
                 ubifs_wbuf_sync(&c->jheads[i].wbuf);
                 del_timer_sync(&c->jheads[i].wbuf.timer);
         }
 
-        if (!c->ro_media) {
-                c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY);
-                c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
-                c->mst_node->gc_lnum = cpu_to_le32(c->gc_lnum);
-                err = ubifs_write_master(c);
-                if (err)
-                        ubifs_ro_mode(c, err);
-        }
+        c->mst_node->flags &= ~cpu_to_le32(UBIFS_MST_DIRTY);
+        c->mst_node->flags |= cpu_to_le32(UBIFS_MST_NO_ORPHS);
+        c->mst_node->gc_lnum = cpu_to_le32(c->gc_lnum);
+        err = ubifs_write_master(c);
+        if (err)
+                ubifs_ro_mode(c, err);
 
-        ubifs_destroy_idx_gc(c);
         free_wbufs(c);
         vfree(c->orph_buf);
         c->orph_buf = NULL;
         vfree(c->ileb_buf);
         c->ileb_buf = NULL;
         ubifs_lpt_free(c, 1);
+        err = dbg_check_space_info(c);
+        if (err)
+                ubifs_ro_mode(c, err);
         mutex_unlock(&c->umount_mutex);
 }
 
@@ -1760,11 +1752,20 @@ static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
         }
 
         if ((sb->s_flags & MS_RDONLY) && !(*flags & MS_RDONLY)) {
+                if (c->ro_media) {
+                        ubifs_msg("cannot re-mount due to prior errors");
+                        return -EROFS;
+                }
                 err = ubifs_remount_rw(c);
                 if (err)
                         return err;
-        } else if (!(sb->s_flags & MS_RDONLY) && (*flags & MS_RDONLY))
+        } else if (!(sb->s_flags & MS_RDONLY) && (*flags & MS_RDONLY)) {
+                if (c->ro_media) {
+                        ubifs_msg("cannot re-mount due to prior errors");
+                        return -EROFS;
+                }
                 ubifs_remount_ro(c);
+        }
 
         if (c->bulk_read == 1)
                 bu_init(c);
@@ -1774,10 +1775,11 @@ static int ubifs_remount_fs(struct super_block *sb, int *flags, char *data)
                 c->bu.buf = NULL;
         }
 
+        ubifs_assert(c->lst.taken_empty_lebs == 1);
         return 0;
 }
 
-struct super_operations ubifs_super_operations = {
+const struct super_operations ubifs_super_operations = {
         .alloc_inode   = ubifs_alloc_inode,
         .destroy_inode = ubifs_destroy_inode,
         .put_super     = ubifs_put_super,
@@ -2044,15 +2046,6 @@ out_close:
 
 static void ubifs_kill_sb(struct super_block *sb)
 {
-        struct ubifs_info *c = sb->s_fs_info;
-
-        /*
-         * We do 'commit_on_unmount()' here instead of 'ubifs_put_super()'
-         * in order to be outside BKL.
-         */
-        if (sb->s_root)
-                commit_on_unmount(c);
-        /* The un-mount routine is actually done in put_super() */
         generic_shutdown_super(sb);
 }
 
diff --git a/fs/ubifs/tnc.c b/fs/ubifs/tnc.c
index f7e36f54552..fa28a84c6a1 100644
--- a/fs/ubifs/tnc.c
+++ b/fs/ubifs/tnc.c
@@ -443,6 +443,11 @@ static int tnc_read_node_nm(struct ubifs_info *c, struct ubifs_zbranch *zbr,
  * This function performs that same function as ubifs_read_node except that
  * it does not require that there is actually a node present and instead
  * the return code indicates if a node was read.
+ *
+ * Note, this function does not check CRC of data nodes if @c->no_chk_data_crc
+ * is true (it is controlled by corresponding mount option). However, if
+ * @c->always_chk_crc is true, @c->no_chk_data_crc is ignored and CRC is always
+ * checked.
  */
 static int try_read_node(const struct ubifs_info *c, void *buf, int type,
                          int len, int lnum, int offs)
@@ -470,9 +475,8 @@ static int try_read_node(const struct ubifs_info *c, void *buf, int type,
         if (node_len != len)
                 return 0;
 
-        if (type == UBIFS_DATA_NODE && !c->always_chk_crc)
-                if (c->no_chk_data_crc)
-                        return 0;
+        if (type == UBIFS_DATA_NODE && !c->always_chk_crc && c->no_chk_data_crc)
+                return 1;
 
         crc = crc32(UBIFS_CRC32_INIT, buf + 8, node_len - 8);
         node_crc = le32_to_cpu(ch->crc);
@@ -1506,7 +1510,7 @@ out:
  *
  * Note, if the bulk-read buffer length (@bu->buf_len) is known, this function
  * makes sure bulk-read nodes fit the buffer. Otherwise, this function prepares
- * maxumum possible amount of nodes for bulk-read.
+ * maximum possible amount of nodes for bulk-read.
  */
 int ubifs_tnc_get_bu_keys(struct ubifs_info *c, struct bu_info *bu)
 {
diff --git a/fs/ubifs/ubifs.h b/fs/ubifs/ubifs.h
index fc2a4cc66d0..039a68bee29 100644
--- a/fs/ubifs/ubifs.h
+++ b/fs/ubifs/ubifs.h
@@ -426,9 +426,9 @@ struct ubifs_unclean_leb {
  * LEB properties flags.
  *
  * LPROPS_UNCAT: not categorized
- * LPROPS_DIRTY: dirty > 0, not index
+ * LPROPS_DIRTY: dirty > free, dirty >= @c->dead_wm, not index
  * LPROPS_DIRTY_IDX: dirty + free > @c->min_idx_node_sze and index
- * LPROPS_FREE: free > 0, not empty, not index
+ * LPROPS_FREE: free > 0, dirty < @c->dead_wm, not empty, not index
  * LPROPS_HEAP_CNT: number of heaps used for storing categorized LEBs
  * LPROPS_EMPTY: LEB is empty, not taken
  * LPROPS_FREEABLE: free + dirty == leb_size, not index, not taken
@@ -961,7 +961,6 @@ struct ubifs_debug_info;
  * @cs_lock: commit state lock
  * @cmt_wq: wait queue to sleep on if the log is full and a commit is running
  *
- * @fast_unmount: do not run journal commit before un-mounting
  * @big_lpt: flag that LPT is too big to write whole during commit
  * @no_chk_data_crc: do not check CRCs when reading data nodes (except during
  *                   recovery)
@@ -1202,7 +1201,6 @@ struct ubifs_info {
         spinlock_t cs_lock;
         wait_queue_head_t cmt_wq;
 
-        unsigned int fast_unmount:1;
         unsigned int big_lpt:1;
         unsigned int no_chk_data_crc:1;
         unsigned int bulk_read:1;
@@ -1405,13 +1403,13 @@ extern struct list_head ubifs_infos;
 extern spinlock_t ubifs_infos_lock;
 extern atomic_long_t ubifs_clean_zn_cnt;
 extern struct kmem_cache *ubifs_inode_slab;
-extern struct super_operations ubifs_super_operations;
-extern struct address_space_operations ubifs_file_address_operations;
-extern struct file_operations ubifs_file_operations;
-extern struct inode_operations ubifs_file_inode_operations;
-extern struct file_operations ubifs_dir_operations;
-extern struct inode_operations ubifs_dir_inode_operations;
-extern struct inode_operations ubifs_symlink_inode_operations;
+extern const struct super_operations ubifs_super_operations;
+extern const struct address_space_operations ubifs_file_address_operations;
+extern const struct file_operations ubifs_file_operations;
+extern const struct inode_operations ubifs_file_inode_operations;
+extern const struct file_operations ubifs_dir_operations;
+extern const struct inode_operations ubifs_dir_inode_operations;
+extern const struct inode_operations ubifs_symlink_inode_operations;
 extern struct backing_dev_info ubifs_backing_dev_info;
 extern struct ubifs_compressor *ubifs_compressors[UBIFS_COMPR_TYPES_CNT];
 
@@ -1428,7 +1426,7 @@ int ubifs_read_node_wbuf(struct ubifs_wbuf *wbuf, void *buf, int type, int len,
 int ubifs_write_node(struct ubifs_info *c, void *node, int len, int lnum,
                      int offs, int dtype);
 int ubifs_check_node(const struct ubifs_info *c, const void *buf, int lnum,
-                     int offs, int quiet, int chk_crc);
+                     int offs, int quiet, int must_chk_crc);
 void ubifs_prepare_node(struct ubifs_info *c, void *buf, int len, int pad);
 void ubifs_prep_grp_node(struct ubifs_info *c, void *node, int len, int last);
 int ubifs_io_init(struct ubifs_info *c);
@@ -1495,6 +1493,7 @@ void ubifs_release_ino_dirty(struct ubifs_info *c, struct inode *inode,
 void ubifs_cancel_ino_op(struct ubifs_info *c, struct inode *inode,
                          struct ubifs_budget_req *req);
 long long ubifs_get_free_space(struct ubifs_info *c);
+long long ubifs_get_free_space_nolock(struct ubifs_info *c);
 int ubifs_calc_min_idx_lebs(struct ubifs_info *c);
 void ubifs_convert_page_budget(struct ubifs_info *c);
 long long ubifs_reported_space(const struct ubifs_info *c, long long free);
@@ -1603,6 +1602,7 @@ void ubifs_delete_orphan(struct ubifs_info *c, ino_t inum);
 int ubifs_orphan_start_commit(struct ubifs_info *c);
 int ubifs_orphan_end_commit(struct ubifs_info *c);
 int ubifs_mount_orphans(struct ubifs_info *c, int unclean, int read_only);
+int ubifs_clear_orphans(struct ubifs_info *c);
 
 /* lpt.c */
 int ubifs_calc_lpt_geom(struct ubifs_info *c);
@@ -1646,7 +1646,7 @@ const struct ubifs_lprops *ubifs_change_lp(struct ubifs_info *c,
                                            const struct ubifs_lprops *lp,
                                            int free, int dirty, int flags,
                                            int idx_gc_cnt);
-void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *stats);
+void ubifs_get_lp_stats(struct ubifs_info *c, struct ubifs_lp_stats *lst);
 void ubifs_add_to_cat(struct ubifs_info *c, struct ubifs_lprops *lprops,
                       int cat);
 void ubifs_replace_cat(struct ubifs_info *c, struct ubifs_lprops *old_lprops,
diff --git a/fs/xfs/linux-2.6/xfs_sync.c b/fs/xfs/linux-2.6/xfs_sync.c
index 2ed035354c2..a608e72fa40 100644
--- a/fs/xfs/linux-2.6/xfs_sync.c
+++ b/fs/xfs/linux-2.6/xfs_sync.c
@@ -371,7 +371,11 @@ xfs_quiesce_attr(
         /* flush inodes and push all remaining buffers out to disk */
         xfs_quiesce_fs(mp);
 
-        ASSERT_ALWAYS(atomic_read(&mp->m_active_trans) == 0);
+        /*
+         * Just warn here till VFS can correctly support
+         * read-only remount without racing.
+         */
+        WARN_ON(atomic_read(&mp->m_active_trans) != 0);
 
         /* Push the superblock and write an unmount record */
         error = xfs_log_sbcount(mp, 1);
diff --git a/fs/xfs/xfs_dfrag.c b/fs/xfs/xfs_dfrag.c
index b4c1ee71349..f8278cfcc1d 100644
--- a/fs/xfs/xfs_dfrag.c
+++ b/fs/xfs/xfs_dfrag.c
@@ -55,17 +55,11 @@ xfs_swapext(
         struct file     *file, *target_file;
         int             error = 0;
 
-        sxp = kmem_alloc(sizeof(xfs_swapext_t), KM_MAYFAIL);
-        if (!sxp) {
-                error = XFS_ERROR(ENOMEM);
-                goto out;
-        }
-
         /* Pull information for the target fd */
         file = fget((int)sxp->sx_fdtarget);
         if (!file) {
                 error = XFS_ERROR(EINVAL);
-                goto out_free_sxp;
+                goto out;
         }
 
         if (!(file->f_mode & FMODE_WRITE) || (file->f_flags & O_APPEND)) {
@@ -109,8 +103,6 @@ xfs_swapext(
         fput(target_file);
  out_put_file:
         fput(file);
- out_free_sxp:
-        kmem_free(sxp);
  out:
         return error;
 }
diff --git a/fs/xfs/xfs_log_recover.c b/fs/xfs/xfs_log_recover.c
index 35cca98bd94..b1047de2fff 100644
--- a/fs/xfs/xfs_log_recover.c
+++ b/fs/xfs/xfs_log_recover.c
@@ -70,16 +70,21 @@ STATIC void	xlog_recover_check_summary(xlog_t *);
 xfs_buf_t *
 xlog_get_bp(
         xlog_t          *log,
-        int             num_bblks)
+        int             nbblks)
 {
-        ASSERT(num_bblks > 0);
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_get_bp(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return NULL;
+        }
 
         if (log->l_sectbb_log) {
-                if (num_bblks > 1)
-                        num_bblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);
-                num_bblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, num_bblks);
+                if (nbblks > 1)
+                        nbblks += XLOG_SECTOR_ROUNDUP_BBCOUNT(log, 1);
+                nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
         }
-        return xfs_buf_get_noaddr(BBTOB(num_bblks), log->l_mp->m_logdev_targp);
+        return xfs_buf_get_noaddr(BBTOB(nbblks), log->l_mp->m_logdev_targp);
 }
 
 void
@@ -102,6 +107,13 @@ xlog_bread(
 {
         int             error;
 
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_bread(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return EFSCORRUPTED;
+        }
+
         if (log->l_sectbb_log) {
                 blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);
                 nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
@@ -139,6 +151,13 @@ xlog_bwrite(
 {
         int             error;
 
+        if (nbblks <= 0 || nbblks > log->l_logBBsize) {
+                xlog_warn("XFS: Invalid block length (0x%x) given for buffer", nbblks);
+                XFS_ERROR_REPORT("xlog_bwrite(1)",
+                                 XFS_ERRLEVEL_HIGH, log->l_mp);
+                return EFSCORRUPTED;
+        }
+
         if (log->l_sectbb_log) {
                 blk_no = XLOG_SECTOR_ROUNDDOWN_BLKNO(log, blk_no);
                 nbblks = XLOG_SECTOR_ROUNDUP_BBCOUNT(log, nbblks);
diff --git a/include/acpi/acpiosxf.h b/include/acpi/acpiosxf.h
index a62720a7edc..ab0b85cf21f 100644
--- a/include/acpi/acpiosxf.h
+++ b/include/acpi/acpiosxf.h
@@ -144,6 +144,7 @@ void __iomem *acpi_os_map_memory(acpi_physical_address where,
                                 acpi_size length);
 
 void acpi_os_unmap_memory(void __iomem * logical_address, acpi_size size);
+void early_acpi_os_unmap_memory(void __iomem * virt, acpi_size size);
 
 #ifdef ACPI_FUTURE_USAGE
 acpi_status
diff --git a/include/acpi/acpixf.h b/include/acpi/acpixf.h
index c8e8cf45830..cc40102fe2f 100644
--- a/include/acpi/acpixf.h
+++ b/include/acpi/acpixf.h
@@ -130,6 +130,10 @@ acpi_get_table_header(acpi_string signature,
                       struct acpi_table_header *out_table_header);
 
 acpi_status
+acpi_get_table_with_size(acpi_string signature,
+               u32 instance, struct acpi_table_header **out_table,
+               acpi_size *tbl_size);
+acpi_status
 acpi_get_table(acpi_string signature,
                u32 instance, struct acpi_table_header **out_table);
 
diff --git a/include/acpi/pdc_intel.h b/include/acpi/pdc_intel.h
index e72bfdd887f..552637b0d05 100644
--- a/include/acpi/pdc_intel.h
+++ b/include/acpi/pdc_intel.h
@@ -14,6 +14,7 @@
 #define ACPI_PDC_SMP_T_SWCOORD          (0x0080)
 #define ACPI_PDC_C_C1_FFH               (0x0100)
 #define ACPI_PDC_C_C2C3_FFH             (0x0200)
+#define ACPI_PDC_SMP_P_HWCOORD          (0x0800)
 
 #define ACPI_PDC_EST_CAPABILITY_SMP     (ACPI_PDC_SMP_C1PT | \
                                          ACPI_PDC_C_C1_HALT | \
@@ -22,6 +23,7 @@
 #define ACPI_PDC_EST_CAPABILITY_SWSMP   (ACPI_PDC_SMP_C1PT | \
                                          ACPI_PDC_C_C1_HALT | \
                                          ACPI_PDC_SMP_P_SWCOORD | \
+                                         ACPI_PDC_SMP_P_HWCOORD | \
                                          ACPI_PDC_P_FFH)
 
 #define ACPI_PDC_C_CAPABILITY_SMP       (ACPI_PDC_SMP_C2C3  | \
diff --git a/include/asm-generic/percpu.h b/include/asm-generic/percpu.h
index b0e63c672eb..00f45ff081a 100644
--- a/include/asm-generic/percpu.h
+++ b/include/asm-generic/percpu.h
@@ -80,4 +80,56 @@ extern void setup_per_cpu_areas(void);
 #define DECLARE_PER_CPU(type, name) extern PER_CPU_ATTRIBUTES \
                                         __typeof__(type) per_cpu_var(name)
 
+/*
+ * Optional methods for optimized non-lvalue per-cpu variable access.
+ *
+ * @var can be a percpu variable or a field of it and its size should
+ * equal char, int or long.  percpu_read() evaluates to a lvalue and
+ * all others to void.
+ *
+ * These operations are guaranteed to be atomic w.r.t. preemption.
+ * The generic versions use plain get/put_cpu_var().  Archs are
+ * encouraged to implement single-instruction alternatives which don't
+ * require preemption protection.
+ */
+#ifndef percpu_read
+# define percpu_read(var)                                               \
+  ({                                                                    \
+        typeof(per_cpu_var(var)) __tmp_var__;                           \
+        __tmp_var__ = get_cpu_var(var);                                 \
+        put_cpu_var(var);                                               \
+        __tmp_var__;                                                    \
+  })
+#endif
+
+#define __percpu_generic_to_op(var, val, op)                            \
+do {                                                                    \
+        get_cpu_var(var) op val;                                        \
+        put_cpu_var(var);                                               \
+} while (0)
+
+#ifndef percpu_write
+# define percpu_write(var, val)         __percpu_generic_to_op(var, (val), =)
+#endif
+
+#ifndef percpu_add
+# define percpu_add(var, val)           __percpu_generic_to_op(var, (val), +=)
+#endif
+
+#ifndef percpu_sub
+# define percpu_sub(var, val)           __percpu_generic_to_op(var, (val), -=)
+#endif
+
+#ifndef percpu_and
+# define percpu_and(var, val)           __percpu_generic_to_op(var, (val), &=)
+#endif
+
+#ifndef percpu_or
+# define percpu_or(var, val)            __percpu_generic_to_op(var, (val), |=)
+#endif
+
+#ifndef percpu_xor
+# define percpu_xor(var, val)           __percpu_generic_to_op(var, (val), ^=)
+#endif
+
 #endif /* _ASM_GENERIC_PERCPU_H_ */
diff --git a/include/asm-generic/sections.h b/include/asm-generic/sections.h
index 79a7ff925bf..4ce48e87853 100644
--- a/include/asm-generic/sections.h
+++ b/include/asm-generic/sections.h
@@ -9,7 +9,7 @@ extern char __bss_start[], __bss_stop[];
 extern char __init_begin[], __init_end[];
 extern char _sinittext[], _einittext[];
 extern char _end[];
-extern char __per_cpu_start[], __per_cpu_end[];
+extern char __per_cpu_load[], __per_cpu_start[], __per_cpu_end[];
 extern char __kprobes_text_start[], __kprobes_text_end[];
 extern char __initdata_begin[], __initdata_end[];
 extern char __start_rodata[], __end_rodata[];
diff --git a/include/asm-generic/vmlinux.lds.h b/include/asm-generic/vmlinux.lds.h
index c61fab1dd2f..5406e70aba8 100644
--- a/include/asm-generic/vmlinux.lds.h
+++ b/include/asm-generic/vmlinux.lds.h
@@ -430,12 +430,59 @@
         *(.initcall7.init)                                              \
         *(.initcall7s.init)
 
+/**
+ * PERCPU_VADDR - define output section for percpu area
+ * @vaddr: explicit base address (optional)
+ * @phdr: destination PHDR (optional)
+ *
+ * Macro which expands to output section for percpu area.  If @vaddr
+ * is not blank, it specifies explicit base address and all percpu
+ * symbols will be offset from the given address.  If blank, @vaddr
+ * always equals @laddr + LOAD_OFFSET.
+ *
+ * @phdr defines the output PHDR to use if not blank.  Be warned that
+ * output PHDR is sticky.  If @phdr is specified, the next output
+ * section in the linker script will go there too.  @phdr should have
+ * a leading colon.
+ *
+ * Note that this macros defines __per_cpu_load as an absolute symbol.
+ * If there is no need to put the percpu section at a predetermined
+ * address, use PERCPU().
+ */
+#define PERCPU_VADDR(vaddr, phdr)                                       \
+        VMLINUX_SYMBOL(__per_cpu_load) = .;                             \
+        .data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)          \
+                                - LOAD_OFFSET) {                        \
+                VMLINUX_SYMBOL(__per_cpu_start) = .;                    \
+                *(.data.percpu.first)                                   \
+                *(.data.percpu.page_aligned)                            \
+                *(.data.percpu)                                         \
+                *(.data.percpu.shared_aligned)                          \
+                VMLINUX_SYMBOL(__per_cpu_end) = .;                      \
+        } phdr                                                          \
+        . = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
+
+/**
+ * PERCPU - define output section for percpu area, simple version
+ * @align: required alignment
+ *
+ * Align to @align and outputs output section for percpu area.  This
+ * macro doesn't maniuplate @vaddr or @phdr and __per_cpu_load and
+ * __per_cpu_start will be identical.
+ *
+ * This macro is equivalent to ALIGN(align); PERCPU_VADDR( , ) except
+ * that __per_cpu_load is defined as a relative symbol against
+ * .data.percpu which is required for relocatable x86_32
+ * configuration.
+ */
 #define PERCPU(align)                                                   \
         . = ALIGN(align);                                               \
-        VMLINUX_SYMBOL(__per_cpu_start) = .;                            \
-        .data.percpu  : AT(ADDR(.data.percpu) - LOAD_OFFSET) {          \
+        .data.percpu    : AT(ADDR(.data.percpu) - LOAD_OFFSET) {        \
+                VMLINUX_SYMBOL(__per_cpu_load) = .;                     \
+                VMLINUX_SYMBOL(__per_cpu_start) = .;                    \
+                *(.data.percpu.first)                                   \
                 *(.data.percpu.page_aligned)                            \
                 *(.data.percpu)                                         \
                 *(.data.percpu.shared_aligned)                          \
-        }                                                               \
-        VMLINUX_SYMBOL(__per_cpu_end) = .;
+                VMLINUX_SYMBOL(__per_cpu_end) = .;                      \
+        }
diff --git a/include/crypto/hash.h b/include/crypto/hash.h
index cd16d6e668c..d797e119e3d 100644
--- a/include/crypto/hash.h
+++ b/include/crypto/hash.h
@@ -222,7 +222,7 @@ static inline struct crypto_tfm *crypto_shash_tfm(struct crypto_shash *tfm)
 
 static inline void crypto_free_shash(struct crypto_shash *tfm)
 {
-        crypto_free_tfm(crypto_shash_tfm(tfm));
+        crypto_destroy_tfm(tfm, crypto_shash_tfm(tfm));
 }
 
 static inline unsigned int crypto_shash_alignmask(
diff --git a/include/drm/i915_drm.h b/include/drm/i915_drm.h
index b3bcf72dc65..912cd52db96 100644
--- a/include/drm/i915_drm.h
+++ b/include/drm/i915_drm.h
@@ -261,6 +261,7 @@ typedef struct drm_i915_irq_wait {
 #define I915_PARAM_LAST_DISPATCH         3
 #define I915_PARAM_CHIPSET_ID            4
 #define I915_PARAM_HAS_GEM               5
+#define I915_PARAM_NUM_FENCES_AVAIL      6
 
 typedef struct drm_i915_getparam {
         int param;
@@ -272,6 +273,7 @@ typedef struct drm_i915_getparam {
 #define I915_SETPARAM_USE_MI_BATCHBUFFER_START            1
 #define I915_SETPARAM_TEX_LRU_LOG_GRANULARITY             2
 #define I915_SETPARAM_ALLOW_BATCHBUFFER                   3
+#define I915_SETPARAM_NUM_USED_FENCES                     4
 
 typedef struct drm_i915_setparam {
         int param;
diff --git a/include/linux/Kbuild b/include/linux/Kbuild
index 12e9a2957ca..b97cdc516a8 100644
--- a/include/linux/Kbuild
+++ b/include/linux/Kbuild
@@ -41,6 +41,7 @@ header-y += baycom.h
 header-y += bfs_fs.h
 header-y += blkpg.h
 header-y += bpqether.h
+header-y += bsg.h
 header-y += can.h
 header-y += cdk.h
 header-y += chio.h
@@ -89,7 +90,6 @@ header-y += if_ppp.h
 header-y += if_slip.h
 header-y += if_strip.h
 header-y += if_tun.h
-header-y += if_tunnel.h
 header-y += in_route.h
 header-y += ioctl.h
 header-y += ip6_tunnel.h
@@ -235,6 +235,7 @@ unifdef-y += if_phonet.h
 unifdef-y += if_pppol2tp.h
 unifdef-y += if_pppox.h
 unifdef-y += if_tr.h
+unifdef-y += if_tunnel.h
 unifdef-y += if_vlan.h
 unifdef-y += igmp.h
 unifdef-y += inet_diag.h
diff --git a/include/linux/acpi.h b/include/linux/acpi.h
index 6fce2fc2d12..d59f0fa4d77 100644
--- a/include/linux/acpi.h
+++ b/include/linux/acpi.h
@@ -79,6 +79,7 @@ typedef int (*acpi_table_handler) (struct acpi_table_header *table);
 typedef int (*acpi_table_entry_handler) (struct acpi_subtable_header *header, const unsigned long end);
 
 char * __acpi_map_table (unsigned long phys_addr, unsigned long size);
+void __init __acpi_unmap_table(char *map, unsigned long size);
 int early_acpi_boot_init(void);
 int acpi_boot_init (void);
 int acpi_boot_table_init (void);
diff --git a/include/linux/async.h b/include/linux/async.h
index c4ecacd0b32..68a9530196f 100644
--- a/include/linux/async.h
+++ b/include/linux/async.h
@@ -17,9 +17,11 @@ typedef u64 async_cookie_t;
 typedef void (async_func_ptr) (void *data, async_cookie_t cookie);
 
 extern async_cookie_t async_schedule(async_func_ptr *ptr, void *data);
-extern async_cookie_t async_schedule_special(async_func_ptr *ptr, void *data, struct list_head *list);
+extern async_cookie_t async_schedule_domain(async_func_ptr *ptr, void *data,
+                                            struct list_head *list);
 extern void async_synchronize_full(void);
-extern void async_synchronize_full_special(struct list_head *list);
+extern void async_synchronize_full_domain(struct list_head *list);
 extern void async_synchronize_cookie(async_cookie_t cookie);
-extern void async_synchronize_cookie_special(async_cookie_t cookie, struct list_head *list);
+extern void async_synchronize_cookie_domain(async_cookie_t cookie,
+                                            struct list_head *list);
 
diff --git a/include/linux/ata.h b/include/linux/ata.h
index a53318b8cbd..08a86d5cdf1 100644
--- a/include/linux/ata.h
+++ b/include/linux/ata.h
@@ -731,12 +731,17 @@ static inline int ata_id_current_chs_valid(const u16 *id)
 
 static inline int ata_id_is_cfa(const u16 *id)
 {
-        if (id[ATA_ID_CONFIG] == 0x848A)        /* Standard CF */
+        if (id[ATA_ID_CONFIG] == 0x848A)        /* Traditional CF */
                 return 1;
-        /* Could be CF hiding as standard ATA */
-        if (ata_id_major_version(id) >= 3 &&
-            id[ATA_ID_COMMAND_SET_1] != 0xFFFF &&
-           (id[ATA_ID_COMMAND_SET_1] & (1 << 2)))
+        /*
+         * CF specs don't require specific value in the word 0 anymore and yet
+         * they forbid to report the ATA version in the word 80 and require the
+         * CFA feature set support to be indicated in the word 83 in this case.
+         * Unfortunately, some cards only follow either of this requirements,
+         * and while those that don't indicate CFA feature support need some
+         * sort of quirk list, it seems impractical for the ones that do...
+         */
+        if ((id[ATA_ID_COMMAND_SET_2] & 0xC004) == 0x4004)
                 return 1;
         return 0;
 }
diff --git a/include/linux/bio.h b/include/linux/bio.h
index 18462c5b8ff..2aa283ab062 100644
--- a/include/linux/bio.h
+++ b/include/linux/bio.h
@@ -144,7 +144,7 @@ struct bio {
  * bit 1 -- rw-ahead when set
  * bit 2 -- barrier
  *      Insert a serialization point in the IO queue, forcing previously
- *      submitted IO to be completed before this oen is issued.
+ *      submitted IO to be completed before this one is issued.
  * bit 3 -- synchronous I/O hint: the block layer will unplug immediately
  *      Note that this does NOT indicate that the IO itself is sync, just
  *      that the block layer will not postpone issue of this IO by plugging.
@@ -163,12 +163,33 @@ struct bio {
 #define BIO_RW          0       /* Must match RW in req flags (blkdev.h) */
 #define BIO_RW_AHEAD    1       /* Must match FAILFAST in req flags */
 #define BIO_RW_BARRIER  2
-#define BIO_RW_SYNC     3
-#define BIO_RW_META     4
-#define BIO_RW_DISCARD  5
-#define BIO_RW_FAILFAST_DEV             6
-#define BIO_RW_FAILFAST_TRANSPORT       7
-#define BIO_RW_FAILFAST_DRIVER          8
+#define BIO_RW_SYNCIO   3
+#define BIO_RW_UNPLUG   4
+#define BIO_RW_META     5
+#define BIO_RW_DISCARD  6
+#define BIO_RW_FAILFAST_DEV             7
+#define BIO_RW_FAILFAST_TRANSPORT       8
+#define BIO_RW_FAILFAST_DRIVER          9
+
+#define BIO_RW_SYNC     (BIO_RW_SYNCIO | BIO_RW_UNPLUG)
+
+#define bio_rw_flagged(bio, flag)       ((bio)->bi_rw & (1 << (flag)))
+
+/*
+ * Old defines, these should eventually be replaced by direct usage of
+ * bio_rw_flagged()
+ */
+#define bio_barrier(bio)        bio_rw_flagged(bio, BIO_RW_BARRIER)
+#define bio_sync(bio)           bio_rw_flagged(bio, BIO_RW_SYNCIO)
+#define bio_unplug(bio)         bio_rw_flagged(bio, BIO_RW_UNPLUG)
+#define bio_failfast_dev(bio)   bio_rw_flagged(bio, BIO_RW_FAILFAST_DEV)
+#define bio_failfast_transport(bio)     \
+                bio_rw_flagged(bio, BIO_RW_FAILFAST_TRANSPORT)
+#define bio_failfast_driver(bio)        \
+                bio_rw_flagged(bio, BIO_RW_FAILFAST_DRIVER)
+#define bio_rw_ahead(bio)       bio_rw_flagged(bio, BIO_RW_AHEAD)
+#define bio_rw_meta(bio)        bio_rw_flagged(bio, BIO_RW_META)
+#define bio_discard(bio)        bio_rw_flagged(bio, BIO_RW_DISCARD)
 
 /*
  * upper 16 bits of bi_rw define the io priority of this bio
@@ -193,15 +214,6 @@ struct bio {
 #define bio_offset(bio)         bio_iovec((bio))->bv_offset
 #define bio_segments(bio)       ((bio)->bi_vcnt - (bio)->bi_idx)
 #define bio_sectors(bio)        ((bio)->bi_size >> 9)
-#define bio_barrier(bio)        ((bio)->bi_rw & (1 << BIO_RW_BARRIER))
-#define bio_sync(bio)           ((bio)->bi_rw & (1 << BIO_RW_SYNC))
-#define bio_failfast_dev(bio)   ((bio)->bi_rw & (1 << BIO_RW_FAILFAST_DEV))
-#define bio_failfast_transport(bio)     \
-        ((bio)->bi_rw & (1 << BIO_RW_FAILFAST_TRANSPORT))
-#define bio_failfast_driver(bio) ((bio)->bi_rw & (1 << BIO_RW_FAILFAST_DRIVER))
-#define bio_rw_ahead(bio)       ((bio)->bi_rw & (1 << BIO_RW_AHEAD))
-#define bio_rw_meta(bio)        ((bio)->bi_rw & (1 << BIO_RW_META))
-#define bio_discard(bio)        ((bio)->bi_rw & (1 << BIO_RW_DISCARD))
 #define bio_empty_barrier(bio)  (bio_barrier(bio) && !bio_has_data(bio) && !bio_discard(bio))
 
 static inline unsigned int bio_cur_sectors(struct bio *bio)
@@ -312,7 +324,6 @@ struct bio_integrity_payload {
         void                    *bip_buf;       /* generated integrity data */
         bio_end_io_t            *bip_end_io;    /* saved I/O completion fn */
 
-        int                     bip_error;      /* saved I/O error */
         unsigned int            bip_size;
 
         unsigned short          bip_pool;       /* pool the ivec came from */
@@ -440,12 +451,13 @@ extern struct biovec_slab bvec_slabs[BIOVEC_NR_POOLS] __read_mostly;
 
 #ifdef CONFIG_HIGHMEM
 /*
- * remember to add offset! and never ever reenable interrupts between a
- * bvec_kmap_irq and bvec_kunmap_irq!!
+ * remember never ever reenable interrupts between a bvec_kmap_irq and
+ * bvec_kunmap_irq!
  *
  * This function MUST be inlined - it plays with the CPU interrupt flags.
  */
-static inline char *bvec_kmap_irq(struct bio_vec *bvec, unsigned long *flags)
+static __always_inline char *bvec_kmap_irq(struct bio_vec *bvec,
+                unsigned long *flags)
 {
         unsigned long addr;
 
@@ -461,7 +473,8 @@ static inline char *bvec_kmap_irq(struct bio_vec *bvec, unsigned long *flags)
         return (char *) addr + bvec->bv_offset;
 }
 
-static inline void bvec_kunmap_irq(char *buffer, unsigned long *flags)
+static __always_inline void bvec_kunmap_irq(char *buffer,
+                unsigned long *flags)
 {
         unsigned long ptr = (unsigned long) buffer & PAGE_MASK;
 
diff --git a/include/linux/blkdev.h b/include/linux/blkdev.h
index 044467ef7b1..dcaa0fd84b0 100644
--- a/include/linux/blkdev.h
+++ b/include/linux/blkdev.h
@@ -108,6 +108,7 @@ enum rq_flag_bits {
         __REQ_RW_META,          /* metadata io request */
         __REQ_COPY_USER,        /* contains copies of user pages */
         __REQ_INTEGRITY,        /* integrity metadata has been remapped */
+        __REQ_UNPLUG,           /* unplug queue on submission */
         __REQ_NR_BITS,          /* stops here */
 };
 
@@ -134,6 +135,7 @@ enum rq_flag_bits {
 #define REQ_RW_META     (1 << __REQ_RW_META)
 #define REQ_COPY_USER   (1 << __REQ_COPY_USER)
 #define REQ_INTEGRITY   (1 << __REQ_INTEGRITY)
+#define REQ_UNPLUG      (1 << __REQ_UNPLUG)
 
 #define BLK_MAX_CDB     16
 
@@ -449,6 +451,11 @@ struct request_queue
 #define QUEUE_FLAG_STACKABLE   13       /* supports request stacking */
 #define QUEUE_FLAG_NONROT      14       /* non-rotational device (SSD) */
 #define QUEUE_FLAG_VIRT        QUEUE_FLAG_NONROT /* paravirt device */
+#define QUEUE_FLAG_IO_STAT     15       /* do IO stats */
+
+#define QUEUE_FLAG_DEFAULT      ((1 << QUEUE_FLAG_IO_STAT) |            \
+                                 (1 << QUEUE_FLAG_CLUSTER) |            \
+                                 (1 << QUEUE_FLAG_STACKABLE))
 
 static inline int queue_is_locked(struct request_queue *q)
 {
@@ -565,6 +572,7 @@ enum {
 #define blk_queue_stopped(q)    test_bit(QUEUE_FLAG_STOPPED, &(q)->queue_flags)
 #define blk_queue_nomerges(q)   test_bit(QUEUE_FLAG_NOMERGES, &(q)->queue_flags)
 #define blk_queue_nonrot(q)     test_bit(QUEUE_FLAG_NONROT, &(q)->queue_flags)
+#define blk_queue_io_stat(q)    test_bit(QUEUE_FLAG_IO_STAT, &(q)->queue_flags)
 #define blk_queue_flushing(q)   ((q)->ordseq)
 #define blk_queue_stackable(q)  \
         test_bit(QUEUE_FLAG_STACKABLE, &(q)->queue_flags)
diff --git a/include/linux/cgroup.h b/include/linux/cgroup.h
index e4e8e117d27..499900d0cee 100644
--- a/include/linux/cgroup.h
+++ b/include/linux/cgroup.h
@@ -378,6 +378,7 @@ struct cgroup_subsys {
          * - initiating hotplug events
          */
         struct mutex hierarchy_mutex;
+        struct lock_class_key subsys_key;
 
         /*
          * Link to parent, and list entry in parent's children.
diff --git a/include/linux/clockchips.h b/include/linux/clockchips.h
index cea153697ec..3a1dbba4d3a 100644
--- a/include/linux/clockchips.h
+++ b/include/linux/clockchips.h
@@ -36,6 +36,7 @@ enum clock_event_nofitiers {
         CLOCK_EVT_NOTIFY_BROADCAST_EXIT,
         CLOCK_EVT_NOTIFY_SUSPEND,
         CLOCK_EVT_NOTIFY_RESUME,
+        CLOCK_EVT_NOTIFY_CPU_DYING,
         CLOCK_EVT_NOTIFY_CPU_DEAD,
 };
 
diff --git a/include/linux/crypto.h b/include/linux/crypto.h
index 3bacd71509f..1f2e9020acc 100644
--- a/include/linux/crypto.h
+++ b/include/linux/crypto.h
@@ -552,7 +552,12 @@ struct crypto_tfm *crypto_alloc_tfm(const char *alg_name,
                                     const struct crypto_type *frontend,
                                     u32 type, u32 mask);
 struct crypto_tfm *crypto_alloc_base(const char *alg_name, u32 type, u32 mask);
-void crypto_free_tfm(struct crypto_tfm *tfm);
+void crypto_destroy_tfm(void *mem, struct crypto_tfm *tfm);
+
+static inline void crypto_free_tfm(struct crypto_tfm *tfm)
+{
+        return crypto_destroy_tfm(tfm, tfm);
+}
 
 int alg_test(const char *driver, const char *alg, u32 type, u32 mask);
 
diff --git a/include/linux/dmaengine.h b/include/linux/dmaengine.h
index 3e0f64c335c..3e68469c188 100644
--- a/include/linux/dmaengine.h
+++ b/include/linux/dmaengine.h
@@ -282,6 +282,18 @@ static inline void dmaengine_put(void)
 }
 #endif
 
+#ifdef CONFIG_NET_DMA
+#define net_dmaengine_get()     dmaengine_get()
+#define net_dmaengine_put()     dmaengine_put()
+#else
+static inline void net_dmaengine_get(void)
+{
+}
+static inline void net_dmaengine_put(void)
+{
+}
+#endif
+
 dma_cookie_t dma_async_memcpy_buf_to_buf(struct dma_chan *chan,
         void *dest, void *src, size_t len);
 dma_cookie_t dma_async_memcpy_buf_to_pg(struct dma_chan *chan,
diff --git a/include/linux/elfcore.h b/include/linux/elfcore.h
index 5ca54d77079..7605c5e9589 100644
--- a/include/linux/elfcore.h
+++ b/include/linux/elfcore.h
@@ -111,6 +111,15 @@ static inline void elf_core_copy_regs(elf_gregset_t *elfregs, struct pt_regs *re
 #endif
 }
 
+static inline void elf_core_copy_kernel_regs(elf_gregset_t *elfregs, struct pt_regs *regs)
+{
+#ifdef ELF_CORE_COPY_KERNEL_REGS
+        ELF_CORE_COPY_KERNEL_REGS((*elfregs), regs);
+#else
+        elf_core_copy_regs(elfregs, regs);
+#endif
+}
+
 static inline int elf_core_copy_task_regs(struct task_struct *t, elf_gregset_t* elfregs)
 {
 #ifdef ELF_CORE_COPY_TASK_REGS
diff --git a/include/linux/fb.h b/include/linux/fb.h
index 818fe21257e..31527e17076 100644
--- a/include/linux/fb.h
+++ b/include/linux/fb.h
@@ -960,6 +960,21 @@ extern struct fb_info *registered_fb[FB_MAX];
 extern int num_registered_fb;
 extern struct class *fb_class;
 
+static inline int lock_fb_info(struct fb_info *info)
+{
+        mutex_lock(&info->lock);
+        if (!info->fbops) {
+                mutex_unlock(&info->lock);
+                return 0;
+        }
+        return 1;
+}
+
+static inline void unlock_fb_info(struct fb_info *info)
+{
+        mutex_unlock(&info->lock);
+}
+
 static inline void __fb_pad_aligned_buffer(u8 *dst, u32 d_pitch,
                                            u8 *src, u32 s_pitch, u32 height)
 {
diff --git a/include/linux/hugetlb.h b/include/linux/hugetlb.h
index f1d2fba19ea..03be7f29ca0 100644
--- a/include/linux/hugetlb.h
+++ b/include/linux/hugetlb.h
@@ -33,7 +33,8 @@ unsigned long hugetlb_total_pages(void);
 int hugetlb_fault(struct mm_struct *mm, struct vm_area_struct *vma,
                         unsigned long address, int write_access);
 int hugetlb_reserve_pages(struct inode *inode, long from, long to,
-                                                struct vm_area_struct *vma);
+                                                struct vm_area_struct *vma,
+                                                int acctflags);
 void hugetlb_unreserve_pages(struct inode *inode, long offset, long freed);
 
 extern unsigned long hugepages_treat_as_movable;
@@ -138,7 +139,7 @@ static inline struct hugetlbfs_sb_info *HUGETLBFS_SB(struct super_block *sb)
 
 extern const struct file_operations hugetlbfs_file_operations;
 extern struct vm_operations_struct hugetlb_vm_ops;
-struct file *hugetlb_file_setup(const char *name, size_t);
+struct file *hugetlb_file_setup(const char *name, size_t, int);
 int hugetlb_get_quota(struct address_space *mapping, long delta);
 void hugetlb_put_quota(struct address_space *mapping, long delta);
 
@@ -158,9 +159,9 @@ static inline void set_file_hugepages(struct file *file)
 }
 #else /* !CONFIG_HUGETLBFS */
 
-#define is_file_hugepages(file)         0
-#define set_file_hugepages(file)        BUG()
-#define hugetlb_file_setup(name,size)   ERR_PTR(-ENOSYS)
+#define is_file_hugepages(file)                 0
+#define set_file_hugepages(file)                BUG()
+#define hugetlb_file_setup(name,size,acctflag)  ERR_PTR(-ENOSYS)
 
 #endif /* !CONFIG_HUGETLBFS */
 
diff --git a/include/linux/if_tunnel.h b/include/linux/if_tunnel.h
index aeab2cb32a9..82c43624c06 100644
--- a/include/linux/if_tunnel.h
+++ b/include/linux/if_tunnel.h
@@ -2,7 +2,10 @@
 #define _IF_TUNNEL_H_
 
 #include <linux/types.h>
+
+#ifdef __KERNEL__
 #include <linux/ip.h>
+#endif
 
 #define SIOCGETTUNNEL   (SIOCDEVPRIVATE + 0)
 #define SIOCADDTUNNEL   (SIOCDEVPRIVATE + 1)
diff --git a/include/linux/init_task.h b/include/linux/init_task.h
index ea0ea1a4c36..e752d973fa2 100644
--- a/include/linux/init_task.h
+++ b/include/linux/init_task.h
@@ -48,12 +48,11 @@ extern struct fs_struct init_fs;
         .posix_timers    = LIST_HEAD_INIT(sig.posix_timers),            \
         .cpu_timers     = INIT_CPU_TIMERS(sig.cpu_timers),              \
         .rlim           = INIT_RLIMITS,                                 \
-        .cputime        = { .totals = {                                 \
-                .utime = cputime_zero,                                  \
-                .stime = cputime_zero,                                  \
-                .sum_exec_runtime = 0,                                  \
-                .lock = __SPIN_LOCK_UNLOCKED(sig.cputime.totals.lock),  \
-        }, },                                                           \
+        .cputimer       = {                                             \
+                .cputime = INIT_CPUTIME,                                \
+                .running = 0,                                           \
+                .lock = __SPIN_LOCK_UNLOCKED(sig.cputimer.lock),        \
+        },                                                              \
 }
 
 extern struct nsproxy init_nsproxy;
diff --git a/include/linux/interrupt.h b/include/linux/interrupt.h
index 9127f6b51a3..472f11765f6 100644
--- a/include/linux/interrupt.h
+++ b/include/linux/interrupt.h
@@ -467,6 +467,7 @@ int show_interrupts(struct seq_file *p, void *v);
 struct irq_desc;
 
 extern int early_irq_init(void);
+extern int arch_probe_nr_irqs(void);
 extern int arch_early_irq_init(void);
 extern int arch_init_chip_data(struct irq_desc *desc, int cpu);
 
diff --git a/include/linux/irq.h b/include/linux/irq.h
index f899b502f18..27a67536511 100644
--- a/include/linux/irq.h
+++ b/include/linux/irq.h
@@ -182,11 +182,11 @@ struct irq_desc {
         unsigned int            irqs_unhandled;
         spinlock_t              lock;
 #ifdef CONFIG_SMP
-        cpumask_t               affinity;
+        cpumask_var_t           affinity;
         unsigned int            cpu;
-#endif
 #ifdef CONFIG_GENERIC_PENDING_IRQ
-        cpumask_t               pending_mask;
+        cpumask_var_t           pending_mask;
+#endif
 #endif
 #ifdef CONFIG_PROC_FS
         struct proc_dir_entry   *dir;
@@ -422,4 +422,84 @@ extern int set_irq_msi(unsigned int irq, struct msi_desc *entry);
 
 #endif /* !CONFIG_S390 */
 
+#ifdef CONFIG_SMP
+/**
+ * init_alloc_desc_masks - allocate cpumasks for irq_desc
+ * @desc:       pointer to irq_desc struct
+ * @cpu:        cpu which will be handling the cpumasks
+ * @boot:       true if need bootmem
+ *
+ * Allocates affinity and pending_mask cpumask if required.
+ * Returns true if successful (or not required).
+ * Side effect: affinity has all bits set, pending_mask has all bits clear.
+ */
+static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,
+                                                                bool boot)
+{
+        int node;
+
+        if (boot) {
+                alloc_bootmem_cpumask_var(&desc->affinity);
+                cpumask_setall(desc->affinity);
+
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+                alloc_bootmem_cpumask_var(&desc->pending_mask);
+                cpumask_clear(desc->pending_mask);
+#endif
+                return true;
+        }
+
+        node = cpu_to_node(cpu);
+
+        if (!alloc_cpumask_var_node(&desc->affinity, GFP_ATOMIC, node))
+                return false;
+        cpumask_setall(desc->affinity);
+
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        if (!alloc_cpumask_var_node(&desc->pending_mask, GFP_ATOMIC, node)) {
+                free_cpumask_var(desc->affinity);
+                return false;
+        }
+        cpumask_clear(desc->pending_mask);
+#endif
+        return true;
+}
+
+/**
+ * init_copy_desc_masks - copy cpumasks for irq_desc
+ * @old_desc:   pointer to old irq_desc struct
+ * @new_desc:   pointer to new irq_desc struct
+ *
+ * Insures affinity and pending_masks are copied to new irq_desc.
+ * If !CONFIG_CPUMASKS_OFFSTACK the cpumasks are embedded in the
+ * irq_desc struct so the copy is redundant.
+ */
+
+static inline void init_copy_desc_masks(struct irq_desc *old_desc,
+                                        struct irq_desc *new_desc)
+{
+#ifdef CONFIG_CPUMASKS_OFFSTACK
+        cpumask_copy(new_desc->affinity, old_desc->affinity);
+
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        cpumask_copy(new_desc->pending_mask, old_desc->pending_mask);
+#endif
+#endif
+}
+
+#else /* !CONFIG_SMP */
+
+static inline bool init_alloc_desc_masks(struct irq_desc *desc, int cpu,
+                                                                bool boot)
+{
+        return true;
+}
+
+static inline void init_copy_desc_masks(struct irq_desc *old_desc,
+                                        struct irq_desc *new_desc)
+{
+}
+
+#endif  /* CONFIG_SMP */
+
 #endif /* _LINUX_IRQ_H */
diff --git a/include/linux/irqnr.h b/include/linux/irqnr.h
index 86af92e9e84..887477bc2ab 100644
--- a/include/linux/irqnr.h
+++ b/include/linux/irqnr.h
@@ -20,6 +20,7 @@
 
 # define for_each_irq_desc_reverse(irq, desc)                          \
         for (irq = nr_irqs - 1; irq >= 0; irq--)
+
 #else /* CONFIG_GENERIC_HARDIRQS */
 
 extern int nr_irqs;
diff --git a/include/linux/jbd2.h b/include/linux/jbd2.h
index b45109c61fb..b28b37eb11c 100644
--- a/include/linux/jbd2.h
+++ b/include/linux/jbd2.h
@@ -308,7 +308,8 @@ void buffer_assertion_failure(struct buffer_head *bh);
                 int val = (expr);                                            \
                 if (!val) {                                                  \
                         printk(KERN_ERR                                      \
-                                "EXT3-fs unexpected failure: %s;\n",# expr); \
+                               "JBD2 unexpected failure: %s: %s;\n",         \
+                               __func__, #expr);                             \
                         printk(KERN_ERR why "\n");                           \
                 }                                                            \
                 val;                                                         \
diff --git a/include/linux/kernel.h b/include/linux/kernel.h
index 343df9ef241..7fa371898e3 100644
--- a/include/linux/kernel.h
+++ b/include/linux/kernel.h
@@ -480,7 +480,8 @@ static inline char *pack_hex_byte(char *buf, u8 byte)
 /*
  * swap - swap value of @a and @b
  */
-#define swap(a, b) ({ typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; })
+#define swap(a, b) \
+        do { typeof(a) __tmp = (a); (a) = (b); (b) = __tmp; } while (0)
 
 /**
  * container_of - cast a member of a structure out to the containing structure
diff --git a/include/linux/libata.h b/include/linux/libata.h
index bca3ba25f52..5d87bc09a1f 100644
--- a/include/linux/libata.h
+++ b/include/linux/libata.h
@@ -380,6 +380,7 @@ enum {
         ATA_HORKAGE_ATAPI_MOD16_DMA = (1 << 11), /* use ATAPI DMA for commands
                                                     not multiple of 16 bytes */
         ATA_HORKAGE_FIRMWARE_WARN = (1 << 12),  /* firwmare update warning */
+        ATA_HORKAGE_1_5_GBPS    = (1 << 13),    /* force 1.5 Gbps */
 
          /* DMA mask for user DMA control: User visible values; DO NOT
             renumber */
@@ -580,7 +581,7 @@ struct ata_device {
         acpi_handle             acpi_handle;
         union acpi_object       *gtf_cache;
 #endif
-        /* n_sector is used as CLEAR_OFFSET, read comment above CLEAR_OFFSET */
+        /* n_sector is CLEAR_BEGIN, read comment above CLEAR_BEGIN */
         u64                     n_sectors;      /* size of device, if ATA */
         unsigned int            class;          /* ATA_DEV_xxx */
         unsigned long           unpark_deadline;
@@ -605,20 +606,22 @@ struct ata_device {
         u16                     heads;          /* Number of heads */
         u16                     sectors;        /* Number of sectors per track */
 
-        /* error history */
-        int                     spdn_cnt;
-        struct ata_ering        ering;
-
         union {
                 u16             id[ATA_ID_WORDS]; /* IDENTIFY xxx DEVICE data */
                 u32             gscr[SATA_PMP_GSCR_DWORDS]; /* PMP GSCR block */
         };
+
+        /* error history */
+        int                     spdn_cnt;
+        /* ering is CLEAR_END, read comment above CLEAR_END */
+        struct ata_ering        ering;
 };
 
-/* Offset into struct ata_device.  Fields above it are maintained
- * acress device init.  Fields below are zeroed.
+/* Fields between ATA_DEVICE_CLEAR_BEGIN and ATA_DEVICE_CLEAR_END are
+ * cleared to zero on ata_dev_init().
  */
-#define ATA_DEVICE_CLEAR_OFFSET         offsetof(struct ata_device, n_sectors)
+#define ATA_DEVICE_CLEAR_BEGIN          offsetof(struct ata_device, n_sectors)
+#define ATA_DEVICE_CLEAR_END            offsetof(struct ata_device, ering)
 
 struct ata_eh_info {
         struct ata_device       *dev;           /* offending device */
diff --git a/include/linux/magic.h b/include/linux/magic.h
index 0b4df7eba85..5b4e28bcb78 100644
--- a/include/linux/magic.h
+++ b/include/linux/magic.h
@@ -49,4 +49,5 @@
 #define FUTEXFS_SUPER_MAGIC     0xBAD1DEA
 #define INOTIFYFS_SUPER_MAGIC   0x2BAD1DEA
 
+#define STACK_END_MAGIC         0x57AC6E9D
 #endif /* __LINUX_MAGIC_H__ */
diff --git a/include/linux/mm.h b/include/linux/mm.h
index e8ddc98b840..7dc04ff5ab8 100644
--- a/include/linux/mm.h
+++ b/include/linux/mm.h
@@ -1129,8 +1129,7 @@ extern unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         unsigned long flag, unsigned long pgoff);
 extern unsigned long mmap_region(struct file *file, unsigned long addr,
         unsigned long len, unsigned long flags,
-        unsigned int vm_flags, unsigned long pgoff,
-        int accountable);
+        unsigned int vm_flags, unsigned long pgoff);
 
 static inline unsigned long do_mmap(struct file *file, unsigned long addr,
         unsigned long len, unsigned long prot,
@@ -1305,5 +1304,6 @@ void vmemmap_populate_print_last(void);
 
 extern void *alloc_locked_buffer(size_t size);
 extern void free_locked_buffer(void *buffer, size_t size);
+extern void release_locked_buffer(void *buffer, size_t size);
 #endif /* __KERNEL__ */
 #endif /* _LINUX_MM_H */
diff --git a/include/linux/module.h b/include/linux/module.h
index 4f7ea12463d..145a75528cc 100644
--- a/include/linux/module.h
+++ b/include/linux/module.h
@@ -219,11 +219,6 @@ void *__symbol_get_gpl(const char *symbol);
 
 #endif
 
-struct module_ref
-{
-        local_t count;
-} ____cacheline_aligned;
-
 enum module_state
 {
         MODULE_STATE_LIVE,
@@ -344,8 +339,11 @@ struct module
         /* Destruction function. */
         void (*exit)(void);
 
-        /* Reference counts */
-        struct module_ref ref[NR_CPUS];
+#ifdef CONFIG_SMP
+        char *refptr;
+#else
+        local_t ref;
+#endif
 #endif
 };
 #ifndef MODULE_ARCH_INIT
@@ -395,13 +393,21 @@ void __symbol_put(const char *symbol);
 #define symbol_put(x) __symbol_put(MODULE_SYMBOL_PREFIX #x)
 void symbol_put_addr(void *addr);
 
+static inline local_t *__module_ref_addr(struct module *mod, int cpu)
+{
+#ifdef CONFIG_SMP
+        return (local_t *) (mod->refptr + per_cpu_offset(cpu));
+#else
+        return &mod->ref;
+#endif
+}
+
 /* Sometimes we know we already have a refcount, and it's easier not
    to handle the error case (which only happens with rmmod --wait). */
 static inline void __module_get(struct module *module)
 {
         if (module) {
-                BUG_ON(module_refcount(module) == 0);
-                local_inc(&module->ref[get_cpu()].count);
+                local_inc(__module_ref_addr(module, get_cpu()));
                 put_cpu();
         }
 }
@@ -413,7 +419,7 @@ static inline int try_module_get(struct module *module)
         if (module) {
                 unsigned int cpu = get_cpu();
                 if (likely(module_is_live(module)))
-                        local_inc(&module->ref[cpu].count);
+                        local_inc(__module_ref_addr(module, cpu));
                 else
                         ret = 0;
                 put_cpu();
diff --git a/include/linux/pci.h b/include/linux/pci.h
index 48890cf3f96..7bd624bfdcf 100644
--- a/include/linux/pci.h
+++ b/include/linux/pci.h
@@ -684,7 +684,7 @@ int pci_enable_rom(struct pci_dev *pdev);
 void pci_disable_rom(struct pci_dev *pdev);
 void __iomem __must_check *pci_map_rom(struct pci_dev *pdev, size_t *size);
 void pci_unmap_rom(struct pci_dev *pdev, void __iomem *rom);
-size_t pci_get_rom_size(void __iomem *rom, size_t size);
+size_t pci_get_rom_size(struct pci_dev *pdev, void __iomem *rom, size_t size);
 
 /* Power management related routines */
 int pci_save_state(struct pci_dev *dev);
diff --git a/include/linux/pci_ids.h b/include/linux/pci_ids.h
index febc10ed385..52a9fe08451 100644
--- a/include/linux/pci_ids.h
+++ b/include/linux/pci_ids.h
@@ -2425,6 +2425,7 @@
 #define PCI_DEVICE_ID_INTEL_ICH7_0      0x27b8
 #define PCI_DEVICE_ID_INTEL_ICH7_1      0x27b9
 #define PCI_DEVICE_ID_INTEL_ICH7_30     0x27b0
+#define PCI_DEVICE_ID_INTEL_TGP_LPC     0x27bc
 #define PCI_DEVICE_ID_INTEL_ICH7_31     0x27bd
 #define PCI_DEVICE_ID_INTEL_ICH7_17     0x27da
 #define PCI_DEVICE_ID_INTEL_ICH7_19     0x27dd
diff --git a/include/linux/percpu.h b/include/linux/percpu.h
index 9f2a3751873..3577ffd90d4 100644
--- a/include/linux/percpu.h
+++ b/include/linux/percpu.h
@@ -8,35 +8,46 @@
 
 #include <asm/percpu.h>
 
+#ifndef PER_CPU_BASE_SECTION
+#ifdef CONFIG_SMP
+#define PER_CPU_BASE_SECTION ".data.percpu"
+#else
+#define PER_CPU_BASE_SECTION ".data"
+#endif
+#endif
+
 #ifdef CONFIG_SMP
-#define DEFINE_PER_CPU(type, name)                                      \
-        __attribute__((__section__(".data.percpu")))                    \
-        PER_CPU_ATTRIBUTES __typeof__(type) per_cpu__##name
 
 #ifdef MODULE
-#define SHARED_ALIGNED_SECTION ".data.percpu"
+#define PER_CPU_SHARED_ALIGNED_SECTION ""
 #else
-#define SHARED_ALIGNED_SECTION ".data.percpu.shared_aligned"
+#define PER_CPU_SHARED_ALIGNED_SECTION ".shared_aligned"
 #endif
+#define PER_CPU_FIRST_SECTION ".first"
 
-#define DEFINE_PER_CPU_SHARED_ALIGNED(type, name)                       \
-        __attribute__((__section__(SHARED_ALIGNED_SECTION)))            \
-        PER_CPU_ATTRIBUTES __typeof__(type) per_cpu__##name             \
-        ____cacheline_aligned_in_smp
+#else
 
-#define DEFINE_PER_CPU_PAGE_ALIGNED(type, name)                 \
-        __attribute__((__section__(".data.percpu.page_aligned")))       \
+#define PER_CPU_SHARED_ALIGNED_SECTION ""
+#define PER_CPU_FIRST_SECTION ""
+
+#endif
+
+#define DEFINE_PER_CPU_SECTION(type, name, section)                     \
+        __attribute__((__section__(PER_CPU_BASE_SECTION section)))      \
         PER_CPU_ATTRIBUTES __typeof__(type) per_cpu__##name
-#else
+
 #define DEFINE_PER_CPU(type, name)                                      \
-        PER_CPU_ATTRIBUTES __typeof__(type) per_cpu__##name
+        DEFINE_PER_CPU_SECTION(type, name, "")
 
-#define DEFINE_PER_CPU_SHARED_ALIGNED(type, name)                     \
-        DEFINE_PER_CPU(type, name)
+#define DEFINE_PER_CPU_SHARED_ALIGNED(type, name)                       \
+        DEFINE_PER_CPU_SECTION(type, name, PER_CPU_SHARED_ALIGNED_SECTION) \
+        ____cacheline_aligned_in_smp
 
-#define DEFINE_PER_CPU_PAGE_ALIGNED(type, name)               \
-        DEFINE_PER_CPU(type, name)
-#endif
+#define DEFINE_PER_CPU_PAGE_ALIGNED(type, name)                         \
+        DEFINE_PER_CPU_SECTION(type, name, ".page_aligned")
+
+#define DEFINE_PER_CPU_FIRST(type, name)                                \
+        DEFINE_PER_CPU_SECTION(type, name, PER_CPU_FIRST_SECTION)
 
 #define EXPORT_PER_CPU_SYMBOL(var) EXPORT_SYMBOL(per_cpu__##var)
 #define EXPORT_PER_CPU_SYMBOL_GPL(var) EXPORT_SYMBOL_GPL(per_cpu__##var)
diff --git a/include/linux/sched.h b/include/linux/sched.h
index 5a7c7638873..f0a50b20e8a 100644
--- a/include/linux/sched.h
+++ b/include/linux/sched.h
@@ -453,23 +453,33 @@ struct task_cputime {
         cputime_t utime;
         cputime_t stime;
         unsigned long long sum_exec_runtime;
-        spinlock_t lock;
 };
 /* Alternate field names when used to cache expirations. */
 #define prof_exp        stime
 #define virt_exp        utime
 #define sched_exp       sum_exec_runtime
 
+#define INIT_CPUTIME    \
+        (struct task_cputime) {                                 \
+                .utime = cputime_zero,                          \
+                .stime = cputime_zero,                          \
+                .sum_exec_runtime = 0,                          \
+        }
+
 /**
- * struct thread_group_cputime - thread group interval timer counts
- * @totals:             thread group interval timers; substructure for
- *                      uniprocessor kernel, per-cpu for SMP kernel.
+ * struct thread_group_cputimer - thread group interval timer counts
+ * @cputime:            thread group interval timers.
+ * @running:            non-zero when there are timers running and
+ *                      @cputime receives updates.
+ * @lock:               lock for fields in this struct.
  *
  * This structure contains the version of task_cputime, above, that is
- * used for thread group CPU clock calculations.
+ * used for thread group CPU timer calculations.
  */
-struct thread_group_cputime {
-        struct task_cputime totals;
+struct thread_group_cputimer {
+        struct task_cputime cputime;
+        int running;
+        spinlock_t lock;
 };
 
 /*
@@ -518,10 +528,10 @@ struct signal_struct {
         cputime_t it_prof_incr, it_virt_incr;
 
         /*
-         * Thread group totals for process CPU clocks.
-         * See thread_group_cputime(), et al, for details.
+         * Thread group totals for process CPU timers.
+         * See thread_group_cputimer(), et al, for details.
          */
-        struct thread_group_cputime cputime;
+        struct thread_group_cputimer cputimer;
 
         /* Earliest-expiration cache. */
         struct task_cputime cputime_expires;
@@ -558,7 +568,7 @@ struct signal_struct {
          * Live threads maintain their own counters and add to these
          * in __exit_signal, except for the group leader.
          */
-        cputime_t cutime, cstime;
+        cputime_t utime, stime, cutime, cstime;
         cputime_t gtime;
         cputime_t cgtime;
         unsigned long nvcsw, nivcsw, cnvcsw, cnivcsw;
@@ -567,6 +577,14 @@ struct signal_struct {
         struct task_io_accounting ioac;
 
         /*
+         * Cumulative ns of schedule CPU time fo dead threads in the
+         * group, not including a zombie group leader, (This only differs
+         * from jiffies_to_ns(utime + stime) if sched_clock uses something
+         * other than jiffies.)
+         */
+        unsigned long long sum_sched_runtime;
+
+        /*
          * We don't bother to synchronize most readers of this at all,
          * because there is no reader checking a limit that actually needs
          * to get both rlim_cur and rlim_max atomically, and either one
@@ -1160,10 +1178,9 @@ struct task_struct {
         pid_t pid;
         pid_t tgid;
 
-#ifdef CONFIG_CC_STACKPROTECTOR
         /* Canary value for the -fstack-protector gcc feature */
         unsigned long stack_canary;
-#endif
+
         /* 
          * pointers to (original) parent process, youngest child, younger sibling,
          * older sibling, respectively.  (p->father can be replaced with 
@@ -2069,6 +2086,19 @@ static inline int object_is_on_stack(void *obj)
 
 extern void thread_info_cache_init(void);
 
+#ifdef CONFIG_DEBUG_STACK_USAGE
+static inline unsigned long stack_not_used(struct task_struct *p)
+{
+        unsigned long *n = end_of_stack(p);
+
+        do {    /* Skip over canary */
+                n++;
+        } while (!*n);
+
+        return (unsigned long)n - (unsigned long)end_of_stack(p);
+}
+#endif
+
 /* set thread flags in other task's structures
  * - see asm/thread_info.h for TIF_xxxx flags available
  */
@@ -2182,27 +2212,14 @@ static inline int spin_needbreak(spinlock_t *lock)
 /*
  * Thread group CPU time accounting.
  */
-
-static inline
-void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
-{
-        struct task_cputime *totals = &tsk->signal->cputime.totals;
-        unsigned long flags;
-
-        spin_lock_irqsave(&totals->lock, flags);
-        *times = *totals;
-        spin_unlock_irqrestore(&totals->lock, flags);
-}
+void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times);
+void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times);
 
 static inline void thread_group_cputime_init(struct signal_struct *sig)
 {
-        sig->cputime.totals = (struct task_cputime){
-                .utime = cputime_zero,
-                .stime = cputime_zero,
-                .sum_exec_runtime = 0,
-        };
-
-        spin_lock_init(&sig->cputime.totals.lock);
+        sig->cputimer.cputime = INIT_CPUTIME;
+        spin_lock_init(&sig->cputimer.lock);
+        sig->cputimer.running = 0;
 }
 
 static inline void thread_group_cputime_free(struct signal_struct *sig)
diff --git a/include/linux/slab_def.h b/include/linux/slab_def.h
index 39c3a5eb8eb..6ca6a7b66d7 100644
--- a/include/linux/slab_def.h
+++ b/include/linux/slab_def.h
@@ -43,10 +43,7 @@ static inline void *kmalloc(size_t size, gfp_t flags)
                         i++;
 #include <linux/kmalloc_sizes.h>
 #undef CACHE
-                {
-                        extern void __you_cannot_kmalloc_that_much(void);
-                        __you_cannot_kmalloc_that_much();
-                }
+                return NULL;
 found:
 #ifdef CONFIG_ZONE_DMA
                 if (flags & GFP_DMA)
@@ -77,10 +74,7 @@ static inline void *kmalloc_node(size_t size, gfp_t flags, int node)
                         i++;
 #include <linux/kmalloc_sizes.h>
 #undef CACHE
-                {
-                        extern void __you_cannot_kmalloc_that_much(void);
-                        __you_cannot_kmalloc_that_much();
-                }
+                return NULL;
 found:
 #ifdef CONFIG_ZONE_DMA
                 if (flags & GFP_DMA)
diff --git a/include/linux/smp.h b/include/linux/smp.h
index 715196b09d6..bbacb7baa44 100644
--- a/include/linux/smp.h
+++ b/include/linux/smp.h
@@ -176,6 +176,12 @@ static inline void init_call_single_data(void)
 #define put_cpu()               preempt_enable()
 #define put_cpu_no_resched()    preempt_enable_no_resched()
 
+/*
+ * Callback to arch code if there's nosmp or maxcpus=0 on the
+ * boot command line:
+ */
+extern void arch_disable_smp_support(void);
+
 void smp_setup_processor_id(void);
 
 #endif /* __LINUX_SMP_H */
diff --git a/include/linux/spinlock.h b/include/linux/spinlock.h
index e0c0fccced4..a0c66a2e00a 100644
--- a/include/linux/spinlock.h
+++ b/include/linux/spinlock.h
@@ -124,7 +124,12 @@ do {								\
 #ifdef CONFIG_GENERIC_LOCKBREAK
 #define spin_is_contended(lock) ((lock)->break_lock)
 #else
+
+#ifdef __raw_spin_is_contended
 #define spin_is_contended(lock) __raw_spin_is_contended(&(lock)->raw_lock)
+#else
+#define spin_is_contended(lock) (((void)(lock), 0))
+#endif /*__raw_spin_is_contended*/
 #endif
 
 /**
diff --git a/include/linux/stackprotector.h b/include/linux/stackprotector.h
new file mode 100644
index 00000000000..6f3e54c704c
--- /dev/null
+++ b/include/linux/stackprotector.h
@@ -0,0 +1,16 @@
+#ifndef _LINUX_STACKPROTECTOR_H
+#define _LINUX_STACKPROTECTOR_H 1
+
+#include <linux/compiler.h>
+#include <linux/sched.h>
+#include <linux/random.h>
+
+#ifdef CONFIG_CC_STACKPROTECTOR
+# include <asm/stackprotector.h>
+#else
+static inline void boot_init_stack_canary(void)
+{
+}
+#endif
+
+#endif
diff --git a/include/linux/syscalls.h b/include/linux/syscalls.h
index 0eda02ff241..f9f900cfd06 100644
--- a/include/linux/syscalls.h
+++ b/include/linux/syscalls.h
@@ -95,13 +95,13 @@ struct old_linux_dirent;
 #define __SC_TEST5(t5, a5, ...) __SC_TEST(t5); __SC_TEST4(__VA_ARGS__)
 #define __SC_TEST6(t6, a6, ...) __SC_TEST(t6); __SC_TEST5(__VA_ARGS__)
 
-#define SYSCALL_DEFINE0(name)   asmlinkage long sys_##name(void)
-#define SYSCALL_DEFINE1(...)    SYSCALL_DEFINEx(1, __VA_ARGS__)
-#define SYSCALL_DEFINE2(...)    SYSCALL_DEFINEx(2, __VA_ARGS__)
-#define SYSCALL_DEFINE3(...)    SYSCALL_DEFINEx(3, __VA_ARGS__)
-#define SYSCALL_DEFINE4(...)    SYSCALL_DEFINEx(4, __VA_ARGS__)
-#define SYSCALL_DEFINE5(...)    SYSCALL_DEFINEx(5, __VA_ARGS__)
-#define SYSCALL_DEFINE6(...)    SYSCALL_DEFINEx(6, __VA_ARGS__)
+#define SYSCALL_DEFINE0(name)      asmlinkage long sys_##name(void)
+#define SYSCALL_DEFINE1(name, ...) SYSCALL_DEFINEx(1, _##name, __VA_ARGS__)
+#define SYSCALL_DEFINE2(name, ...) SYSCALL_DEFINEx(2, _##name, __VA_ARGS__)
+#define SYSCALL_DEFINE3(name, ...) SYSCALL_DEFINEx(3, _##name, __VA_ARGS__)
+#define SYSCALL_DEFINE4(name, ...) SYSCALL_DEFINEx(4, _##name, __VA_ARGS__)
+#define SYSCALL_DEFINE5(name, ...) SYSCALL_DEFINEx(5, _##name, __VA_ARGS__)
+#define SYSCALL_DEFINE6(name, ...) SYSCALL_DEFINEx(6, _##name, __VA_ARGS__)
 
 #ifdef CONFIG_PPC64
 #define SYSCALL_ALIAS(alias, name)                                      \
@@ -121,21 +121,21 @@ struct old_linux_dirent;
 
 #define SYSCALL_DEFINE(name) static inline long SYSC_##name
 #define SYSCALL_DEFINEx(x, name, ...)                                   \
-        asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__));          \
-        static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__));      \
-        asmlinkage long SyS_##name(__SC_LONG##x(__VA_ARGS__))           \
+        asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__));           \
+        static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__));       \
+        asmlinkage long SyS##name(__SC_LONG##x(__VA_ARGS__))            \
         {                                                               \
                 __SC_TEST##x(__VA_ARGS__);                              \
-                return (long) SYSC_##name(__SC_CAST##x(__VA_ARGS__));   \
+                return (long) SYSC##name(__SC_CAST##x(__VA_ARGS__));    \
         }                                                               \
-        SYSCALL_ALIAS(sys_##name, SyS_##name);                          \
-        static inline long SYSC_##name(__SC_DECL##x(__VA_ARGS__))
+        SYSCALL_ALIAS(sys##name, SyS##name);                            \
+        static inline long SYSC##name(__SC_DECL##x(__VA_ARGS__))
 
 #else /* CONFIG_HAVE_SYSCALL_WRAPPERS */
 
 #define SYSCALL_DEFINE(name) asmlinkage long sys_##name
 #define SYSCALL_DEFINEx(x, name, ...)                                   \
-        asmlinkage long sys_##name(__SC_DECL##x(__VA_ARGS__))
+        asmlinkage long sys##name(__SC_DECL##x(__VA_ARGS__))
 
 #endif /* CONFIG_HAVE_SYSCALL_WRAPPERS */
 
diff --git a/include/linux/topology.h b/include/linux/topology.h
index e632d29f054..a16b9e06f2e 100644
--- a/include/linux/topology.h
+++ b/include/linux/topology.h
@@ -193,5 +193,11 @@ int arch_update_cpu_topology(void);
 #ifndef topology_core_siblings
 #define topology_core_siblings(cpu)             cpumask_of_cpu(cpu)
 #endif
+#ifndef topology_thread_cpumask
+#define topology_thread_cpumask(cpu)            cpumask_of(cpu)
+#endif
+#ifndef topology_core_cpumask
+#define topology_core_cpumask(cpu)              cpumask_of(cpu)
+#endif
 
 #endif /* _LINUX_TOPOLOGY_H */
diff --git a/include/linux/wait.h b/include/linux/wait.h
index ef609f842fa..a210ede73b5 100644
--- a/include/linux/wait.h
+++ b/include/linux/wait.h
@@ -132,6 +132,8 @@ static inline void __remove_wait_queue(wait_queue_head_t *head,
         list_del(&old->task_list);
 }
 
+void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
+                        int nr_exclusive, int sync, void *key);
 void __wake_up(wait_queue_head_t *q, unsigned int mode, int nr, void *key);
 extern void __wake_up_locked(wait_queue_head_t *q, unsigned int mode);
 extern void __wake_up_sync(wait_queue_head_t *q, unsigned int mode, int nr);
@@ -333,16 +335,19 @@ do {									\
         for (;;) {                                                      \
                 prepare_to_wait_exclusive(&wq, &__wait,                 \
                                         TASK_INTERRUPTIBLE);            \
-                if (condition)                                          \
+                if (condition) {                                        \
+                        finish_wait(&wq, &__wait);                      \
                         break;                                          \
+                }                                                       \
                 if (!signal_pending(current)) {                         \
                         schedule();                                     \
                         continue;                                       \
                 }                                                       \
                 ret = -ERESTARTSYS;                                     \
+                abort_exclusive_wait(&wq, &__wait,                      \
+                                TASK_INTERRUPTIBLE, NULL);              \
                 break;                                                  \
         }                                                               \
-        finish_wait(&wq, &__wait);                                      \
 } while (0)
 
 #define wait_event_interruptible_exclusive(wq, condition)               \
@@ -431,6 +436,8 @@ extern long interruptible_sleep_on_timeout(wait_queue_head_t *q,
 void prepare_to_wait(wait_queue_head_t *q, wait_queue_t *wait, int state);
 void prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state);
 void finish_wait(wait_queue_head_t *q, wait_queue_t *wait);
+void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
+                        unsigned int mode, void *key);
 int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 int wake_bit_function(wait_queue_t *wait, unsigned mode, int sync, void *key);
 
diff --git a/include/media/v4l2-device.h b/include/media/v4l2-device.h
index 9bf4ccc93db..55e41afd95e 100644
--- a/include/media/v4l2-device.h
+++ b/include/media/v4l2-device.h
@@ -94,16 +94,16 @@ void v4l2_device_unregister_subdev(struct v4l2_subdev *sd);
 /* Call the specified callback for all subdevs matching grp_id (if 0, then
    match them all). Ignore any errors. Note that you cannot add or delete
    a subdev while walking the subdevs list. */
-#define v4l2_device_call_all(dev, grp_id, o, f, args...)                \
+#define v4l2_device_call_all(dev, grpid, o, f, args...)                 \
         __v4l2_device_call_subdevs(dev,                                 \
-                        !(grp_id) || sd->grp_id == (grp_id), o, f , ##args)
+                        !(grpid) || sd->grp_id == (grpid), o, f , ##args)
 
 /* Call the specified callback for all subdevs matching grp_id (if 0, then
    match them all). If the callback returns an error other than 0 or
    -ENOIOCTLCMD, then return with that error code. Note that you cannot
    add or delete a subdev while walking the subdevs list. */
-#define v4l2_device_call_until_err(dev, grp_id, o, f, args...)          \
+#define v4l2_device_call_until_err(dev, grpid, o, f, args...)           \
         __v4l2_device_call_subdevs_until_err(dev,                       \
-                       !(grp_id) || sd->grp_id == (grp_id), o, f , ##args)
+                       !(grpid) || sd->grp_id == (grpid), o, f , ##args)
 
 #endif
diff --git a/include/net/inet_hashtables.h b/include/net/inet_hashtables.h
index f44bb5c77a7..d0a043153cc 100644
--- a/include/net/inet_hashtables.h
+++ b/include/net/inet_hashtables.h
@@ -182,7 +182,7 @@ static inline int inet_ehash_locks_alloc(struct inet_hashinfo *hashinfo)
                 size = 2048;
         if (nr_pcpus >= 32)
                 size = 4096;
-        if (sizeof(rwlock_t) != 0) {
+        if (sizeof(spinlock_t) != 0) {
 #ifdef CONFIG_NUMA
                 if (size * sizeof(spinlock_t) > PAGE_SIZE)
                         hashinfo->ehash_locks = vmalloc(size * sizeof(spinlock_t));
diff --git a/include/video/aty128.h b/include/video/aty128.h
index 7079beb005e..51ac69f05bd 100644
--- a/include/video/aty128.h
+++ b/include/video/aty128.h
@@ -21,9 +21,9 @@
 #define I2C_CNTL_1                              0x0094
 #define PALETTE_INDEX                           0x00b0
 #define PALETTE_DATA                            0x00b4
-#define CONFIG_CNTL                             0x00e0
+#define CNFG_CNTL                               0x00e0
 #define GEN_RESET_CNTL                          0x00f0
-#define CONFIG_MEMSIZE                          0x00f8
+#define CNFG_MEMSIZE                            0x00f8
 #define MEM_CNTL                                0x0140
 #define MEM_POWER_MISC                          0x015c
 #define AGP_BASE                                0x0170
diff --git a/include/video/mach64.h b/include/video/mach64.h
index a8332e528ec..89e91c0cb73 100644
--- a/include/video/mach64.h
+++ b/include/video/mach64.h
@@ -103,7 +103,7 @@
 #define CUR_HORZ_VERT_OFF       0x0070  /* Dword offset 0_1C */
 #define CUR2_HORZ_VERT_OFF      0x0070  /* Dword offset 0_1C */
 
-#define CONFIG_PANEL_LG         0x0074  /* Dword offset 0_1D (LG) */
+#define CNFG_PANEL_LG           0x0074  /* Dword offset 0_1D (LG) */
 
 /* General I/O Control */
 #define GP_IO                   0x0078  /* Dword offset 0_1E */
@@ -146,8 +146,8 @@
 #define CLOCK_SEL_CNTL          0x0090  /* Dword offset 0_24 */
 
 /* Configuration */
-#define CONFIG_STAT1            0x0094  /* Dword offset 0_25 */
-#define CONFIG_STAT2            0x0098  /* Dword offset 0_26 */
+#define CNFG_STAT1              0x0094  /* Dword offset 0_25 */
+#define CNFG_STAT2              0x0098  /* Dword offset 0_26 */
 
 /* Bus Control */
 #define BUS_CNTL                0x00A0  /* Dword offset 0_28 */
@@ -190,9 +190,9 @@
 #define POWER_MANAGEMENT_LG     0x00D8  /* Dword offset 0_36 (LG) */
 
 /* Configuration */
-#define CONFIG_CNTL             0x00DC  /* Dword offset 0_37 (CT, ET, VT) */
-#define CONFIG_CHIP_ID          0x00E0  /* Dword offset 0_38 */
-#define CONFIG_STAT0            0x00E4  /* Dword offset 0_39 */
+#define CNFG_CNTL               0x00DC  /* Dword offset 0_37 (CT, ET, VT) */
+#define CNFG_CHIP_ID            0x00E0  /* Dword offset 0_38 */
+#define CNFG_STAT0              0x00E4  /* Dword offset 0_39 */
 
 /* Test and Debug */
 #define CRC_SIG                 0x00E8  /* Dword offset 0_3A */
@@ -851,17 +851,17 @@
 #define PLL_YCLK_CNTL           0x29
 #define PM_DYN_CLK_CNTL         0x2A
 
-/* CONFIG_CNTL register constants */
+/* CNFG_CNTL register constants */
 #define APERTURE_4M_ENABLE      1
 #define APERTURE_8M_ENABLE      2
 #define VGA_APERTURE_ENABLE     4
 
-/* CONFIG_STAT0 register constants (GX, CX) */
+/* CNFG_STAT0 register constants (GX, CX) */
 #define CFG_BUS_TYPE            0x00000007
 #define CFG_MEM_TYPE            0x00000038
 #define CFG_INIT_DAC_TYPE       0x00000e00
 
-/* CONFIG_STAT0 register constants (CT, ET, VT) */
+/* CNFG_STAT0 register constants (CT, ET, VT) */
 #define CFG_MEM_TYPE_xT         0x00000007
 
 #define ISA                     0
@@ -942,7 +942,7 @@
 #define PCI_ATI_VENDOR_ID       0x1002
 
 
-/* CONFIG_CHIP_ID register constants */
+/* CNFG_CHIP_ID register constants */
 #define CFG_CHIP_TYPE           0x0000FFFF
 #define CFG_CHIP_CLASS          0x00FF0000
 #define CFG_CHIP_REV            0xFF000000
@@ -951,7 +951,7 @@
 #define CFG_CHIP_MINOR          0xC0000000
 
 
-/* Chip IDs read from CONFIG_CHIP_ID */
+/* Chip IDs read from CNFG_CHIP_ID */
 
 /* mach64GX family */
 #define GX_CHIP_ID      0xD7    /* mach64GX (ATI888GX00) */
@@ -1254,7 +1254,7 @@
 #define CRTC2_DISPLAY_DIS       0x00000400
 
 /* LCD register indices */
-#define CONFIG_PANEL            0x00
+#define CNFG_PANEL              0x00
 #define LCD_GEN_CNTL            0x01
 #define DSTN_CONTROL            0x02
 #define HFB_PITCH_ADDR          0x03
diff --git a/include/video/radeon.h b/include/video/radeon.h
index 1cd09cc5b16..e072b16b39a 100644
--- a/include/video/radeon.h
+++ b/include/video/radeon.h
@@ -11,13 +11,13 @@
 #define HI_STAT                                0x004C  
 #define BUS_CNTL1                              0x0034
 #define I2C_CNTL_1                             0x0094  
-#define CONFIG_CNTL                            0x00E0  
-#define CONFIG_MEMSIZE                         0x00F8  
-#define CONFIG_APER_0_BASE                     0x0100  
-#define CONFIG_APER_1_BASE                     0x0104  
-#define CONFIG_APER_SIZE                       0x0108  
-#define CONFIG_REG_1_BASE                      0x010C  
-#define CONFIG_REG_APER_SIZE                   0x0110  
+#define CNFG_CNTL                              0x00E0
+#define CNFG_MEMSIZE                           0x00F8
+#define CNFG_APER_0_BASE                       0x0100
+#define CNFG_APER_1_BASE                       0x0104
+#define CNFG_APER_SIZE                         0x0108
+#define CNFG_REG_1_BASE                        0x010C
+#define CNFG_REG_APER_SIZE                     0x0110
 #define PAD_AGPINPUT_DELAY                     0x0164  
 #define PAD_CTLR_STRENGTH                      0x0168  
 #define PAD_CTLR_UPDATE                        0x016C
@@ -509,7 +509,7 @@
 /* CLOCK_CNTL_INDEX bit constants */
 #define PLL_WR_EN                                  0x00000080
 
-/* CONFIG_CNTL bit constants */
+/* CNFG_CNTL bit constants */
 #define CFG_VGA_RAM_EN                             0x00000100
 #define CFG_ATI_REV_ID_MASK                        (0xf << 16)
 #define CFG_ATI_REV_A11                            (0 << 16)
@@ -980,7 +980,7 @@
 
 /* masks */
 
-#define CONFIG_MEMSIZE_MASK             0x1f000000
+#define CNFG_MEMSIZE_MASK               0x1f000000
 #define MEM_CFG_TYPE                    0x40000000
 #define DST_OFFSET_MASK                 0x003fffff
 #define DST_PITCH_MASK                  0x3fc00000
diff --git a/init/main.c b/init/main.c
index 844209453c0..6441083f827 100644
--- a/init/main.c
+++ b/init/main.c
@@ -14,6 +14,7 @@
 #include <linux/proc_fs.h>
 #include <linux/kernel.h>
 #include <linux/syscalls.h>
+#include <linux/stackprotector.h>
 #include <linux/string.h>
 #include <linux/ctype.h>
 #include <linux/delay.h>
@@ -135,14 +136,14 @@ unsigned int __initdata setup_max_cpus = NR_CPUS;
  * greater than 0, limits the maximum number of CPUs activated in
  * SMP mode to <NUM>.
  */
-#ifndef CONFIG_X86_IO_APIC
-static inline void disable_ioapic_setup(void) {};
-#endif
+
+void __weak arch_disable_smp_support(void) { }
 
 static int __init nosmp(char *str)
 {
         setup_max_cpus = 0;
-        disable_ioapic_setup();
+        arch_disable_smp_support();
+
         return 0;
 }
 
@@ -152,14 +153,14 @@ static int __init maxcpus(char *str)
 {
         get_option(&str, &setup_max_cpus);
         if (setup_max_cpus == 0)
-                disable_ioapic_setup();
+                arch_disable_smp_support();
 
         return 0;
 }
 
 early_param("maxcpus", maxcpus);
 #else
-#define setup_max_cpus NR_CPUS
+const unsigned int setup_max_cpus = NR_CPUS;
 #endif
 
 /*
@@ -539,6 +540,12 @@ asmlinkage void __init start_kernel(void)
          */
         lockdep_init();
         debug_objects_early_init();
+
+        /*
+         * Set up the the initial canary ASAP:
+         */
+        boot_init_stack_canary();
+
         cgroup_init_early();
 
         local_irq_disable();
diff --git a/ipc/shm.c b/ipc/shm.c
index a9e09ad2263..05d51d2a792 100644
--- a/ipc/shm.c
+++ b/ipc/shm.c
@@ -340,6 +340,7 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
         struct file * file;
         char name[13];
         int id;
+        int acctflag = 0;
 
         if (size < SHMMIN || size > ns->shm_ctlmax)
                 return -EINVAL;
@@ -364,18 +365,19 @@ static int newseg(struct ipc_namespace *ns, struct ipc_params *params)
 
         sprintf (name, "SYSV%08x", key);
         if (shmflg & SHM_HUGETLB) {
-                /* hugetlb_file_setup takes care of mlock user accounting */
-                file = hugetlb_file_setup(name, size);
+                /* hugetlb_file_setup applies strict accounting */
+                if (shmflg & SHM_NORESERVE)
+                        acctflag = VM_NORESERVE;
+                file = hugetlb_file_setup(name, size, acctflag);
                 shp->mlock_user = current_user();
         } else {
-                int acctflag = VM_ACCOUNT;
                 /*
                  * Do not allow no accounting for OVERCOMMIT_NEVER, even
                  * if it's asked for.
                  */
                 if  ((shmflg & SHM_NORESERVE) &&
                                 sysctl_overcommit_memory != OVERCOMMIT_NEVER)
-                        acctflag = 0;
+                        acctflag = VM_NORESERVE;
                 file = shmem_file_setup(name, size, acctflag);
         }
         error = PTR_ERR(file);
@@ -565,11 +567,15 @@ static void shm_get_stat(struct ipc_namespace *ns, unsigned long *rss,
                         struct hstate *h = hstate_file(shp->shm_file);
                         *rss += pages_per_huge_page(h) * mapping->nrpages;
                 } else {
+#ifdef CONFIG_SHMEM
                         struct shmem_inode_info *info = SHMEM_I(inode);
                         spin_lock(&info->lock);
                         *rss += inode->i_mapping->nrpages;
                         *swp += info->swapped;
                         spin_unlock(&info->lock);
+#else
+                        *rss += inode->i_mapping->nrpages;
+#endif
                 }
 
                 total++;
diff --git a/kernel/async.c b/kernel/async.c
index 608b32b4281..f565891f2c9 100644
--- a/kernel/async.c
+++ b/kernel/async.c
@@ -54,6 +54,7 @@ asynchronous and synchronous parts of the kernel.
 #include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/kthread.h>
+#include <linux/delay.h>
 #include <asm/atomic.h>
 
 static async_cookie_t next_cookie = 1;
@@ -132,21 +133,23 @@ static void run_one_entry(void)
         entry = list_first_entry(&async_pending, struct async_entry, list);
 
         /* 2) move it to the running queue */
-        list_del(&entry->list);
-        list_add_tail(&entry->list, &async_running);
+        list_move_tail(&entry->list, entry->running);
         spin_unlock_irqrestore(&async_lock, flags);
 
         /* 3) run it (and print duration)*/
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
-                printk("calling  %lli_%pF @ %i\n", entry->cookie, entry->func, task_pid_nr(current));
+                printk("calling  %lli_%pF @ %i\n", (long long)entry->cookie,
+                        entry->func, task_pid_nr(current));
                 calltime = ktime_get();
         }
         entry->func(entry->data, entry->cookie);
         if (initcall_debug && system_state == SYSTEM_BOOTING) {
                 rettime = ktime_get();
                 delta = ktime_sub(rettime, calltime);
-                printk("initcall %lli_%pF returned 0 after %lld usecs\n", entry->cookie,
-                        entry->func, ktime_to_ns(delta) >> 10);
+                printk("initcall %lli_%pF returned 0 after %lld usecs\n",
+                        (long long)entry->cookie,
+                        entry->func,
+                        (long long)ktime_to_ns(delta) >> 10);
         }
 
         /* 4) remove it from the running queue */
@@ -205,18 +208,44 @@ static async_cookie_t __async_schedule(async_func_ptr *ptr, void *data, struct l
         return newcookie;
 }
 
+/**
+ * async_schedule - schedule a function for asynchronous execution
+ * @ptr: function to execute asynchronously
+ * @data: data pointer to pass to the function
+ *
+ * Returns an async_cookie_t that may be used for checkpointing later.
+ * Note: This function may be called from atomic or non-atomic contexts.
+ */
 async_cookie_t async_schedule(async_func_ptr *ptr, void *data)
 {
-        return __async_schedule(ptr, data, &async_pending);
+        return __async_schedule(ptr, data, &async_running);
 }
 EXPORT_SYMBOL_GPL(async_schedule);
 
-async_cookie_t async_schedule_special(async_func_ptr *ptr, void *data, struct list_head *running)
+/**
+ * async_schedule_domain - schedule a function for asynchronous execution within a certain domain
+ * @ptr: function to execute asynchronously
+ * @data: data pointer to pass to the function
+ * @running: running list for the domain
+ *
+ * Returns an async_cookie_t that may be used for checkpointing later.
+ * @running may be used in the async_synchronize_*_domain() functions
+ * to wait within a certain synchronization domain rather than globally.
+ * A synchronization domain is specified via the running queue @running to use.
+ * Note: This function may be called from atomic or non-atomic contexts.
+ */
+async_cookie_t async_schedule_domain(async_func_ptr *ptr, void *data,
+                                     struct list_head *running)
 {
         return __async_schedule(ptr, data, running);
 }
-EXPORT_SYMBOL_GPL(async_schedule_special);
+EXPORT_SYMBOL_GPL(async_schedule_domain);
 
+/**
+ * async_synchronize_full - synchronize all asynchronous function calls
+ *
+ * This function waits until all asynchronous function calls have been done.
+ */
 void async_synchronize_full(void)
 {
         do {
@@ -225,13 +254,30 @@ void async_synchronize_full(void)
 }
 EXPORT_SYMBOL_GPL(async_synchronize_full);
 
-void async_synchronize_full_special(struct list_head *list)
+/**
+ * async_synchronize_full_domain - synchronize all asynchronous function within a certain domain
+ * @list: running list to synchronize on
+ *
+ * This function waits until all asynchronous function calls for the
+ * synchronization domain specified by the running list @list have been done.
+ */
+void async_synchronize_full_domain(struct list_head *list)
 {
-        async_synchronize_cookie_special(next_cookie, list);
+        async_synchronize_cookie_domain(next_cookie, list);
 }
-EXPORT_SYMBOL_GPL(async_synchronize_full_special);
+EXPORT_SYMBOL_GPL(async_synchronize_full_domain);
 
-void async_synchronize_cookie_special(async_cookie_t cookie, struct list_head *running)
+/**
+ * async_synchronize_cookie_domain - synchronize asynchronous function calls within a certain domain with cookie checkpointing
+ * @cookie: async_cookie_t to use as checkpoint
+ * @running: running list to synchronize on
+ *
+ * This function waits until all asynchronous function calls for the
+ * synchronization domain specified by the running list @list submitted
+ * prior to @cookie have been done.
+ */
+void async_synchronize_cookie_domain(async_cookie_t cookie,
+                                     struct list_head *running)
 {
         ktime_t starttime, delta, endtime;
 
@@ -247,14 +293,22 @@ void async_synchronize_cookie_special(async_cookie_t cookie, struct list_head *r
                 delta = ktime_sub(endtime, starttime);
 
                 printk("async_continuing @ %i after %lli usec\n",
-                        task_pid_nr(current), ktime_to_ns(delta) >> 10);
+                        task_pid_nr(current),
+                        (long long)ktime_to_ns(delta) >> 10);
         }
 }
-EXPORT_SYMBOL_GPL(async_synchronize_cookie_special);
+EXPORT_SYMBOL_GPL(async_synchronize_cookie_domain);
 
+/**
+ * async_synchronize_cookie - synchronize asynchronous function calls with cookie checkpointing
+ * @cookie: async_cookie_t to use as checkpoint
+ *
+ * This function waits until all asynchronous function calls prior to @cookie
+ * have been done.
+ */
 void async_synchronize_cookie(async_cookie_t cookie)
 {
-        async_synchronize_cookie_special(cookie, &async_running);
+        async_synchronize_cookie_domain(cookie, &async_running);
 }
 EXPORT_SYMBOL_GPL(async_synchronize_cookie);
 
@@ -315,7 +369,11 @@ static int async_manager_thread(void *unused)
                 ec = atomic_read(&entry_count);
 
                 while (tc < ec && tc < MAX_THREADS) {
-                        kthread_run(async_thread, NULL, "async/%i", tc);
+                        if (IS_ERR(kthread_run(async_thread, NULL, "async/%i",
+                                               tc))) {
+                                msleep(100);
+                                continue;
+                        }
                         atomic_inc(&thread_count);
                         tc++;
                 }
@@ -330,7 +388,9 @@ static int async_manager_thread(void *unused)
 static int __init async_init(void)
 {
         if (async_enabled)
-                kthread_run(async_manager_thread, NULL, "async/mgr");
+                if (IS_ERR(kthread_run(async_manager_thread, NULL,
+                                       "async/mgr")))
+                        async_enabled = 0;
         return 0;
 }
 
diff --git a/kernel/cgroup.c b/kernel/cgroup.c
index 5a54ff42874..e14db9c089b 100644
--- a/kernel/cgroup.c
+++ b/kernel/cgroup.c
@@ -2351,7 +2351,7 @@ static void cgroup_lock_hierarchy(struct cgroupfs_root *root)
         for (i = 0; i < CGROUP_SUBSYS_COUNT; i++) {
                 struct cgroup_subsys *ss = subsys[i];
                 if (ss->root == root)
-                        mutex_lock_nested(&ss->hierarchy_mutex, i);
+                        mutex_lock(&ss->hierarchy_mutex);
         }
 }
 
@@ -2637,6 +2637,7 @@ static void __init cgroup_init_subsys(struct cgroup_subsys *ss)
         BUG_ON(!list_empty(&init_task.tasks));
 
         mutex_init(&ss->hierarchy_mutex);
+        lockdep_set_class(&ss->hierarchy_mutex, &ss->subsys_key);
         ss->active = 1;
 }
 
diff --git a/kernel/cpuset.c b/kernel/cpuset.c
index a85678865c5..f76db9dcaa0 100644
--- a/kernel/cpuset.c
+++ b/kernel/cpuset.c
@@ -61,6 +61,14 @@
 #include <linux/cgroup.h>
 
 /*
+ * Workqueue for cpuset related tasks.
+ *
+ * Using kevent workqueue may cause deadlock when memory_migrate
+ * is set. So we create a separate workqueue thread for cpuset.
+ */
+static struct workqueue_struct *cpuset_wq;
+
+/*
  * Tracks how many cpusets are currently defined in system.
  * When there is only one cpuset (the root cpuset) we can
  * short circuit some hooks.
@@ -831,7 +839,7 @@ static DECLARE_WORK(rebuild_sched_domains_work, do_rebuild_sched_domains);
  */
 static void async_rebuild_sched_domains(void)
 {
-        schedule_work(&rebuild_sched_domains_work);
+        queue_work(cpuset_wq, &rebuild_sched_domains_work);
 }
 
 /*
@@ -2111,6 +2119,9 @@ void __init cpuset_init_smp(void)
 
         hotcpu_notifier(cpuset_track_online_cpus, 0);
         hotplug_memory_notifier(cpuset_track_online_nodes, 10);
+
+        cpuset_wq = create_singlethread_workqueue("cpuset");
+        BUG_ON(!cpuset_wq);
 }
 
 /**
diff --git a/kernel/exit.c b/kernel/exit.c
index f80dec3f187..167e1e3ad7c 100644
--- a/kernel/exit.c
+++ b/kernel/exit.c
@@ -118,6 +118,8 @@ static void __exit_signal(struct task_struct *tsk)
                  * We won't ever get here for the group leader, since it
                  * will have been the last reference on the signal_struct.
                  */
+                sig->utime = cputime_add(sig->utime, task_utime(tsk));
+                sig->stime = cputime_add(sig->stime, task_stime(tsk));
                 sig->gtime = cputime_add(sig->gtime, task_gtime(tsk));
                 sig->min_flt += tsk->min_flt;
                 sig->maj_flt += tsk->maj_flt;
@@ -126,6 +128,7 @@ static void __exit_signal(struct task_struct *tsk)
                 sig->inblock += task_io_get_inblock(tsk);
                 sig->oublock += task_io_get_oublock(tsk);
                 task_io_accounting_add(&sig->ioac, &tsk->ioac);
+                sig->sum_sched_runtime += tsk->se.sum_exec_runtime;
                 sig = NULL; /* Marker for below. */
         }
 
@@ -977,12 +980,9 @@ static void check_stack_usage(void)
 {
         static DEFINE_SPINLOCK(low_water_lock);
         static int lowest_to_date = THREAD_SIZE;
-        unsigned long *n = end_of_stack(current);
         unsigned long free;
 
-        while (*n == 0)
-                n++;
-        free = (unsigned long)n - (unsigned long)end_of_stack(current);
+        free = stack_not_used(current);
 
         if (free >= lowest_to_date)
                 return;
diff --git a/kernel/fork.c b/kernel/fork.c
index 242a706e772..8de303bdd4e 100644
--- a/kernel/fork.c
+++ b/kernel/fork.c
@@ -61,6 +61,7 @@
 #include <linux/proc_fs.h>
 #include <linux/blkdev.h>
 #include <trace/sched.h>
+#include <linux/magic.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -212,6 +213,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
 {
         struct task_struct *tsk;
         struct thread_info *ti;
+        unsigned long *stackend;
+
         int err;
 
         prepare_to_copy(orig);
@@ -237,6 +240,8 @@ static struct task_struct *dup_task_struct(struct task_struct *orig)
                 goto out;
 
         setup_thread_stack(tsk, orig);
+        stackend = end_of_stack(tsk);
+        *stackend = STACK_END_MAGIC;    /* for overflow detection */
 
 #ifdef CONFIG_CC_STACKPROTECTOR
         tsk->stack_canary = get_random_int();
@@ -851,13 +856,14 @@ static int copy_signal(unsigned long clone_flags, struct task_struct *tsk)
         sig->tty_old_pgrp = NULL;
         sig->tty = NULL;
 
-        sig->cutime = sig->cstime = cputime_zero;
+        sig->utime = sig->stime = sig->cutime = sig->cstime = cputime_zero;
         sig->gtime = cputime_zero;
         sig->cgtime = cputime_zero;
         sig->nvcsw = sig->nivcsw = sig->cnvcsw = sig->cnivcsw = 0;
         sig->min_flt = sig->maj_flt = sig->cmin_flt = sig->cmaj_flt = 0;
         sig->inblock = sig->oublock = sig->cinblock = sig->coublock = 0;
         task_io_accounting_init(&sig->ioac);
+        sig->sum_sched_runtime = 0;
         taskstats_tgid_init(sig);
 
         task_lock(current->group_leader);
@@ -1005,6 +1011,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
          * triggers too late. This doesn't hurt, the check is only there
          * to stop root fork bombs.
          */
+        retval = -EAGAIN;
         if (nr_threads >= max_threads)
                 goto bad_fork_cleanup_count;
 
@@ -1093,7 +1100,7 @@ static struct task_struct *copy_process(unsigned long clone_flags,
 #ifdef CONFIG_DEBUG_MUTEXES
         p->blocked_on = NULL; /* not blocked yet */
 #endif
-        if (unlikely(ptrace_reparented(current)))
+        if (unlikely(current->ptrace))
                 ptrace_fork(p, clone_flags);
 
         /* Perform scheduler related setup. Assign this task to a CPU. */
diff --git a/kernel/hrtimer.c b/kernel/hrtimer.c
index f33afb0407b..f394d2a42ca 100644
--- a/kernel/hrtimer.c
+++ b/kernel/hrtimer.c
@@ -501,6 +501,13 @@ static void hrtimer_force_reprogram(struct hrtimer_cpu_base *cpu_base)
                         continue;
                 timer = rb_entry(base->first, struct hrtimer, node);
                 expires = ktime_sub(hrtimer_get_expires(timer), base->offset);
+                /*
+                 * clock_was_set() has changed base->offset so the
+                 * result might be negative. Fix it up to prevent a
+                 * false positive in clockevents_program_event()
+                 */
+                if (expires.tv64 < 0)
+                        expires.tv64 = 0;
                 if (expires.tv64 < cpu_base->expires_next.tv64)
                         cpu_base->expires_next = expires;
         }
@@ -1158,6 +1165,29 @@ static void __run_hrtimer(struct hrtimer *timer)
 
 #ifdef CONFIG_HIGH_RES_TIMERS
 
+static int force_clock_reprogram;
+
+/*
+ * After 5 iteration's attempts, we consider that hrtimer_interrupt()
+ * is hanging, which could happen with something that slows the interrupt
+ * such as the tracing. Then we force the clock reprogramming for each future
+ * hrtimer interrupts to avoid infinite loops and use the min_delta_ns
+ * threshold that we will overwrite.
+ * The next tick event will be scheduled to 3 times we currently spend on
+ * hrtimer_interrupt(). This gives a good compromise, the cpus will spend
+ * 1/4 of their time to process the hrtimer interrupts. This is enough to
+ * let it running without serious starvation.
+ */
+
+static inline void
+hrtimer_interrupt_hanging(struct clock_event_device *dev,
+                        ktime_t try_time)
+{
+        force_clock_reprogram = 1;
+        dev->min_delta_ns = (unsigned long)try_time.tv64 * 3;
+        printk(KERN_WARNING "hrtimer: interrupt too slow, "
+                "forcing clock min delta to %lu ns\n", dev->min_delta_ns);
+}
 /*
  * High resolution timer interrupt
  * Called with interrupts disabled
@@ -1167,6 +1197,7 @@ void hrtimer_interrupt(struct clock_event_device *dev)
         struct hrtimer_cpu_base *cpu_base = &__get_cpu_var(hrtimer_bases);
         struct hrtimer_clock_base *base;
         ktime_t expires_next, now;
+        int nr_retries = 0;
         int i;
 
         BUG_ON(!cpu_base->hres_active);
@@ -1174,6 +1205,10 @@ void hrtimer_interrupt(struct clock_event_device *dev)
         dev->next_event.tv64 = KTIME_MAX;
 
  retry:
+        /* 5 retries is enough to notice a hang */
+        if (!(++nr_retries % 5))
+                hrtimer_interrupt_hanging(dev, ktime_sub(ktime_get(), now));
+
         now = ktime_get();
 
         expires_next.tv64 = KTIME_MAX;
@@ -1226,7 +1261,7 @@ void hrtimer_interrupt(struct clock_event_device *dev)
 
         /* Reprogramming necessary ? */
         if (expires_next.tv64 != KTIME_MAX) {
-                if (tick_program_event(expires_next, 0))
+                if (tick_program_event(expires_next, force_clock_reprogram))
                         goto retry;
         }
 }
@@ -1580,6 +1615,10 @@ static int __cpuinit hrtimer_cpu_notify(struct notifier_block *self,
                 break;
 
 #ifdef CONFIG_HOTPLUG_CPU
+        case CPU_DYING:
+        case CPU_DYING_FROZEN:
+                clockevents_notify(CLOCK_EVT_NOTIFY_CPU_DYING, &scpu);
+                break;
         case CPU_DEAD:
         case CPU_DEAD_FROZEN:
         {
diff --git a/kernel/irq/chip.c b/kernel/irq/chip.c
index f63c706d25e..122fef4b0bd 100644
--- a/kernel/irq/chip.c
+++ b/kernel/irq/chip.c
@@ -46,7 +46,10 @@ void dynamic_irq_init(unsigned int irq)
         desc->irq_count = 0;
         desc->irqs_unhandled = 0;
 #ifdef CONFIG_SMP
-        cpumask_setall(&desc->affinity);
+        cpumask_setall(desc->affinity);
+#ifdef CONFIG_GENERIC_PENDING_IRQ
+        cpumask_clear(desc->pending_mask);
+#endif
 #endif
         spin_unlock_irqrestore(&desc->lock, flags);
 }
@@ -383,6 +386,7 @@ handle_level_irq(unsigned int irq, struct irq_desc *desc)
 out_unlock:
         spin_unlock(&desc->lock);
 }
+EXPORT_SYMBOL_GPL(handle_level_irq);
 
 /**
  *      handle_fasteoi_irq - irq handler for transparent controllers
@@ -593,6 +597,7 @@ __set_irq_handler(unsigned int irq, irq_flow_handler_t handle, int is_chained,
         }
         spin_unlock_irqrestore(&desc->lock, flags);
 }
+EXPORT_SYMBOL_GPL(__set_irq_handler);
 
 void
 set_irq_chip_and_handler(unsigned int irq, struct irq_chip *chip,
diff --git a/kernel/irq/handle.c b/kernel/irq/handle.c
index 3aba8d12f32..f51eaee921b 100644
--- a/kernel/irq/handle.c
+++ b/kernel/irq/handle.c
@@ -17,6 +17,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/rculist.h>
 #include <linux/hash.h>
+#include <linux/bootmem.h>
 
 #include "internals.h"
 
@@ -69,6 +70,7 @@ int nr_irqs = NR_IRQS;
 EXPORT_SYMBOL_GPL(nr_irqs);
 
 #ifdef CONFIG_SPARSE_IRQ
+
 static struct irq_desc irq_desc_init = {
         .irq        = -1,
         .status     = IRQ_DISABLED,
@@ -76,9 +78,6 @@ static struct irq_desc irq_desc_init = {
         .handle_irq = handle_bad_irq,
         .depth      = 1,
         .lock       = __SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
-#ifdef CONFIG_SMP
-        .affinity   = CPU_MASK_ALL
-#endif
 };
 
 void init_kstat_irqs(struct irq_desc *desc, int cpu, int nr)
@@ -113,6 +112,10 @@ static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu)
                 printk(KERN_ERR "can not alloc kstat_irqs\n");
                 BUG_ON(1);
         }
+        if (!init_alloc_desc_masks(desc, cpu, false)) {
+                printk(KERN_ERR "can not alloc irq_desc cpumasks\n");
+                BUG_ON(1);
+        }
         arch_init_chip_data(desc, cpu);
 }
 
@@ -121,7 +124,7 @@ static void init_one_irq_desc(int irq, struct irq_desc *desc, int cpu)
  */
 DEFINE_SPINLOCK(sparse_irq_lock);
 
-struct irq_desc *irq_desc_ptrs[NR_IRQS] __read_mostly;
+struct irq_desc **irq_desc_ptrs __read_mostly;
 
 static struct irq_desc irq_desc_legacy[NR_IRQS_LEGACY] __cacheline_aligned_in_smp = {
         [0 ... NR_IRQS_LEGACY-1] = {
@@ -131,14 +134,10 @@ static struct irq_desc irq_desc_legacy[NR_IRQS_LEGACY] __cacheline_aligned_in_sm
                 .handle_irq = handle_bad_irq,
                 .depth      = 1,
                 .lock       = __SPIN_LOCK_UNLOCKED(irq_desc_init.lock),
-#ifdef CONFIG_SMP
-                .affinity   = CPU_MASK_ALL
-#endif
         }
 };
 
-/* FIXME: use bootmem alloc ...*/
-static unsigned int kstat_irqs_legacy[NR_IRQS_LEGACY][NR_CPUS];
+static unsigned int *kstat_irqs_legacy;
 
 int __init early_irq_init(void)
 {
@@ -148,18 +147,30 @@ int __init early_irq_init(void)
 
         init_irq_default_affinity();
 
+         /* initialize nr_irqs based on nr_cpu_ids */
+        arch_probe_nr_irqs();
+        printk(KERN_INFO "NR_IRQS:%d nr_irqs:%d\n", NR_IRQS, nr_irqs);
+
         desc = irq_desc_legacy;
         legacy_count = ARRAY_SIZE(irq_desc_legacy);
 
+        /* allocate irq_desc_ptrs array based on nr_irqs */
+        irq_desc_ptrs = alloc_bootmem(nr_irqs * sizeof(void *));
+
+        /* allocate based on nr_cpu_ids */
+        /* FIXME: invert kstat_irgs, and it'd be a per_cpu_alloc'd thing */
+        kstat_irqs_legacy = alloc_bootmem(NR_IRQS_LEGACY * nr_cpu_ids *
+                                          sizeof(int));
+
         for (i = 0; i < legacy_count; i++) {
                 desc[i].irq = i;
-                desc[i].kstat_irqs = kstat_irqs_legacy[i];
+                desc[i].kstat_irqs = kstat_irqs_legacy + i * nr_cpu_ids;
                 lockdep_set_class(&desc[i].lock, &irq_desc_lock_class);
-
+                init_alloc_desc_masks(&desc[i], 0, true);
                 irq_desc_ptrs[i] = desc + i;
         }
 
-        for (i = legacy_count; i < NR_IRQS; i++)
+        for (i = legacy_count; i < nr_irqs; i++)
                 irq_desc_ptrs[i] = NULL;
 
         return arch_early_irq_init();
@@ -167,7 +178,10 @@ int __init early_irq_init(void)
 
 struct irq_desc *irq_to_desc(unsigned int irq)
 {
-        return (irq < NR_IRQS) ? irq_desc_ptrs[irq] : NULL;
+        if (irq_desc_ptrs && irq < nr_irqs)
+                return irq_desc_ptrs[irq];
+
+        return NULL;
 }
 
 struct irq_desc *irq_to_desc_alloc_cpu(unsigned int irq, int cpu)
@@ -176,10 +190,9 @@ struct irq_desc *irq_to_desc_alloc_cpu(unsigned int irq, int cpu)
         unsigned long flags;
         int node;
 
-        if (irq >= NR_IRQS) {
-                printk(KERN_WARNING "irq >= NR_IRQS in irq_to_desc_alloc: %d %d\n",
-                                irq, NR_IRQS);
-                WARN_ON(1);
+        if (irq >= nr_irqs) {
+                WARN(1, "irq (%d) >= nr_irqs (%d) in irq_to_desc_alloc\n",
+                        irq, nr_irqs);
                 return NULL;
         }
 
@@ -221,9 +234,6 @@ struct irq_desc irq_desc[NR_IRQS] __cacheline_aligned_in_smp = {
                 .handle_irq = handle_bad_irq,
                 .depth = 1,
                 .lock = __SPIN_LOCK_UNLOCKED(irq_desc->lock),
-#ifdef CONFIG_SMP
-                .affinity = CPU_MASK_ALL
-#endif
         }
 };
 
@@ -235,12 +245,15 @@ int __init early_irq_init(void)
 
         init_irq_default_affinity();
 
+        printk(KERN_INFO "NR_IRQS:%d\n", NR_IRQS);
+
         desc = irq_desc;
         count = ARRAY_SIZE(irq_desc);
 
-        for (i = 0; i < count; i++)
+        for (i = 0; i < count; i++) {
                 desc[i].irq = i;
-
+                init_alloc_desc_masks(&desc[i], 0, true);
+        }
         return arch_early_irq_init();
 }
 
diff --git a/kernel/irq/internals.h b/kernel/irq/internals.h
index e6d0a43cc12..40416a81a0f 100644
--- a/kernel/irq/internals.h
+++ b/kernel/irq/internals.h
@@ -16,7 +16,14 @@ extern int __irq_set_trigger(struct irq_desc *desc, unsigned int irq,
 extern struct lock_class_key irq_desc_lock_class;
 extern void init_kstat_irqs(struct irq_desc *desc, int cpu, int nr);
 extern spinlock_t sparse_irq_lock;
+
+#ifdef CONFIG_SPARSE_IRQ
+/* irq_desc_ptrs allocated at boot time */
+extern struct irq_desc **irq_desc_ptrs;
+#else
+/* irq_desc_ptrs is a fixed size array */
 extern struct irq_desc *irq_desc_ptrs[NR_IRQS];
+#endif
 
 #ifdef CONFIG_PROC_FS
 extern void register_irq_proc(unsigned int irq, struct irq_desc *desc);
diff --git a/kernel/irq/manage.c b/kernel/irq/manage.c
index 291f0366455..a3a5dc9ef34 100644
--- a/kernel/irq/manage.c
+++ b/kernel/irq/manage.c
@@ -90,14 +90,14 @@ int irq_set_affinity(unsigned int irq, const struct cpumask *cpumask)
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         if (desc->status & IRQ_MOVE_PCNTXT || desc->status & IRQ_DISABLED) {
-                cpumask_copy(&desc->affinity, cpumask);
+                cpumask_copy(desc->affinity, cpumask);
                 desc->chip->set_affinity(irq, cpumask);
         } else {
                 desc->status |= IRQ_MOVE_PENDING;
-                cpumask_copy(&desc->pending_mask, cpumask);
+                cpumask_copy(desc->pending_mask, cpumask);
         }
 #else
-        cpumask_copy(&desc->affinity, cpumask);
+        cpumask_copy(desc->affinity, cpumask);
         desc->chip->set_affinity(irq, cpumask);
 #endif
         desc->status |= IRQ_AFFINITY_SET;
@@ -119,16 +119,16 @@ int do_irq_select_affinity(unsigned int irq, struct irq_desc *desc)
          * one of the targets is online.
          */
         if (desc->status & (IRQ_AFFINITY_SET | IRQ_NO_BALANCING)) {
-                if (cpumask_any_and(&desc->affinity, cpu_online_mask)
+                if (cpumask_any_and(desc->affinity, cpu_online_mask)
                     < nr_cpu_ids)
                         goto set_affinity;
                 else
                         desc->status &= ~IRQ_AFFINITY_SET;
         }
 
-        cpumask_and(&desc->affinity, cpu_online_mask, irq_default_affinity);
+        cpumask_and(desc->affinity, cpu_online_mask, irq_default_affinity);
 set_affinity:
-        desc->chip->set_affinity(irq, &desc->affinity);
+        desc->chip->set_affinity(irq, desc->affinity);
 
         return 0;
 }
diff --git a/kernel/irq/migration.c b/kernel/irq/migration.c
index bd72329e630..e05ad9be43b 100644
--- a/kernel/irq/migration.c
+++ b/kernel/irq/migration.c
@@ -18,7 +18,7 @@ void move_masked_irq(int irq)
 
         desc->status &= ~IRQ_MOVE_PENDING;
 
-        if (unlikely(cpumask_empty(&desc->pending_mask)))
+        if (unlikely(cpumask_empty(desc->pending_mask)))
                 return;
 
         if (!desc->chip->set_affinity)
@@ -38,13 +38,13 @@ void move_masked_irq(int irq)
          * For correct operation this depends on the caller
          * masking the irqs.
          */
-        if (likely(cpumask_any_and(&desc->pending_mask, cpu_online_mask)
+        if (likely(cpumask_any_and(desc->pending_mask, cpu_online_mask)
                    < nr_cpu_ids)) {
-                cpumask_and(&desc->affinity,
-                            &desc->pending_mask, cpu_online_mask);
-                desc->chip->set_affinity(irq, &desc->affinity);
+                cpumask_and(desc->affinity,
+                            desc->pending_mask, cpu_online_mask);
+                desc->chip->set_affinity(irq, desc->affinity);
         }
-        cpumask_clear(&desc->pending_mask);
+        cpumask_clear(desc->pending_mask);
 }
 
 void move_native_irq(int irq)
diff --git a/kernel/irq/numa_migrate.c b/kernel/irq/numa_migrate.c
index ecf765c6a77..7f9b80434e3 100644
--- a/kernel/irq/numa_migrate.c
+++ b/kernel/irq/numa_migrate.c
@@ -38,15 +38,22 @@ static void free_kstat_irqs(struct irq_desc *old_desc, struct irq_desc *desc)
         old_desc->kstat_irqs = NULL;
 }
 
-static void init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,
+static bool init_copy_one_irq_desc(int irq, struct irq_desc *old_desc,
                  struct irq_desc *desc, int cpu)
 {
         memcpy(desc, old_desc, sizeof(struct irq_desc));
+        if (!init_alloc_desc_masks(desc, cpu, false)) {
+                printk(KERN_ERR "irq %d: can not get new irq_desc cpumask "
+                                "for migration.\n", irq);
+                return false;
+        }
         spin_lock_init(&desc->lock);
         desc->cpu = cpu;
         lockdep_set_class(&desc->lock, &irq_desc_lock_class);
         init_copy_kstat_irqs(old_desc, desc, cpu, nr_cpu_ids);
+        init_copy_desc_masks(old_desc, desc);
         arch_init_copy_chip_data(old_desc, desc, cpu);
+        return true;
 }
 
 static void free_one_irq_desc(struct irq_desc *old_desc, struct irq_desc *desc)
@@ -71,23 +78,34 @@ static struct irq_desc *__real_move_irq_desc(struct irq_desc *old_desc,
         desc = irq_desc_ptrs[irq];
 
         if (desc && old_desc != desc)
-                        goto out_unlock;
+                goto out_unlock;
 
         node = cpu_to_node(cpu);
         desc = kzalloc_node(sizeof(*desc), GFP_ATOMIC, node);
         if (!desc) {
-                printk(KERN_ERR "irq %d: can not get new irq_desc for migration.\n", irq);
+                printk(KERN_ERR "irq %d: can not get new irq_desc "
+                                "for migration.\n", irq);
                 /* still use old one */
                 desc = old_desc;
                 goto out_unlock;
         }
-        init_copy_one_irq_desc(irq, old_desc, desc, cpu);
+        if (!init_copy_one_irq_desc(irq, old_desc, desc, cpu)) {
+                /* still use old one */
+                kfree(desc);
+                desc = old_desc;
+                goto out_unlock;
+        }
 
         irq_desc_ptrs[irq] = desc;
+        spin_unlock_irqrestore(&sparse_irq_lock, flags);
 
         /* free the old one */
         free_one_irq_desc(old_desc, desc);
+        spin_unlock(&old_desc->lock);
         kfree(old_desc);
+        spin_lock(&desc->lock);
+
+        return desc;
 
 out_unlock:
         spin_unlock_irqrestore(&sparse_irq_lock, flags);
diff --git a/kernel/irq/proc.c b/kernel/irq/proc.c
index aae3f742bce..692363dd591 100644
--- a/kernel/irq/proc.c
+++ b/kernel/irq/proc.c
@@ -20,11 +20,11 @@ static struct proc_dir_entry *root_irq_dir;
 static int irq_affinity_proc_show(struct seq_file *m, void *v)
 {
         struct irq_desc *desc = irq_to_desc((long)m->private);
-        const struct cpumask *mask = &desc->affinity;
+        const struct cpumask *mask = desc->affinity;
 
 #ifdef CONFIG_GENERIC_PENDING_IRQ
         if (desc->status & IRQ_MOVE_PENDING)
-                mask = &desc->pending_mask;
+                mask = desc->pending_mask;
 #endif
         seq_cpumask(m, mask);
         seq_putc(m, '\n');
diff --git a/kernel/itimer.c b/kernel/itimer.c
index 6a5fe93dd8b..58762f7077e 100644
--- a/kernel/itimer.c
+++ b/kernel/itimer.c
@@ -62,7 +62,7 @@ int do_getitimer(int which, struct itimerval *value)
                         struct task_cputime cputime;
                         cputime_t utime;
 
-                        thread_group_cputime(tsk, &cputime);
+                        thread_group_cputimer(tsk, &cputime);
                         utime = cputime.utime;
                         if (cputime_le(cval, utime)) { /* about to fire */
                                 cval = jiffies_to_cputime(1);
@@ -82,7 +82,7 @@ int do_getitimer(int which, struct itimerval *value)
                         struct task_cputime times;
                         cputime_t ptime;
 
-                        thread_group_cputime(tsk, &times);
+                        thread_group_cputimer(tsk, &times);
                         ptime = cputime_add(times.utime, times.stime);
                         if (cputime_le(cval, ptime)) { /* about to fire */
                                 cval = jiffies_to_cputime(1);
diff --git a/kernel/kexec.c b/kernel/kexec.c
index 8a6d7b08864..795e7b67a22 100644
--- a/kernel/kexec.c
+++ b/kernel/kexec.c
@@ -1130,7 +1130,7 @@ void crash_save_cpu(struct pt_regs *regs, int cpu)
                 return;
         memset(&prstatus, 0, sizeof(prstatus));
         prstatus.pr_pid = current->pid;
-        elf_core_copy_regs(&prstatus.pr_reg, regs);
+        elf_core_copy_kernel_regs(&prstatus.pr_reg, regs);
         buf = append_elf_note(buf, KEXEC_CORE_NOTE_NAME, NT_PRSTATUS,
                               &prstatus, sizeof(prstatus));
         final_note(buf);
diff --git a/kernel/module.c b/kernel/module.c
index e8b51d41dd7..ba22484a987 100644
--- a/kernel/module.c
+++ b/kernel/module.c
@@ -573,13 +573,13 @@ static char last_unloaded_module[MODULE_NAME_LEN+1];
 /* Init the unload section of the module. */
 static void module_unload_init(struct module *mod)
 {
-        unsigned int i;
+        int cpu;
 
         INIT_LIST_HEAD(&mod->modules_which_use_me);
-        for (i = 0; i < NR_CPUS; i++)
-                local_set(&mod->ref[i].count, 0);
+        for_each_possible_cpu(cpu)
+                local_set(__module_ref_addr(mod, cpu), 0);
         /* Hold reference count during initialization. */
-        local_set(&mod->ref[raw_smp_processor_id()].count, 1);
+        local_set(__module_ref_addr(mod, raw_smp_processor_id()), 1);
         /* Backwards compatibility macros put refcount during init. */
         mod->waiter = current;
 }
@@ -717,10 +717,11 @@ static int try_stop_module(struct module *mod, int flags, int *forced)
 
 unsigned int module_refcount(struct module *mod)
 {
-        unsigned int i, total = 0;
+        unsigned int total = 0;
+        int cpu;
 
-        for (i = 0; i < NR_CPUS; i++)
-                total += local_read(&mod->ref[i].count);
+        for_each_possible_cpu(cpu)
+                total += local_read(__module_ref_addr(mod, cpu));
         return total;
 }
 EXPORT_SYMBOL(module_refcount);
@@ -894,7 +895,7 @@ void module_put(struct module *module)
 {
         if (module) {
                 unsigned int cpu = get_cpu();
-                local_dec(&module->ref[cpu].count);
+                local_dec(__module_ref_addr(module, cpu));
                 /* Maybe they're waiting for us to drop reference? */
                 if (unlikely(!module_is_live(module)))
                         wake_up_process(module->waiter);
@@ -1464,7 +1465,10 @@ static void free_module(struct module *mod)
         kfree(mod->args);
         if (mod->percpu)
                 percpu_modfree(mod->percpu);
-
+#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+        if (mod->refptr)
+                percpu_modfree(mod->refptr);
+#endif
         /* Free lock-classes: */
         lockdep_free_key_range(mod->module_core, mod->core_size);
 
@@ -2011,6 +2015,14 @@ static noinline struct module *load_module(void __user *umod,
         if (err < 0)
                 goto free_mod;
 
+#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+        mod->refptr = percpu_modalloc(sizeof(local_t), __alignof__(local_t),
+                                      mod->name);
+        if (!mod->refptr) {
+                err = -ENOMEM;
+                goto free_mod;
+        }
+#endif
         if (pcpuindex) {
                 /* We have a special allocation for this section. */
                 percpu = percpu_modalloc(sechdrs[pcpuindex].sh_size,
@@ -2018,7 +2030,7 @@ static noinline struct module *load_module(void __user *umod,
                                          mod->name);
                 if (!percpu) {
                         err = -ENOMEM;
-                        goto free_mod;
+                        goto free_percpu;
                 }
                 sechdrs[pcpuindex].sh_flags &= ~(unsigned long)SHF_ALLOC;
                 mod->percpu = percpu;
@@ -2282,6 +2294,9 @@ static noinline struct module *load_module(void __user *umod,
  free_percpu:
         if (percpu)
                 percpu_modfree(percpu);
+#if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+        percpu_modfree(mod->refptr);
+#endif
  free_mod:
         kfree(args);
  free_hdr:
diff --git a/kernel/panic.c b/kernel/panic.c
index 2a2ff36ff44..32fe4eff1b8 100644
--- a/kernel/panic.c
+++ b/kernel/panic.c
@@ -74,6 +74,9 @@ NORET_TYPE void panic(const char * fmt, ...)
         vsnprintf(buf, sizeof(buf), fmt, args);
         va_end(args);
         printk(KERN_EMERG "Kernel panic - not syncing: %s\n",buf);
+#ifdef CONFIG_DEBUG_BUGVERBOSE
+        dump_stack();
+#endif
         bust_spinlocks(0);
 
         /*
@@ -355,15 +358,18 @@ EXPORT_SYMBOL(warn_slowpath);
 #endif
 
 #ifdef CONFIG_CC_STACKPROTECTOR
+
 /*
  * Called when gcc's -fstack-protector feature is used, and
  * gcc detects corruption of the on-stack canary value
  */
 void __stack_chk_fail(void)
 {
-        panic("stack-protector: Kernel stack is corrupted");
+        panic("stack-protector: Kernel stack is corrupted in: %p\n",
+                __builtin_return_address(0));
 }
 EXPORT_SYMBOL(__stack_chk_fail);
+
 #endif
 
 core_param(panic, panic_timeout, int, 0644);
diff --git a/kernel/posix-cpu-timers.c b/kernel/posix-cpu-timers.c
index fa07da94d7b..2313a4cc14e 100644
--- a/kernel/posix-cpu-timers.c
+++ b/kernel/posix-cpu-timers.c
@@ -230,6 +230,71 @@ static int cpu_clock_sample(const clockid_t which_clock, struct task_struct *p,
         return 0;
 }
 
+void thread_group_cputime(struct task_struct *tsk, struct task_cputime *times)
+{
+        struct sighand_struct *sighand;
+        struct signal_struct *sig;
+        struct task_struct *t;
+
+        *times = INIT_CPUTIME;
+
+        rcu_read_lock();
+        sighand = rcu_dereference(tsk->sighand);
+        if (!sighand)
+                goto out;
+
+        sig = tsk->signal;
+
+        t = tsk;
+        do {
+                times->utime = cputime_add(times->utime, t->utime);
+                times->stime = cputime_add(times->stime, t->stime);
+                times->sum_exec_runtime += t->se.sum_exec_runtime;
+
+                t = next_thread(t);
+        } while (t != tsk);
+
+        times->utime = cputime_add(times->utime, sig->utime);
+        times->stime = cputime_add(times->stime, sig->stime);
+        times->sum_exec_runtime += sig->sum_sched_runtime;
+out:
+        rcu_read_unlock();
+}
+
+static void update_gt_cputime(struct task_cputime *a, struct task_cputime *b)
+{
+        if (cputime_gt(b->utime, a->utime))
+                a->utime = b->utime;
+
+        if (cputime_gt(b->stime, a->stime))
+                a->stime = b->stime;
+
+        if (b->sum_exec_runtime > a->sum_exec_runtime)
+                a->sum_exec_runtime = b->sum_exec_runtime;
+}
+
+void thread_group_cputimer(struct task_struct *tsk, struct task_cputime *times)
+{
+        struct thread_group_cputimer *cputimer = &tsk->signal->cputimer;
+        struct task_cputime sum;
+        unsigned long flags;
+
+        spin_lock_irqsave(&cputimer->lock, flags);
+        if (!cputimer->running) {
+                cputimer->running = 1;
+                /*
+                 * The POSIX timer interface allows for absolute time expiry
+                 * values through the TIMER_ABSTIME flag, therefore we have
+                 * to synchronize the timer to the clock every time we start
+                 * it.
+                 */
+                thread_group_cputime(tsk, &sum);
+                update_gt_cputime(&cputimer->cputime, &sum);
+        }
+        *times = cputimer->cputime;
+        spin_unlock_irqrestore(&cputimer->lock, flags);
+}
+
 /*
  * Sample a process (thread group) clock for the given group_leader task.
  * Must be called with tasklist_lock held for reading.
@@ -457,7 +522,7 @@ void posix_cpu_timers_exit_group(struct task_struct *tsk)
 {
         struct task_cputime cputime;
 
-        thread_group_cputime(tsk, &cputime);
+        thread_group_cputimer(tsk, &cputime);
         cleanup_timers(tsk->signal->cpu_timers,
                        cputime.utime, cputime.stime, cputime.sum_exec_runtime);
 }
@@ -964,6 +1029,19 @@ static void check_thread_timers(struct task_struct *tsk,
         }
 }
 
+static void stop_process_timers(struct task_struct *tsk)
+{
+        struct thread_group_cputimer *cputimer = &tsk->signal->cputimer;
+        unsigned long flags;
+
+        if (!cputimer->running)
+                return;
+
+        spin_lock_irqsave(&cputimer->lock, flags);
+        cputimer->running = 0;
+        spin_unlock_irqrestore(&cputimer->lock, flags);
+}
+
 /*
  * Check for any per-thread CPU timers that have fired and move them
  * off the tsk->*_timers list onto the firing list.  Per-thread timers
@@ -987,13 +1065,15 @@ static void check_process_timers(struct task_struct *tsk,
             sig->rlim[RLIMIT_CPU].rlim_cur == RLIM_INFINITY &&
             list_empty(&timers[CPUCLOCK_VIRT]) &&
             cputime_eq(sig->it_virt_expires, cputime_zero) &&
-            list_empty(&timers[CPUCLOCK_SCHED]))
+            list_empty(&timers[CPUCLOCK_SCHED])) {
+                stop_process_timers(tsk);
                 return;
+        }
 
         /*
          * Collect the current process totals.
          */
-        thread_group_cputime(tsk, &cputime);
+        thread_group_cputimer(tsk, &cputime);
         utime = cputime.utime;
         ptime = cputime_add(utime, cputime.stime);
         sum_sched_runtime = cputime.sum_exec_runtime;
@@ -1259,7 +1339,7 @@ static inline int fastpath_timer_check(struct task_struct *tsk)
         if (!task_cputime_zero(&sig->cputime_expires)) {
                 struct task_cputime group_sample;
 
-                thread_group_cputime(tsk, &group_sample);
+                thread_group_cputimer(tsk, &group_sample);
                 if (task_cputime_expired(&group_sample, &sig->cputime_expires))
                         return 1;
         }
@@ -1329,6 +1409,33 @@ void run_posix_cpu_timers(struct task_struct *tsk)
 }
 
 /*
+ * Sample a process (thread group) timer for the given group_leader task.
+ * Must be called with tasklist_lock held for reading.
+ */
+static int cpu_timer_sample_group(const clockid_t which_clock,
+                                  struct task_struct *p,
+                                  union cpu_time_count *cpu)
+{
+        struct task_cputime cputime;
+
+        thread_group_cputimer(p, &cputime);
+        switch (CPUCLOCK_WHICH(which_clock)) {
+        default:
+                return -EINVAL;
+        case CPUCLOCK_PROF:
+                cpu->cpu = cputime_add(cputime.utime, cputime.stime);
+                break;
+        case CPUCLOCK_VIRT:
+                cpu->cpu = cputime.utime;
+                break;
+        case CPUCLOCK_SCHED:
+                cpu->sched = cputime.sum_exec_runtime + task_delta_exec(p);
+                break;
+        }
+        return 0;
+}
+
+/*
  * Set one of the process-wide special case CPU timers.
  * The tsk->sighand->siglock must be held by the caller.
  * The *newval argument is relative and we update it to be absolute, *oldval
@@ -1341,7 +1448,7 @@ void set_process_cpu_timer(struct task_struct *tsk, unsigned int clock_idx,
         struct list_head *head;
 
         BUG_ON(clock_idx == CPUCLOCK_SCHED);
-        cpu_clock_sample_group(clock_idx, tsk, &now);
+        cpu_timer_sample_group(clock_idx, tsk, &now);
 
         if (oldval) {
                 if (!cputime_eq(*oldval, cputime_zero)) {
diff --git a/kernel/power/main.c b/kernel/power/main.c
index 23998887397..b4d219016b6 100644
--- a/kernel/power/main.c
+++ b/kernel/power/main.c
@@ -57,16 +57,6 @@ int pm_notifier_call_chain(unsigned long val)
 #ifdef CONFIG_PM_DEBUG
 int pm_test_level = TEST_NONE;
 
-static int suspend_test(int level)
-{
-        if (pm_test_level == level) {
-                printk(KERN_INFO "suspend debug: Waiting for 5 seconds.\n");
-                mdelay(5000);
-                return 1;
-        }
-        return 0;
-}
-
 static const char * const pm_tests[__TEST_AFTER_LAST] = {
         [TEST_NONE] = "none",
         [TEST_CORE] = "core",
@@ -125,14 +115,24 @@ static ssize_t pm_test_store(struct kobject *kobj, struct kobj_attribute *attr,
 }
 
 power_attr(pm_test);
-#else /* !CONFIG_PM_DEBUG */
-static inline int suspend_test(int level) { return 0; }
-#endif /* !CONFIG_PM_DEBUG */
+#endif /* CONFIG_PM_DEBUG */
 
 #endif /* CONFIG_PM_SLEEP */
 
 #ifdef CONFIG_SUSPEND
 
+static int suspend_test(int level)
+{
+#ifdef CONFIG_PM_DEBUG
+        if (pm_test_level == level) {
+                printk(KERN_INFO "suspend debug: Waiting for 5 seconds.\n");
+                mdelay(5000);
+                return 1;
+        }
+#endif /* !CONFIG_PM_DEBUG */
+        return 0;
+}
+
 #ifdef CONFIG_PM_TEST_SUSPEND
 
 /*
diff --git a/kernel/profile.c b/kernel/profile.c
index 784933acf5b..7724e0409ba 100644
--- a/kernel/profile.c
+++ b/kernel/profile.c
@@ -114,12 +114,15 @@ int __ref profile_init(void)
         if (!slab_is_available()) {
                 prof_buffer = alloc_bootmem(buffer_bytes);
                 alloc_bootmem_cpumask_var(&prof_cpu_mask);
+                cpumask_copy(prof_cpu_mask, cpu_possible_mask);
                 return 0;
         }
 
         if (!alloc_cpumask_var(&prof_cpu_mask, GFP_KERNEL))
                 return -ENOMEM;
 
+        cpumask_copy(prof_cpu_mask, cpu_possible_mask);
+
         prof_buffer = kzalloc(buffer_bytes, GFP_KERNEL);
         if (prof_buffer)
                 return 0;
diff --git a/kernel/sched.c b/kernel/sched.c
index 52bbf1c842a..61245b8d0f1 100644
--- a/kernel/sched.c
+++ b/kernel/sched.c
@@ -3880,19 +3880,24 @@ int select_nohz_load_balancer(int stop_tick)
         int cpu = smp_processor_id();
 
         if (stop_tick) {
-                cpumask_set_cpu(cpu, nohz.cpu_mask);
                 cpu_rq(cpu)->in_nohz_recently = 1;
 
-                /*
-                 * If we are going offline and still the leader, give up!
-                 */
-                if (!cpu_active(cpu) &&
-                    atomic_read(&nohz.load_balancer) == cpu) {
+                if (!cpu_active(cpu)) {
+                        if (atomic_read(&nohz.load_balancer) != cpu)
+                                return 0;
+
+                        /*
+                         * If we are going offline and still the leader,
+                         * give up!
+                         */
                         if (atomic_cmpxchg(&nohz.load_balancer, cpu, -1) != cpu)
                                 BUG();
+
                         return 0;
                 }
 
+                cpumask_set_cpu(cpu, nohz.cpu_mask);
+
                 /* time for ilb owner also to sleep */
                 if (cpumask_weight(nohz.cpu_mask) == num_online_cpus()) {
                         if (atomic_read(&nohz.load_balancer) == cpu)
@@ -4687,8 +4692,8 @@ EXPORT_SYMBOL(default_wake_function);
  * started to run but is not in state TASK_RUNNING. try_to_wake_up() returns
  * zero in this (rare) case, and we handle it by continuing to scan the queue.
  */
-static void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
-                             int nr_exclusive, int sync, void *key)
+void __wake_up_common(wait_queue_head_t *q, unsigned int mode,
+                        int nr_exclusive, int sync, void *key)
 {
         wait_queue_t *curr, *next;
 
@@ -5939,12 +5944,7 @@ void sched_show_task(struct task_struct *p)
                 printk(KERN_CONT " %016lx ", thread_saved_pc(p));
 #endif
 #ifdef CONFIG_DEBUG_STACK_USAGE
-        {
-                unsigned long *n = end_of_stack(p);
-                while (!*n)
-                        n++;
-                free = (unsigned long)n - (unsigned long)end_of_stack(p);
-        }
+        free = stack_not_used(p);
 #endif
         printk(KERN_CONT "%5lu %5d %6d\n", free,
                 task_pid_nr(p), task_pid_nr(p->real_parent));
diff --git a/kernel/sched_fair.c b/kernel/sched_fair.c
index 5cc1c162044..0566f2a03c4 100644
--- a/kernel/sched_fair.c
+++ b/kernel/sched_fair.c
@@ -719,7 +719,7 @@ enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int wakeup)
                 __enqueue_entity(cfs_rq, se);
 }
 
-static void clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
+static void __clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
 {
         if (cfs_rq->last == se)
                 cfs_rq->last = NULL;
@@ -728,6 +728,12 @@ static void clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
                 cfs_rq->next = NULL;
 }
 
+static void clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
+{
+        for_each_sched_entity(se)
+                __clear_buddies(cfs_rq_of(se), se);
+}
+
 static void
 dequeue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int sleep)
 {
@@ -768,8 +774,14 @@ check_preempt_tick(struct cfs_rq *cfs_rq, struct sched_entity *curr)
 
         ideal_runtime = sched_slice(cfs_rq, curr);
         delta_exec = curr->sum_exec_runtime - curr->prev_sum_exec_runtime;
-        if (delta_exec > ideal_runtime)
+        if (delta_exec > ideal_runtime) {
                 resched_task(rq_of(cfs_rq)->curr);
+                /*
+                 * The current task ran long enough, ensure it doesn't get
+                 * re-elected due to buddy favours.
+                 */
+                clear_buddies(cfs_rq, curr);
+        }
 }
 
 static void
@@ -1452,6 +1464,11 @@ static struct task_struct *pick_next_task_fair(struct rq *rq)
 
         do {
                 se = pick_next_entity(cfs_rq);
+                /*
+                 * If se was a buddy, clear it so that it will have to earn
+                 * the favour again.
+                 */
+                __clear_buddies(cfs_rq, se);
                 set_next_entity(cfs_rq, se);
                 cfs_rq = group_cfs_rq(se);
         } while (cfs_rq);
diff --git a/kernel/sched_rt.c b/kernel/sched_rt.c
index 954e1a81b79..da932f4c852 100644
--- a/kernel/sched_rt.c
+++ b/kernel/sched_rt.c
@@ -960,16 +960,17 @@ static struct task_struct *pick_next_highest_task_rt(struct rq *rq, int cpu)
 
 static DEFINE_PER_CPU(cpumask_var_t, local_cpu_mask);
 
-static inline int pick_optimal_cpu(int this_cpu, cpumask_t *mask)
+static inline int pick_optimal_cpu(int this_cpu,
+                                   const struct cpumask *mask)
 {
         int first;
 
         /* "this_cpu" is cheaper to preempt than a remote processor */
-        if ((this_cpu != -1) && cpu_isset(this_cpu, *mask))
+        if ((this_cpu != -1) && cpumask_test_cpu(this_cpu, mask))
                 return this_cpu;
 
-        first = first_cpu(*mask);
-        if (first != NR_CPUS)
+        first = cpumask_first(mask);
+        if (first < nr_cpu_ids)
                 return first;
 
         return -1;
@@ -981,6 +982,7 @@ static int find_lowest_rq(struct task_struct *task)
         struct cpumask *lowest_mask = __get_cpu_var(local_cpu_mask);
         int this_cpu = smp_processor_id();
         int cpu      = task_cpu(task);
+        cpumask_var_t domain_mask;
 
         if (task->rt.nr_cpus_allowed == 1)
                 return -1; /* No other targets possible */
@@ -1013,19 +1015,25 @@ static int find_lowest_rq(struct task_struct *task)
         if (this_cpu == cpu)
                 this_cpu = -1; /* Skip this_cpu opt if the same */
 
-        for_each_domain(cpu, sd) {
-                if (sd->flags & SD_WAKE_AFFINE) {
-                        cpumask_t domain_mask;
-                        int       best_cpu;
+        if (alloc_cpumask_var(&domain_mask, GFP_ATOMIC)) {
+                for_each_domain(cpu, sd) {
+                        if (sd->flags & SD_WAKE_AFFINE) {
+                                int best_cpu;
 
-                        cpumask_and(&domain_mask, sched_domain_span(sd),
-                                    lowest_mask);
+                                cpumask_and(domain_mask,
+                                            sched_domain_span(sd),
+                                            lowest_mask);
 
-                        best_cpu = pick_optimal_cpu(this_cpu,
-                                                    &domain_mask);
-                        if (best_cpu != -1)
-                                return best_cpu;
+                                best_cpu = pick_optimal_cpu(this_cpu,
+                                                            domain_mask);
+
+                                if (best_cpu != -1) {
+                                        free_cpumask_var(domain_mask);
+                                        return best_cpu;
+                                }
+                        }
                 }
+                free_cpumask_var(domain_mask);
         }
 
         /*
diff --git a/kernel/sched_stats.h b/kernel/sched_stats.h
index 8ab0cef8eca..a8f93dd374e 100644
--- a/kernel/sched_stats.h
+++ b/kernel/sched_stats.h
@@ -296,19 +296,21 @@ sched_info_switch(struct task_struct *prev, struct task_struct *next)
 static inline void account_group_user_time(struct task_struct *tsk,
                                            cputime_t cputime)
 {
-        struct task_cputime *times;
-        struct signal_struct *sig;
+        struct thread_group_cputimer *cputimer;
 
         /* tsk == current, ensure it is safe to use ->signal */
         if (unlikely(tsk->exit_state))
                 return;
 
-        sig = tsk->signal;
-        times = &sig->cputime.totals;
+        cputimer = &tsk->signal->cputimer;
 
-        spin_lock(&times->lock);
-        times->utime = cputime_add(times->utime, cputime);
-        spin_unlock(&times->lock);
+        if (!cputimer->running)
+                return;
+
+        spin_lock(&cputimer->lock);
+        cputimer->cputime.utime =
+                cputime_add(cputimer->cputime.utime, cputime);
+        spin_unlock(&cputimer->lock);
 }
 
 /**
@@ -324,19 +326,21 @@ static inline void account_group_user_time(struct task_struct *tsk,
 static inline void account_group_system_time(struct task_struct *tsk,
                                              cputime_t cputime)
 {
-        struct task_cputime *times;
-        struct signal_struct *sig;
+        struct thread_group_cputimer *cputimer;
 
         /* tsk == current, ensure it is safe to use ->signal */
         if (unlikely(tsk->exit_state))
                 return;
 
-        sig = tsk->signal;
-        times = &sig->cputime.totals;
+        cputimer = &tsk->signal->cputimer;
+
+        if (!cputimer->running)
+                return;
 
-        spin_lock(&times->lock);
-        times->stime = cputime_add(times->stime, cputime);
-        spin_unlock(&times->lock);
+        spin_lock(&cputimer->lock);
+        cputimer->cputime.stime =
+                cputime_add(cputimer->cputime.stime, cputime);
+        spin_unlock(&cputimer->lock);
 }
 
 /**
@@ -352,7 +356,7 @@ static inline void account_group_system_time(struct task_struct *tsk,
 static inline void account_group_exec_runtime(struct task_struct *tsk,
                                               unsigned long long ns)
 {
-        struct task_cputime *times;
+        struct thread_group_cputimer *cputimer;
         struct signal_struct *sig;
 
         sig = tsk->signal;
@@ -361,9 +365,12 @@ static inline void account_group_exec_runtime(struct task_struct *tsk,
         if (unlikely(!sig))
                 return;
 
-        times = &sig->cputime.totals;
+        cputimer = &sig->cputimer;
+
+        if (!cputimer->running)
+                return;
 
-        spin_lock(&times->lock);
-        times->sum_exec_runtime += ns;
-        spin_unlock(&times->lock);
+        spin_lock(&cputimer->lock);
+        cputimer->cputime.sum_exec_runtime += ns;
+        spin_unlock(&cputimer->lock);
 }
diff --git a/kernel/signal.c b/kernel/signal.c
index e73759783dc..2a74fe87c0d 100644
--- a/kernel/signal.c
+++ b/kernel/signal.c
@@ -909,7 +909,9 @@ static void print_fatal_signal(struct pt_regs *regs, int signr)
         }
 #endif
         printk("\n");
+        preempt_disable();
         show_regs(regs);
+        preempt_enable();
 }
 
 static int __init setup_print_fatal_signals(char *str)
@@ -1365,7 +1367,6 @@ int do_notify_parent(struct task_struct *tsk, int sig)
         struct siginfo info;
         unsigned long flags;
         struct sighand_struct *psig;
-        struct task_cputime cputime;
         int ret = sig;
 
         BUG_ON(sig == -1);
@@ -1395,9 +1396,10 @@ int do_notify_parent(struct task_struct *tsk, int sig)
         info.si_uid = __task_cred(tsk)->uid;
         rcu_read_unlock();
 
-        thread_group_cputime(tsk, &cputime);
-        info.si_utime = cputime_to_jiffies(cputime.utime);
-        info.si_stime = cputime_to_jiffies(cputime.stime);
+        info.si_utime = cputime_to_clock_t(cputime_add(tsk->utime,
+                                tsk->signal->utime));
+        info.si_stime = cputime_to_clock_t(cputime_add(tsk->stime,
+                                tsk->signal->stime));
 
         info.si_status = tsk->exit_code & 0x7f;
         if (tsk->exit_code & 0x80)
diff --git a/kernel/smp.c b/kernel/smp.c
index 5cfa0e5e3e8..bbedbb7efe3 100644
--- a/kernel/smp.c
+++ b/kernel/smp.c
@@ -18,6 +18,7 @@ __cacheline_aligned_in_smp DEFINE_SPINLOCK(call_function_lock);
 enum {
         CSD_FLAG_WAIT           = 0x01,
         CSD_FLAG_ALLOC          = 0x02,
+        CSD_FLAG_LOCK           = 0x04,
 };
 
 struct call_function_data {
@@ -186,6 +187,9 @@ void generic_smp_call_function_single_interrupt(void)
                         if (data_flags & CSD_FLAG_WAIT) {
                                 smp_wmb();
                                 data->flags &= ~CSD_FLAG_WAIT;
+                        } else if (data_flags & CSD_FLAG_LOCK) {
+                                smp_wmb();
+                                data->flags &= ~CSD_FLAG_LOCK;
                         } else if (data_flags & CSD_FLAG_ALLOC)
                                 kfree(data);
                 }
@@ -196,6 +200,8 @@ void generic_smp_call_function_single_interrupt(void)
         }
 }
 
+static DEFINE_PER_CPU(struct call_single_data, csd_data);
+
 /*
  * smp_call_function_single - Run a function on a specific CPU
  * @func: The function to run. This must be fast and non-blocking.
@@ -224,14 +230,38 @@ int smp_call_function_single(int cpu, void (*func) (void *info), void *info,
                 func(info);
                 local_irq_restore(flags);
         } else if ((unsigned)cpu < nr_cpu_ids && cpu_online(cpu)) {
-                struct call_single_data *data = NULL;
+                struct call_single_data *data;
 
                 if (!wait) {
+                        /*
+                         * We are calling a function on a single CPU
+                         * and we are not going to wait for it to finish.
+                         * We first try to allocate the data, but if we
+                         * fail, we fall back to use a per cpu data to pass
+                         * the information to that CPU. Since all callers
+                         * of this code will use the same data, we must
+                         * synchronize the callers to prevent a new caller
+                         * from corrupting the data before the callee
+                         * can access it.
+                         *
+                         * The CSD_FLAG_LOCK is used to let us know when
+                         * the IPI handler is done with the data.
+                         * The first caller will set it, and the callee
+                         * will clear it. The next caller must wait for
+                         * it to clear before we set it again. This
+                         * will make sure the callee is done with the
+                         * data before a new caller will use it.
+                         */
                         data = kmalloc(sizeof(*data), GFP_ATOMIC);
                         if (data)
                                 data->flags = CSD_FLAG_ALLOC;
-                }
-                if (!data) {
+                        else {
+                                data = &per_cpu(csd_data, me);
+                                while (data->flags & CSD_FLAG_LOCK)
+                                        cpu_relax();
+                                data->flags = CSD_FLAG_LOCK;
+                        }
+                } else {
                         data = &d;
                         data->flags = CSD_FLAG_WAIT;
                 }
diff --git a/kernel/softirq.c b/kernel/softirq.c
index bdbe9de9cd8..0365b4899a3 100644
--- a/kernel/softirq.c
+++ b/kernel/softirq.c
@@ -795,6 +795,11 @@ int __init __weak early_irq_init(void)
         return 0;
 }
 
+int __init __weak arch_probe_nr_irqs(void)
+{
+        return 0;
+}
+
 int __init __weak arch_early_irq_init(void)
 {
         return 0;
diff --git a/kernel/sys.c b/kernel/sys.c
index e7dc0e10a48..f145c415bc1 100644
--- a/kernel/sys.c
+++ b/kernel/sys.c
@@ -1525,22 +1525,14 @@ SYSCALL_DEFINE2(setrlimit, unsigned int, resource, struct rlimit __user *, rlim)
                 return -EINVAL;
         if (copy_from_user(&new_rlim, rlim, sizeof(*rlim)))
                 return -EFAULT;
+        if (new_rlim.rlim_cur > new_rlim.rlim_max)
+                return -EINVAL;
         old_rlim = current->signal->rlim + resource;
         if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
             !capable(CAP_SYS_RESOURCE))
                 return -EPERM;
-
-        if (resource == RLIMIT_NOFILE) {
-                if (new_rlim.rlim_max == RLIM_INFINITY)
-                        new_rlim.rlim_max = sysctl_nr_open;
-                if (new_rlim.rlim_cur == RLIM_INFINITY)
-                        new_rlim.rlim_cur = sysctl_nr_open;
-                if (new_rlim.rlim_max > sysctl_nr_open)
-                        return -EPERM;
-        }
-
-        if (new_rlim.rlim_cur > new_rlim.rlim_max)
-                return -EINVAL;
+        if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
+                return -EPERM;
 
         retval = security_task_setrlimit(resource, &new_rlim);
         if (retval)
diff --git a/kernel/sysctl.c b/kernel/sysctl.c
index 790f9d78566..c5ef44ff850 100644
--- a/kernel/sysctl.c
+++ b/kernel/sysctl.c
@@ -101,6 +101,7 @@ static int two = 2;
 
 static int zero;
 static int one = 1;
+static unsigned long one_ul = 1;
 static int one_hundred = 100;
 
 /* this is needed for the proc_dointvec_minmax for [fs_]overflow UID and GID */
@@ -974,7 +975,7 @@ static struct ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &dirty_background_bytes_handler,
                 .strategy       = &sysctl_intvec,
-                .extra1         = &one,
+                .extra1         = &one_ul,
         },
         {
                 .ctl_name       = VM_DIRTY_RATIO,
@@ -995,7 +996,7 @@ static struct ctl_table vm_table[] = {
                 .mode           = 0644,
                 .proc_handler   = &dirty_bytes_handler,
                 .strategy       = &sysctl_intvec,
-                .extra1         = &one,
+                .extra1         = &one_ul,
         },
         {
                 .procname       = "dirty_writeback_centisecs",
diff --git a/kernel/time/tick-common.c b/kernel/time/tick-common.c
index 63e05d423a0..21a5ca84951 100644
--- a/kernel/time/tick-common.c
+++ b/kernel/time/tick-common.c
@@ -274,6 +274,21 @@ out_bc:
 }
 
 /*
+ * Transfer the do_timer job away from a dying cpu.
+ *
+ * Called with interrupts disabled.
+ */
+static void tick_handover_do_timer(int *cpup)
+{
+        if (*cpup == tick_do_timer_cpu) {
+                int cpu = cpumask_first(cpu_online_mask);
+
+                tick_do_timer_cpu = (cpu < nr_cpu_ids) ? cpu :
+                        TICK_DO_TIMER_NONE;
+        }
+}
+
+/*
  * Shutdown an event device on a given cpu:
  *
  * This is called on a life CPU, when a CPU is dead. So we cannot
@@ -297,13 +312,6 @@ static void tick_shutdown(unsigned int *cpup)
                 clockevents_exchange_device(dev, NULL);
                 td->evtdev = NULL;
         }
-        /* Transfer the do_timer job away from this cpu */
-        if (*cpup == tick_do_timer_cpu) {
-                int cpu = cpumask_first(cpu_online_mask);
-
-                tick_do_timer_cpu = (cpu < nr_cpu_ids) ? cpu :
-                        TICK_DO_TIMER_NONE;
-        }
         spin_unlock_irqrestore(&tick_device_lock, flags);
 }
 
@@ -357,6 +365,10 @@ static int tick_notify(struct notifier_block *nb, unsigned long reason,
                 tick_broadcast_oneshot_control(reason);
                 break;
 
+        case CLOCK_EVT_NOTIFY_CPU_DYING:
+                tick_handover_do_timer(dev);
+                break;
+
         case CLOCK_EVT_NOTIFY_CPU_DEAD:
                 tick_shutdown_broadcast_oneshot(dev);
                 tick_shutdown_broadcast(dev);
diff --git a/kernel/trace/ftrace.c b/kernel/trace/ftrace.c
index 2f32969c09d..9a236ffe2aa 100644
--- a/kernel/trace/ftrace.c
+++ b/kernel/trace/ftrace.c
@@ -17,6 +17,7 @@
 #include <linux/clocksource.h>
 #include <linux/kallsyms.h>
 #include <linux/seq_file.h>
+#include <linux/suspend.h>
 #include <linux/debugfs.h>
 #include <linux/hardirq.h>
 #include <linux/kthread.h>
@@ -1736,9 +1737,12 @@ static void clear_ftrace_pid(struct pid *pid)
 {
         struct task_struct *p;
 
+        rcu_read_lock();
         do_each_pid_task(pid, PIDTYPE_PID, p) {
                 clear_tsk_trace_trace(p);
         } while_each_pid_task(pid, PIDTYPE_PID, p);
+        rcu_read_unlock();
+
         put_pid(pid);
 }
 
@@ -1746,9 +1750,11 @@ static void set_ftrace_pid(struct pid *pid)
 {
         struct task_struct *p;
 
+        rcu_read_lock();
         do_each_pid_task(pid, PIDTYPE_PID, p) {
                 set_tsk_trace_trace(p);
         } while_each_pid_task(pid, PIDTYPE_PID, p);
+        rcu_read_unlock();
 }
 
 static void clear_ftrace_pid_task(struct pid **pid)
@@ -1965,6 +1971,7 @@ ftrace_enable_sysctl(struct ctl_table *table, int write,
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 
 static atomic_t ftrace_graph_active;
+static struct notifier_block ftrace_suspend_notifier;
 
 int ftrace_graph_entry_stub(struct ftrace_graph_ent *trace)
 {
@@ -2043,6 +2050,27 @@ static int start_graph_tracing(void)
         return ret;
 }
 
+/*
+ * Hibernation protection.
+ * The state of the current task is too much unstable during
+ * suspend/restore to disk. We want to protect against that.
+ */
+static int
+ftrace_suspend_notifier_call(struct notifier_block *bl, unsigned long state,
+                                                        void *unused)
+{
+        switch (state) {
+        case PM_HIBERNATION_PREPARE:
+                pause_graph_tracing();
+                break;
+
+        case PM_POST_HIBERNATION:
+                unpause_graph_tracing();
+                break;
+        }
+        return NOTIFY_DONE;
+}
+
 int register_ftrace_graph(trace_func_graph_ret_t retfunc,
                         trace_func_graph_ent_t entryfunc)
 {
@@ -2050,6 +2078,9 @@ int register_ftrace_graph(trace_func_graph_ret_t retfunc,
 
         mutex_lock(&ftrace_sysctl_lock);
 
+        ftrace_suspend_notifier.notifier_call = ftrace_suspend_notifier_call;
+        register_pm_notifier(&ftrace_suspend_notifier);
+
         atomic_inc(&ftrace_graph_active);
         ret = start_graph_tracing();
         if (ret) {
@@ -2075,6 +2106,7 @@ void unregister_ftrace_graph(void)
         ftrace_graph_return = (trace_func_graph_ret_t)ftrace_stub;
         ftrace_graph_entry = ftrace_graph_entry_stub;
         ftrace_shutdown(FTRACE_STOP_FUNC_RET);
+        unregister_pm_notifier(&ftrace_suspend_notifier);
 
         mutex_unlock(&ftrace_sysctl_lock);
 }
diff --git a/kernel/trace/ring_buffer.c b/kernel/trace/ring_buffer.c
index 8b0daf0662e..bd38c5cfd8a 100644
--- a/kernel/trace/ring_buffer.c
+++ b/kernel/trace/ring_buffer.c
@@ -246,7 +246,7 @@ static inline int test_time_stamp(u64 delta)
         return 0;
 }
 
-#define BUF_PAGE_SIZE (PAGE_SIZE - sizeof(struct buffer_data_page))
+#define BUF_PAGE_SIZE (PAGE_SIZE - offsetof(struct buffer_data_page, data))
 
 /*
  * head_page == tail_page && head == tail then buffer is empty.
@@ -1025,12 +1025,8 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
                 }
 
                 if (next_page == head_page) {
-                        if (!(buffer->flags & RB_FL_OVERWRITE)) {
-                                /* reset write */
-                                if (tail <= BUF_PAGE_SIZE)
-                                        local_set(&tail_page->write, tail);
+                        if (!(buffer->flags & RB_FL_OVERWRITE))
                                 goto out_unlock;
-                        }
 
                         /* tail_page has not moved yet? */
                         if (tail_page == cpu_buffer->tail_page) {
@@ -1105,6 +1101,10 @@ __rb_reserve_next(struct ring_buffer_per_cpu *cpu_buffer,
         return event;
 
  out_unlock:
+        /* reset write */
+        if (tail <= BUF_PAGE_SIZE)
+                local_set(&tail_page->write, tail);
+
         __raw_spin_unlock(&cpu_buffer->lock);
         local_irq_restore(flags);
         return NULL;
@@ -2174,6 +2174,9 @@ rb_reset_cpu(struct ring_buffer_per_cpu *cpu_buffer)
 
         cpu_buffer->overrun = 0;
         cpu_buffer->entries = 0;
+
+        cpu_buffer->write_stamp = 0;
+        cpu_buffer->read_stamp = 0;
 }
 
 /**
diff --git a/kernel/trace/trace.c b/kernel/trace/trace.c
index c580233add9..17bb88d86ac 100644
--- a/kernel/trace/trace.c
+++ b/kernel/trace/trace.c
@@ -40,7 +40,7 @@
 
 #define TRACE_BUFFER_FLAGS      (RB_FL_OVERWRITE)
 
-unsigned long __read_mostly     tracing_max_latency = (cycle_t)ULONG_MAX;
+unsigned long __read_mostly     tracing_max_latency;
 unsigned long __read_mostly     tracing_thresh;
 
 /*
@@ -3736,7 +3736,7 @@ static struct notifier_block trace_die_notifier = {
  * it if we decide to change what log level the ftrace dump
  * should be at.
  */
-#define KERN_TRACE              KERN_INFO
+#define KERN_TRACE              KERN_EMERG
 
 static void
 trace_printk_seq(struct trace_seq *s)
@@ -3770,6 +3770,7 @@ void ftrace_dump(void)
         dump_ran = 1;
 
         /* No turning back! */
+        tracing_off();
         ftrace_kill();
 
         for_each_tracing_cpu(cpu) {
diff --git a/kernel/trace/trace_irqsoff.c b/kernel/trace/trace_irqsoff.c
index 7c2e326bbc8..62a78d94353 100644
--- a/kernel/trace/trace_irqsoff.c
+++ b/kernel/trace/trace_irqsoff.c
@@ -380,6 +380,7 @@ static void stop_irqsoff_tracer(struct trace_array *tr)
 
 static void __irqsoff_tracer_init(struct trace_array *tr)
 {
+        tracing_max_latency = 0;
         irqsoff_trace = tr;
         /* make sure that the tracer is visible */
         smp_wmb();
diff --git a/kernel/trace/trace_sched_wakeup.c b/kernel/trace/trace_sched_wakeup.c
index 43586b689e3..42ae1e77b6b 100644
--- a/kernel/trace/trace_sched_wakeup.c
+++ b/kernel/trace/trace_sched_wakeup.c
@@ -333,6 +333,7 @@ static void stop_wakeup_tracer(struct trace_array *tr)
 
 static int wakeup_tracer_init(struct trace_array *tr)
 {
+        tracing_max_latency = 0;
         wakeup_trace = tr;
         start_wakeup_tracer(tr);
         return 0;
diff --git a/kernel/wait.c b/kernel/wait.c
index cd87131f2fc..42a2dbc181c 100644
--- a/kernel/wait.c
+++ b/kernel/wait.c
@@ -91,6 +91,15 @@ prepare_to_wait_exclusive(wait_queue_head_t *q, wait_queue_t *wait, int state)
 }
 EXPORT_SYMBOL(prepare_to_wait_exclusive);
 
+/*
+ * finish_wait - clean up after waiting in a queue
+ * @q: waitqueue waited on
+ * @wait: wait descriptor
+ *
+ * Sets current thread back to running state and removes
+ * the wait descriptor from the given waitqueue if still
+ * queued.
+ */
 void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
 {
         unsigned long flags;
@@ -117,6 +126,39 @@ void finish_wait(wait_queue_head_t *q, wait_queue_t *wait)
 }
 EXPORT_SYMBOL(finish_wait);
 
+/*
+ * abort_exclusive_wait - abort exclusive waiting in a queue
+ * @q: waitqueue waited on
+ * @wait: wait descriptor
+ * @state: runstate of the waiter to be woken
+ * @key: key to identify a wait bit queue or %NULL
+ *
+ * Sets current thread back to running state and removes
+ * the wait descriptor from the given waitqueue if still
+ * queued.
+ *
+ * Wakes up the next waiter if the caller is concurrently
+ * woken up through the queue.
+ *
+ * This prevents waiter starvation where an exclusive waiter
+ * aborts and is woken up concurrently and noone wakes up
+ * the next waiter.
+ */
+void abort_exclusive_wait(wait_queue_head_t *q, wait_queue_t *wait,
+                        unsigned int mode, void *key)
+{
+        unsigned long flags;
+
+        __set_current_state(TASK_RUNNING);
+        spin_lock_irqsave(&q->lock, flags);
+        if (!list_empty(&wait->task_list))
+                list_del_init(&wait->task_list);
+        else if (waitqueue_active(q))
+                __wake_up_common(q, mode, 1, 0, key);
+        spin_unlock_irqrestore(&q->lock, flags);
+}
+EXPORT_SYMBOL(abort_exclusive_wait);
+
 int autoremove_wake_function(wait_queue_t *wait, unsigned mode, int sync, void *key)
 {
         int ret = default_wake_function(wait, mode, sync, key);
@@ -177,17 +219,20 @@ int __sched
 __wait_on_bit_lock(wait_queue_head_t *wq, struct wait_bit_queue *q,
                         int (*action)(void *), unsigned mode)
 {
-        int ret = 0;
-
         do {
+                int ret;
+
                 prepare_to_wait_exclusive(wq, &q->wait, mode);
-                if (test_bit(q->key.bit_nr, q->key.flags)) {
-                        if ((ret = (*action)(q->key.flags)))
-                                break;
-                }
+                if (!test_bit(q->key.bit_nr, q->key.flags))
+                        continue;
+                ret = action(q->key.flags);
+                if (!ret)
+                        continue;
+                abort_exclusive_wait(wq, &q->wait, mode, &q->key);
+                return ret;
         } while (test_and_set_bit(q->key.bit_nr, q->key.flags));
         finish_wait(wq, &q->wait);
-        return ret;
+        return 0;
 }
 EXPORT_SYMBOL(__wait_on_bit_lock);
 
diff --git a/lib/smp_processor_id.c b/lib/smp_processor_id.c
index 0f8fc22ed10..4689cb073da 100644
--- a/lib/smp_processor_id.c
+++ b/lib/smp_processor_id.c
@@ -22,7 +22,7 @@ notrace unsigned int debug_smp_processor_id(void)
          * Kernel threads bound to a single CPU can safely use
          * smp_processor_id():
          */
-        if (cpus_equal(current->cpus_allowed, cpumask_of_cpu(this_cpu)))
+        if (cpumask_equal(&current->cpus_allowed, cpumask_of(this_cpu)))
                 goto out;
 
         /*
diff --git a/mm/fremap.c b/mm/fremap.c
index 736ba7f3306..b6ec85abbb3 100644
--- a/mm/fremap.c
+++ b/mm/fremap.c
@@ -198,7 +198,7 @@ SYSCALL_DEFINE5(remap_file_pages, unsigned long, start, unsigned long, size,
                         flags &= MAP_NONBLOCK;
                         get_file(file);
                         addr = mmap_region(file, start, size,
-                                        flags, vma->vm_flags, pgoff, 1);
+                                        flags, vma->vm_flags, pgoff);
                         fput(file);
                         if (IS_ERR_VALUE(addr)) {
                                 err = addr;
diff --git a/mm/hugetlb.c b/mm/hugetlb.c
index 618e9830408..107da3d809a 100644
--- a/mm/hugetlb.c
+++ b/mm/hugetlb.c
@@ -2269,12 +2269,18 @@ void hugetlb_change_protection(struct vm_area_struct *vma,
 
 int hugetlb_reserve_pages(struct inode *inode,
                                         long from, long to,
-                                        struct vm_area_struct *vma)
+                                        struct vm_area_struct *vma,
+                                        int acctflag)
 {
         long ret, chg;
         struct hstate *h = hstate_inode(inode);
 
-        if (vma && vma->vm_flags & VM_NORESERVE)
+        /*
+         * Only apply hugepage reservation if asked. At fault time, an
+         * attempt will be made for VM_NORESERVE to allocate a page
+         * and filesystem quota without using reserves
+         */
+        if (acctflag & VM_NORESERVE)
                 return 0;
 
         /*
@@ -2299,13 +2305,31 @@ int hugetlb_reserve_pages(struct inode *inode,
         if (chg < 0)
                 return chg;
 
+        /* There must be enough filesystem quota for the mapping */
         if (hugetlb_get_quota(inode->i_mapping, chg))
                 return -ENOSPC;
+
+        /*
+         * Check enough hugepages are available for the reservation.
+         * Hand back the quota if there are not
+         */
         ret = hugetlb_acct_memory(h, chg);
         if (ret < 0) {
                 hugetlb_put_quota(inode->i_mapping, chg);
                 return ret;
         }
+
+        /*
+         * Account for the reservations made. Shared mappings record regions
+         * that have reservations as they are shared by multiple VMAs.
+         * When the last VMA disappears, the region map says how much
+         * the reservation was and the page cache tells how much of
+         * the reservation was consumed. Private mappings are per-VMA and
+         * only the consumed reservations are tracked. When the VMA
+         * disappears, the original reservation is the VMA size and the
+         * consumed reservations are stored in the map. Hence, nothing
+         * else has to be done for private mappings here
+         */
         if (!vma || vma->vm_flags & VM_SHARED)
                 region_add(&inode->i_mapping->private_list, from, to);
         return 0;
diff --git a/mm/memory.c b/mm/memory.c
index 22bfa7a47a0..baa999e87cd 100644
--- a/mm/memory.c
+++ b/mm/memory.c
@@ -1999,7 +1999,7 @@ gotten:
          * Don't let another task, with possibly unlocked vma,
          * keep the mlocked page.
          */
-        if (vma->vm_flags & VM_LOCKED) {
+        if ((vma->vm_flags & VM_LOCKED) && old_page) {
                 lock_page(old_page);    /* for LRU manipulation */
                 clear_page_mlock(old_page);
                 unlock_page(old_page);
diff --git a/mm/migrate.c b/mm/migrate.c
index 2bb4e1d6352..a9eff3f092f 100644
--- a/mm/migrate.c
+++ b/mm/migrate.c
@@ -1129,7 +1129,7 @@ int migrate_vmas(struct mm_struct *mm, const nodemask_t *to,
         struct vm_area_struct *vma;
         int err = 0;
 
-        for(vma = mm->mmap; vma->vm_next && !err; vma = vma->vm_next) {
+        for (vma = mm->mmap; vma && !err; vma = vma->vm_next) {
                 if (vma->vm_ops && vma->vm_ops->migrate) {
                         err = vma->vm_ops->migrate(vma, to, from, flags);
                         if (err)
diff --git a/mm/mlock.c b/mm/mlock.c
index 2904a347e47..cbe9e0581b7 100644
--- a/mm/mlock.c
+++ b/mm/mlock.c
@@ -294,14 +294,10 @@ static inline int __mlock_posix_error_return(long retval)
  *
  * return number of pages [> 0] to be removed from locked_vm on success
  * of "special" vmas.
- *
- * return negative error if vma spanning @start-@range disappears while
- * mmap semaphore is dropped.  Unlikely?
  */
 long mlock_vma_pages_range(struct vm_area_struct *vma,
                         unsigned long start, unsigned long end)
 {
-        struct mm_struct *mm = vma->vm_mm;
         int nr_pages = (end - start) / PAGE_SIZE;
         BUG_ON(!(vma->vm_flags & VM_LOCKED));
 
@@ -314,20 +310,11 @@ long mlock_vma_pages_range(struct vm_area_struct *vma,
         if (!((vma->vm_flags & (VM_DONTEXPAND | VM_RESERVED)) ||
                         is_vm_hugetlb_page(vma) ||
                         vma == get_gate_vma(current))) {
-                long error;
-                downgrade_write(&mm->mmap_sem);
 
-                error = __mlock_vma_pages_range(vma, start, end, 1);
+                __mlock_vma_pages_range(vma, start, end, 1);
 
-                up_read(&mm->mmap_sem);
-                /* vma can change or disappear */
-                down_write(&mm->mmap_sem);
-                vma = find_vma(mm, start);
-                /* non-NULL vma must contain @start, but need to check @end */
-                if (!vma ||  end > vma->vm_end)
-                        return -ENOMEM;
-
-                return 0;       /* hide other errors from mmap(), et al */
+                /* Hide errors from mmap() and other callers */
+                return 0;
         }
 
         /*
@@ -438,41 +425,14 @@ success:
         vma->vm_flags = newflags;
 
         if (lock) {
-                /*
-                 * mmap_sem is currently held for write.  Downgrade the write
-                 * lock to a read lock so that other faults, mmap scans, ...
-                 * while we fault in all pages.
-                 */
-                downgrade_write(&mm->mmap_sem);
-
                 ret = __mlock_vma_pages_range(vma, start, end, 1);
 
-                /*
-                 * Need to reacquire mmap sem in write mode, as our callers
-                 * expect this.  We have no support for atomically upgrading
-                 * a sem to write, so we need to check for ranges while sem
-                 * is unlocked.
-                 */
-                up_read(&mm->mmap_sem);
-                /* vma can change or disappear */
-                down_write(&mm->mmap_sem);
-                *prev = find_vma(mm, start);
-                /* non-NULL *prev must contain @start, but need to check @end */
-                if (!(*prev) || end > (*prev)->vm_end)
-                        ret = -ENOMEM;
-                else if (ret > 0) {
+                if (ret > 0) {
                         mm->locked_vm -= ret;
                         ret = 0;
                 } else
                         ret = __mlock_posix_error_return(ret); /* translate if needed */
         } else {
-                /*
-                 * TODO:  for unlocking, pages will already be resident, so
-                 * we don't need to wait for allocations/reclaim/pagein, ...
-                 * However, unlocking a very large region can still take a
-                 * while.  Should we downgrade the semaphore for both lock
-                 * AND unlock ?
-                 */
                 __mlock_vma_pages_range(vma, start, end, 0);
         }
 
@@ -700,7 +660,7 @@ void *alloc_locked_buffer(size_t size)
         return buffer;
 }
 
-void free_locked_buffer(void *buffer, size_t size)
+void release_locked_buffer(void *buffer, size_t size)
 {
         unsigned long pgsz = PAGE_ALIGN(size) >> PAGE_SHIFT;
 
@@ -710,6 +670,11 @@ void free_locked_buffer(void *buffer, size_t size)
         current->mm->locked_vm -= pgsz;
 
         up_write(&current->mm->mmap_sem);
+}
+
+void free_locked_buffer(void *buffer, size_t size)
+{
+        release_locked_buffer(buffer, size);
 
         kfree(buffer);
 }
diff --git a/mm/mmap.c b/mm/mmap.c
index d3fa10a726c..00ced3ee49a 100644
--- a/mm/mmap.c
+++ b/mm/mmap.c
@@ -658,6 +658,9 @@ again:			remove_next = 1 + (end > next->vm_end);
         validate_mm(mm);
 }
 
+/* Flags that can be inherited from an existing mapping when merging */
+#define VM_MERGEABLE_FLAGS (VM_CAN_NONLINEAR)
+
 /*
  * If the vma has a ->close operation then the driver probably needs to release
  * per-vma resources, so we don't attempt to merge those.
@@ -665,7 +668,7 @@ again:			remove_next = 1 + (end > next->vm_end);
 static inline int is_mergeable_vma(struct vm_area_struct *vma,
                         struct file *file, unsigned long vm_flags)
 {
-        if (vma->vm_flags != vm_flags)
+        if ((vma->vm_flags ^ vm_flags) & ~VM_MERGEABLE_FLAGS)
                 return 0;
         if (vma->vm_file != file)
                 return 0;
@@ -915,7 +918,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         struct inode *inode;
         unsigned int vm_flags;
         int error;
-        int accountable = 1;
         unsigned long reqprot = prot;
 
         /*
@@ -1016,8 +1018,6 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
                                         return -EPERM;
                                 vm_flags &= ~VM_MAYEXEC;
                         }
-                        if (is_file_hugepages(file))
-                                accountable = 0;
 
                         if (!file->f_op || !file->f_op->mmap)
                                 return -ENODEV;
@@ -1050,8 +1050,7 @@ unsigned long do_mmap_pgoff(struct file *file, unsigned long addr,
         if (error)
                 return error;
 
-        return mmap_region(file, addr, len, flags, vm_flags, pgoff,
-                           accountable);
+        return mmap_region(file, addr, len, flags, vm_flags, pgoff);
 }
 EXPORT_SYMBOL(do_mmap_pgoff);
 
@@ -1087,10 +1086,25 @@ int vma_wants_writenotify(struct vm_area_struct *vma)
                 mapping_cap_account_dirty(vma->vm_file->f_mapping);
 }
 
+/*
+ * We account for memory if it's a private writeable mapping,
+ * not hugepages and VM_NORESERVE wasn't set.
+ */
+static inline int accountable_mapping(struct file *file, unsigned int vm_flags)
+{
+        /*
+         * hugetlb has its own accounting separate from the core VM
+         * VM_HUGETLB may not be set yet so we cannot check for that flag.
+         */
+        if (file && is_file_hugepages(file))
+                return 0;
+
+        return (vm_flags & (VM_NORESERVE | VM_SHARED | VM_WRITE)) == VM_WRITE;
+}
+
 unsigned long mmap_region(struct file *file, unsigned long addr,
                           unsigned long len, unsigned long flags,
-                          unsigned int vm_flags, unsigned long pgoff,
-                          int accountable)
+                          unsigned int vm_flags, unsigned long pgoff)
 {
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma, *prev;
@@ -1114,23 +1128,28 @@ munmap_back:
         if (!may_expand_vm(mm, len >> PAGE_SHIFT))
                 return -ENOMEM;
 
-        if (flags & MAP_NORESERVE)
-                vm_flags |= VM_NORESERVE;
+        /*
+         * Set 'VM_NORESERVE' if we should not account for the
+         * memory use of this mapping.
+         */
+        if ((flags & MAP_NORESERVE)) {
+                /* We honor MAP_NORESERVE if allowed to overcommit */
+                if (sysctl_overcommit_memory != OVERCOMMIT_NEVER)
+                        vm_flags |= VM_NORESERVE;
 
-        if (accountable && (!(flags & MAP_NORESERVE) ||
-                            sysctl_overcommit_memory == OVERCOMMIT_NEVER)) {
-                if (vm_flags & VM_SHARED) {
-                        /* Check memory availability in shmem_file_setup? */
-                        vm_flags |= VM_ACCOUNT;
-                } else if (vm_flags & VM_WRITE) {
-                        /*
-                         * Private writable mapping: check memory availability
-                         */
-                        charged = len >> PAGE_SHIFT;
-                        if (security_vm_enough_memory(charged))
-                                return -ENOMEM;
-                        vm_flags |= VM_ACCOUNT;
-                }
+                /* hugetlb applies strict overcommit unless MAP_NORESERVE */
+                if (file && is_file_hugepages(file))
+                        vm_flags |= VM_NORESERVE;
+        }
+
+        /*
+         * Private writable mapping: check memory availability
+         */
+        if (accountable_mapping(file, vm_flags)) {
+                charged = len >> PAGE_SHIFT;
+                if (security_vm_enough_memory(charged))
+                        return -ENOMEM;
+                vm_flags |= VM_ACCOUNT;
         }
 
         /*
@@ -1181,14 +1200,6 @@ munmap_back:
                         goto free_vma;
         }
 
-        /* We set VM_ACCOUNT in a shared mapping's vm_flags, to inform
-         * shmem_zero_setup (perhaps called through /dev/zero's ->mmap)
-         * that memory reservation must be checked; but that reservation
-         * belongs to shared memory object, not to vma: so now clear it.
-         */
-        if ((vm_flags & (VM_SHARED|VM_ACCOUNT)) == (VM_SHARED|VM_ACCOUNT))
-                vma->vm_flags &= ~VM_ACCOUNT;
-
         /* Can addr have changed??
          *
          * Answer: Yes, several device drivers can do it in their
@@ -2073,12 +2084,8 @@ void exit_mmap(struct mm_struct *mm)
         unsigned long end;
 
         /* mm's last user has gone, and its about to be pulled down */
-        arch_exit_mmap(mm);
         mmu_notifier_release(mm);
 
-        if (!mm->mmap)  /* Can happen if dup_mmap() received an OOM */
-                return;
-
         if (mm->locked_vm) {
                 vma = mm->mmap;
                 while (vma) {
@@ -2087,7 +2094,13 @@ void exit_mmap(struct mm_struct *mm)
                         vma = vma->vm_next;
                 }
         }
+
+        arch_exit_mmap(mm);
+
         vma = mm->mmap;
+        if (!vma)       /* Can happen if dup_mmap() received an OOM */
+                return;
+
         lru_add_drain();
         flush_cache_mm(mm);
         tlb = tlb_gather_mmu(mm, 1);
diff --git a/mm/mprotect.c b/mm/mprotect.c
index abe2694e13f..258197b76fb 100644
--- a/mm/mprotect.c
+++ b/mm/mprotect.c
@@ -151,10 +151,11 @@ mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
         /*
          * If we make a private mapping writable we increase our commit;
          * but (without finer accounting) cannot reduce our commit if we
-         * make it unwritable again.
+         * make it unwritable again. hugetlb mapping were accounted for
+         * even if read-only so there is no need to account for them here
          */
         if (newflags & VM_WRITE) {
-                if (!(oldflags & (VM_ACCOUNT|VM_WRITE|
+                if (!(oldflags & (VM_ACCOUNT|VM_WRITE|VM_HUGETLB|
                                                 VM_SHARED|VM_NORESERVE))) {
                         charged = nrpages;
                         if (security_vm_enough_memory(charged))
diff --git a/mm/page-writeback.c b/mm/page-writeback.c
index b493db7841d..3c84128596b 100644
--- a/mm/page-writeback.c
+++ b/mm/page-writeback.c
@@ -209,7 +209,7 @@ int dirty_bytes_handler(struct ctl_table *table, int write,
                 struct file *filp, void __user *buffer, size_t *lenp,
                 loff_t *ppos)
 {
-        int old_bytes = vm_dirty_bytes;
+        unsigned long old_bytes = vm_dirty_bytes;
         int ret;
 
         ret = proc_doulongvec_minmax(table, write, filp, buffer, lenp, ppos);
@@ -1051,13 +1051,25 @@ continue_unlock:
                                 }
                         }
 
-                        if (wbc->sync_mode == WB_SYNC_NONE) {
-                                wbc->nr_to_write--;
-                                if (wbc->nr_to_write <= 0) {
+                        if (nr_to_write > 0) {
+                                nr_to_write--;
+                                if (nr_to_write == 0 &&
+                                    wbc->sync_mode == WB_SYNC_NONE) {
+                                        /*
+                                         * We stop writing back only if we are
+                                         * not doing integrity sync. In case of
+                                         * integrity sync we have to keep going
+                                         * because someone may be concurrently
+                                         * dirtying pages, and we might have
+                                         * synced a lot of newly appeared dirty
+                                         * pages, but have not synced all of the
+                                         * old dirty pages.
+                                         */
                                         done = 1;
                                         break;
                                 }
                         }
+
                         if (wbc->nonblocking && bdi_write_congested(bdi)) {
                                 wbc->encountered_congestion = 1;
                                 done = 1;
@@ -1067,7 +1079,7 @@ continue_unlock:
                 pagevec_release(&pvec);
                 cond_resched();
         }
-        if (!cycled) {
+        if (!cycled && !done) {
                 /*
                  * range_cyclic:
                  * We hit the last page and there is more work to be done: wrap
diff --git a/mm/page_cgroup.c b/mm/page_cgroup.c
index 7006a11350c..ceecfbb143f 100644
--- a/mm/page_cgroup.c
+++ b/mm/page_cgroup.c
@@ -114,7 +114,8 @@ static int __init_refok init_section_page_cgroup(unsigned long pfn)
                 nid = page_to_nid(pfn_to_page(pfn));
                 table_size = sizeof(struct page_cgroup) * PAGES_PER_SECTION;
                 if (slab_is_available()) {
-                        base = kmalloc_node(table_size, GFP_KERNEL, nid);
+                        base = kmalloc_node(table_size,
+                                        GFP_KERNEL | __GFP_NOWARN, nid);
                         if (!base)
                                 base = vmalloc_node(table_size, nid);
                 } else {
diff --git a/mm/rmap.c b/mm/rmap.c
index ac4af8cffbf..16521664010 100644
--- a/mm/rmap.c
+++ b/mm/rmap.c
@@ -1072,7 +1072,8 @@ static int try_to_unmap_file(struct page *page, int unlock, int migration)
         spin_lock(&mapping->i_mmap_lock);
         vma_prio_tree_foreach(vma, &iter, &mapping->i_mmap, pgoff, pgoff) {
                 if (MLOCK_PAGES && unlikely(unlock)) {
-                        if (!(vma->vm_flags & VM_LOCKED))
+                        if (!((vma->vm_flags & VM_LOCKED) &&
+                                                page_mapped_in_vma(page, vma)))
                                 continue;       /* must visit all vmas */
                         ret = SWAP_MLOCK;
                 } else {
diff --git a/mm/shmem.c b/mm/shmem.c
index 5d0de96c978..19d566ccdee 100644
--- a/mm/shmem.c
+++ b/mm/shmem.c
@@ -2628,7 +2628,7 @@ struct file *shmem_file_setup(char *name, loff_t size, unsigned long flags)
                 goto close_file;
 
 #ifdef CONFIG_SHMEM
-        SHMEM_I(inode)->flags = flags & VM_ACCOUNT;
+        SHMEM_I(inode)->flags = (flags & VM_NORESERVE) ? 0 : VM_ACCOUNT;
 #endif
         d_instantiate(dentry, inode);
         inode->i_size = size;
diff --git a/mm/slab.c b/mm/slab.c
index ddc41f337d5..4d00855629c 100644
--- a/mm/slab.c
+++ b/mm/slab.c
@@ -4457,3 +4457,4 @@ size_t ksize(const void *objp)
 
         return obj_size(virt_to_cache(objp));
 }
+EXPORT_SYMBOL(ksize);
diff --git a/mm/slob.c b/mm/slob.c
index bf7e8fc3aed..52bc8a2bd9e 100644
--- a/mm/slob.c
+++ b/mm/slob.c
@@ -521,6 +521,7 @@ size_t ksize(const void *block)
         } else
                 return sp->page.private;
 }
+EXPORT_SYMBOL(ksize);
 
 struct kmem_cache {
         unsigned int size, align;
diff --git a/mm/slub.c b/mm/slub.c
index 6392ae5cc6b..0280eee6cf3 100644
--- a/mm/slub.c
+++ b/mm/slub.c
@@ -1996,7 +1996,7 @@ static struct kmem_cache_cpu *alloc_kmem_cache_cpu(struct kmem_cache *s,
 static void free_kmem_cache_cpu(struct kmem_cache_cpu *c, int cpu)
 {
         if (c < per_cpu(kmem_cache_cpu, cpu) ||
-                        c > per_cpu(kmem_cache_cpu, cpu) + NR_KMEM_CACHE_CPU) {
+                        c >= per_cpu(kmem_cache_cpu, cpu) + NR_KMEM_CACHE_CPU) {
                 kfree(c);
                 return;
         }
@@ -2736,6 +2736,7 @@ size_t ksize(const void *object)
          */
         return s->size;
 }
+EXPORT_SYMBOL(ksize);
 
 void kfree(const void *x)
 {
diff --git a/net/9p/protocol.c b/net/9p/protocol.c
index dcd7666824b..fc70147c771 100644
--- a/net/9p/protocol.c
+++ b/net/9p/protocol.c
@@ -29,6 +29,7 @@
 #include <linux/errno.h>
 #include <linux/uaccess.h>
 #include <linux/sched.h>
+#include <linux/types.h>
 #include <net/9p/9p.h>
 #include <net/9p/client.h>
 #include "protocol.h"
@@ -160,29 +161,32 @@ p9pdu_vreadf(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         break;
                 case 'w':{
                                 int16_t *val = va_arg(ap, int16_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le16 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le16(*val);
+                                *val = le16_to_cpu(le_val);
                         }
                         break;
                 case 'd':{
                                 int32_t *val = va_arg(ap, int32_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le32 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le32(*val);
+                                *val = le32_to_cpu(le_val);
                         }
                         break;
                 case 'q':{
                                 int64_t *val = va_arg(ap, int64_t *);
-                                if (pdu_read(pdu, val, sizeof(*val))) {
+                                __le64 le_val;
+                                if (pdu_read(pdu, &le_val, sizeof(le_val))) {
                                         errcode = -EFAULT;
                                         break;
                                 }
-                                *val = cpu_to_le64(*val);
+                                *val = le64_to_cpu(le_val);
                         }
                         break;
                 case 's':{
@@ -362,19 +366,19 @@ p9pdu_vwritef(struct p9_fcall *pdu, int optional, const char *fmt, va_list ap)
                         }
                         break;
                 case 'w':{
-                                int16_t val = va_arg(ap, int);
+                                __le16 val = cpu_to_le16(va_arg(ap, int));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
                         break;
                 case 'd':{
-                                int32_t val = va_arg(ap, int32_t);
+                                __le32 val = cpu_to_le32(va_arg(ap, int32_t));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
                         break;
                 case 'q':{
-                                int64_t val = va_arg(ap, int64_t);
+                                __le64 val = cpu_to_le64(va_arg(ap, int64_t));
                                 if (pdu_write(pdu, &val, sizeof(val)))
                                         errcode = -EFAULT;
                         }
diff --git a/net/bridge/br_forward.c b/net/bridge/br_forward.c
index bdd9ccea17c..d2c27c808d3 100644
--- a/net/bridge/br_forward.c
+++ b/net/bridge/br_forward.c
@@ -67,6 +67,11 @@ static void __br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
         struct net_device *indev;
 
+        if (skb_warn_if_lro(skb)) {
+                kfree_skb(skb);
+                return;
+        }
+
         indev = skb->dev;
         skb->dev = to->dev;
         skb_forward_csum(skb);
@@ -89,7 +94,7 @@ void br_deliver(const struct net_bridge_port *to, struct sk_buff *skb)
 /* called with rcu_read_lock */
 void br_forward(const struct net_bridge_port *to, struct sk_buff *skb)
 {
-        if (!skb_warn_if_lro(skb) && should_deliver(to, skb)) {
+        if (should_deliver(to, skb)) {
                 __br_forward(to, skb);
                 return;
         }
diff --git a/net/core/dev.c b/net/core/dev.c
index 5379b0c1190..a17e0066236 100644
--- a/net/core/dev.c
+++ b/net/core/dev.c
@@ -1090,7 +1090,7 @@ int dev_open(struct net_device *dev)
                 /*
                  *      Enable NET_DMA
                  */
-                dmaengine_get();
+                net_dmaengine_get();
 
                 /*
                  *      Initialize multicasting status
@@ -1172,7 +1172,7 @@ int dev_close(struct net_device *dev)
         /*
          *      Shutdown NET_DMA
          */
-        dmaengine_put();
+        net_dmaengine_put();
 
         return 0;
 }
diff --git a/net/core/neighbour.c b/net/core/neighbour.c
index f66c58df895..278a142d104 100644
--- a/net/core/neighbour.c
+++ b/net/core/neighbour.c
@@ -1994,8 +1994,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                         if (!net_eq(neigh_parms_net(p), net))
                                 continue;
 
-                        if (nidx++ < neigh_skip)
-                                continue;
+                        if (nidx < neigh_skip)
+                                goto next;
 
                         if (neightbl_fill_param_info(skb, tbl, p,
                                                      NETLINK_CB(cb->skb).pid,
@@ -2003,6 +2003,8 @@ static int neightbl_dump_info(struct sk_buff *skb, struct netlink_callback *cb)
                                                      RTM_NEWNEIGHTBL,
                                                      NLM_F_MULTI) <= 0)
                                 goto out;
+                next:
+                        nidx++;
                 }
 
                 neigh_skip = 0;
@@ -2082,12 +2084,10 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                 if (h > s_h)
                         s_idx = 0;
                 for (n = tbl->hash_buckets[h], idx = 0; n; n = n->next) {
-                        int lidx;
                         if (dev_net(n->dev) != net)
                                 continue;
-                        lidx = idx++;
-                        if (lidx < s_idx)
-                                continue;
+                        if (idx < s_idx)
+                                goto next;
                         if (neigh_fill_info(skb, n, NETLINK_CB(cb->skb).pid,
                                             cb->nlh->nlmsg_seq,
                                             RTM_NEWNEIGH,
@@ -2096,6 +2096,8 @@ static int neigh_dump_table(struct neigh_table *tbl, struct sk_buff *skb,
                                 rc = -1;
                                 goto out;
                         }
+                next:
+                        idx++;
                 }
         }
         read_unlock_bh(&tbl->lock);
diff --git a/net/core/skbuff.c b/net/core/skbuff.c
index 2e5f2ca3bdc..da74b844f4e 100644
--- a/net/core/skbuff.c
+++ b/net/core/skbuff.c
@@ -2212,10 +2212,10 @@ unsigned int skb_seq_read(unsigned int consumed, const u8 **data,
                 return 0;
 
 next_skb:
-        block_limit = skb_headlen(st->cur_skb);
+        block_limit = skb_headlen(st->cur_skb) + st->stepped_offset;
 
         if (abs_offset < block_limit) {
-                *data = st->cur_skb->data + abs_offset;
+                *data = st->cur_skb->data + (abs_offset - st->stepped_offset);
                 return block_limit - abs_offset;
         }
 
@@ -2250,13 +2250,14 @@ next_skb:
                 st->frag_data = NULL;
         }
 
-        if (st->cur_skb->next) {
-                st->cur_skb = st->cur_skb->next;
+        if (st->root_skb == st->cur_skb &&
+            skb_shinfo(st->root_skb)->frag_list) {
+                st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
                 st->frag_idx = 0;
                 goto next_skb;
-        } else if (st->root_skb == st->cur_skb &&
-                   skb_shinfo(st->root_skb)->frag_list) {
-                st->cur_skb = skb_shinfo(st->root_skb)->frag_list;
+        } else if (st->cur_skb->next) {
+                st->cur_skb = st->cur_skb->next;
+                st->frag_idx = 0;
                 goto next_skb;
         }
 
diff --git a/net/ipv4/ipconfig.c b/net/ipv4/ipconfig.c
index 42a0f3dd3fd..d722013c1ca 100644
--- a/net/ipv4/ipconfig.c
+++ b/net/ipv4/ipconfig.c
@@ -1268,6 +1268,9 @@ __be32 __init root_nfs_parse_addr(char *name)
 static int __init ip_auto_config(void)
 {
         __be32 addr;
+#ifdef IPCONFIG_DYNAMIC
+        int retries = CONF_OPEN_RETRIES;
+#endif
 
 #ifdef CONFIG_PROC_FS
         proc_net_fops_create(&init_net, "pnp", S_IRUGO, &pnp_seq_fops);
@@ -1304,9 +1307,6 @@ static int __init ip_auto_config(void)
 #endif
             ic_first_dev->next) {
 #ifdef IPCONFIG_DYNAMIC
-
-                int retries = CONF_OPEN_RETRIES;
-
                 if (ic_dynamic() < 0) {
                         ic_close_devs();
 
diff --git a/net/ipv4/tcp.c b/net/ipv4/tcp.c
index 0cd71b84e48..76b148bcb0d 100644
--- a/net/ipv4/tcp.c
+++ b/net/ipv4/tcp.c
@@ -524,7 +524,8 @@ static int tcp_splice_data_recv(read_descriptor_t *rd_desc, struct sk_buff *skb,
         struct tcp_splice_state *tss = rd_desc->arg.data;
         int ret;
 
-        ret = skb_splice_bits(skb, offset, tss->pipe, rd_desc->count, tss->flags);
+        ret = skb_splice_bits(skb, offset, tss->pipe, min(rd_desc->count, len),
+                              tss->flags);
         if (ret > 0)
                 rd_desc->count -= ret;
         return ret;
diff --git a/net/ipv4/tcp_output.c b/net/ipv4/tcp_output.c
index 557fe16cbfb..dda42f0bd7a 100644
--- a/net/ipv4/tcp_output.c
+++ b/net/ipv4/tcp_output.c
@@ -663,14 +663,10 @@ static int tcp_transmit_skb(struct sock *sk, struct sk_buff *skb, int clone_it,
         th->urg_ptr             = 0;
 
         /* The urg_mode check is necessary during a below snd_una win probe */
-        if (unlikely(tcp_urg_mode(tp))) {
-                if (between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF)) {
-                        th->urg_ptr = htons(tp->snd_up - tcb->seq);
-                        th->urg = 1;
-                } else if (after(tcb->seq + 0xFFFF, tp->snd_nxt)) {
-                        th->urg_ptr = 0xFFFF;
-                        th->urg = 1;
-                }
+        if (unlikely(tcp_urg_mode(tp) &&
+                     between(tp->snd_up, tcb->seq + 1, tcb->seq + 0xFFFF))) {
+                th->urg_ptr             = htons(tp->snd_up - tcb->seq);
+                th->urg                 = 1;
         }
 
         tcp_options_write((__be32 *)(th + 1), tp, &opts, &md5_hash_location);
diff --git a/net/ipv4/udp.c b/net/ipv4/udp.c
index cf5ab0581eb..c47c989cb1f 100644
--- a/net/ipv4/udp.c
+++ b/net/ipv4/udp.c
@@ -120,8 +120,11 @@ EXPORT_SYMBOL(sysctl_udp_wmem_min);
 atomic_t udp_memory_allocated;
 EXPORT_SYMBOL(udp_memory_allocated);
 
+#define PORTS_PER_CHAIN (65536 / UDP_HTABLE_SIZE)
+
 static int udp_lib_lport_inuse(struct net *net, __u16 num,
                                const struct udp_hslot *hslot,
+                               unsigned long *bitmap,
                                struct sock *sk,
                                int (*saddr_comp)(const struct sock *sk1,
                                                  const struct sock *sk2))
@@ -132,12 +135,17 @@ static int udp_lib_lport_inuse(struct net *net, __u16 num,
         sk_nulls_for_each(sk2, node, &hslot->head)
                 if (net_eq(sock_net(sk2), net)                  &&
                     sk2 != sk                                   &&
-                    sk2->sk_hash == num                         &&
+                    (bitmap || sk2->sk_hash == num)             &&
                     (!sk2->sk_reuse || !sk->sk_reuse)           &&
                     (!sk2->sk_bound_dev_if || !sk->sk_bound_dev_if
                         || sk2->sk_bound_dev_if == sk->sk_bound_dev_if) &&
-                    (*saddr_comp)(sk, sk2))
-                        return 1;
+                    (*saddr_comp)(sk, sk2)) {
+                        if (bitmap)
+                                __set_bit(sk2->sk_hash / UDP_HTABLE_SIZE,
+                                          bitmap);
+                        else
+                                return 1;
+                }
         return 0;
 }
 
@@ -160,32 +168,47 @@ int udp_lib_get_port(struct sock *sk, unsigned short snum,
         if (!snum) {
                 int low, high, remaining;
                 unsigned rand;
-                unsigned short first;
+                unsigned short first, last;
+                DECLARE_BITMAP(bitmap, PORTS_PER_CHAIN);
 
                 inet_get_local_port_range(&low, &high);
                 remaining = (high - low) + 1;
 
                 rand = net_random();
-                snum = first = rand % remaining + low;
-                rand |= 1;
-                for (;;) {
-                        hslot = &udptable->hash[udp_hashfn(net, snum)];
+                first = (((u64)rand * remaining) >> 32) + low;
+                /*
+                 * force rand to be an odd multiple of UDP_HTABLE_SIZE
+                 */
+                rand = (rand | 1) * UDP_HTABLE_SIZE;
+                for (last = first + UDP_HTABLE_SIZE; first != last; first++) {
+                        hslot = &udptable->hash[udp_hashfn(net, first)];
+                        bitmap_zero(bitmap, PORTS_PER_CHAIN);
                         spin_lock_bh(&hslot->lock);
-                        if (!udp_lib_lport_inuse(net, snum, hslot, sk, saddr_comp))
-                                break;
-                        spin_unlock_bh(&hslot->lock);
+                        udp_lib_lport_inuse(net, snum, hslot, bitmap, sk,
+                                            saddr_comp);
+
+                        snum = first;
+                        /*
+                         * Iterate on all possible values of snum for this hash.
+                         * Using steps of an odd multiple of UDP_HTABLE_SIZE
+                         * give us randomization and full range coverage.
+                         */
                         do {
-                                snum = snum + rand;
-                        } while (snum < low || snum > high);
-                        if (snum == first)
-                                goto fail;
+                                if (low <= snum && snum <= high &&
+                                    !test_bit(snum / UDP_HTABLE_SIZE, bitmap))
+                                        goto found;
+                                snum += rand;
+                        } while (snum != first);
+                        spin_unlock_bh(&hslot->lock);
                 }
+                goto fail;
         } else {
                 hslot = &udptable->hash[udp_hashfn(net, snum)];
                 spin_lock_bh(&hslot->lock);
-                if (udp_lib_lport_inuse(net, snum, hslot, sk, saddr_comp))
+                if (udp_lib_lport_inuse(net, snum, hslot, NULL, sk, saddr_comp))
                         goto fail_unlock;
         }
+found:
         inet_sk(sk)->num = snum;
         sk->sk_hash = snum;
         if (sk_unhashed(sk)) {
@@ -992,9 +1015,11 @@ static int __udp_queue_rcv_skb(struct sock *sk, struct sk_buff *skb)
 
         if ((rc = sock_queue_rcv_skb(sk, skb)) < 0) {
                 /* Note that an ENOMEM error is charged twice */
-                if (rc == -ENOMEM)
+                if (rc == -ENOMEM) {
                         UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
                                          is_udplite);
+                        atomic_inc(&sk->sk_drops);
+                }
                 goto drop;
         }
 
@@ -1206,11 +1231,10 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
                    int proto)
 {
         struct sock *sk;
-        struct udphdr *uh = udp_hdr(skb);
+        struct udphdr *uh;
         unsigned short ulen;
         struct rtable *rt = (struct rtable*)skb->dst;
-        __be32 saddr = ip_hdr(skb)->saddr;
-        __be32 daddr = ip_hdr(skb)->daddr;
+        __be32 saddr, daddr;
         struct net *net = dev_net(skb->dev);
 
         /*
@@ -1219,6 +1243,7 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (!pskb_may_pull(skb, sizeof(struct udphdr)))
                 goto drop;              /* No space for header. */
 
+        uh   = udp_hdr(skb);
         ulen = ntohs(uh->len);
         if (ulen > skb->len)
                 goto short_packet;
@@ -1233,6 +1258,9 @@ int __udp4_lib_rcv(struct sk_buff *skb, struct udp_table *udptable,
         if (udp4_csum_init(skb, uh, proto))
                 goto csum_error;
 
+        saddr = ip_hdr(skb)->saddr;
+        daddr = ip_hdr(skb)->daddr;
+
         if (rt->rt_flags & (RTCF_BROADCAST|RTCF_MULTICAST))
                 return __udp4_lib_mcast_deliver(net, skb, uh,
                                 saddr, daddr, udptable);
diff --git a/net/ipv6/addrconf.c b/net/ipv6/addrconf.c
index e92ad8455c6..f9afb452249 100644
--- a/net/ipv6/addrconf.c
+++ b/net/ipv6/addrconf.c
@@ -4250,7 +4250,7 @@ static struct addrconf_sysctl_table
                         .procname       =       "mc_forwarding",
                         .data           =       &ipv6_devconf.mc_forwarding,
                         .maxlen         =       sizeof(int),
-                        .mode           =       0644,
+                        .mode           =       0444,
                         .proc_handler   =       proc_dointvec,
                 },
 #endif
diff --git a/net/ipv6/icmp.c b/net/ipv6/icmp.c
index 4f433847d95..36dff880718 100644
--- a/net/ipv6/icmp.c
+++ b/net/ipv6/icmp.c
@@ -443,10 +443,10 @@ void icmpv6_send(struct sk_buff *skb, int type, int code, __u32 info,
         if (xfrm_decode_session_reverse(skb, &fl2, AF_INET6))
                 goto relookup_failed;
 
-        if (ip6_dst_lookup(sk, &dst2, &fl))
+        if (ip6_dst_lookup(sk, &dst2, &fl2))
                 goto relookup_failed;
 
-        err = xfrm_lookup(net, &dst2, &fl, sk, XFRM_LOOKUP_ICMP);
+        err = xfrm_lookup(net, &dst2, &fl2, sk, XFRM_LOOKUP_ICMP);
         switch (err) {
         case 0:
                 dst_release(dst);
diff --git a/net/ipv6/ip6_flowlabel.c b/net/ipv6/ip6_flowlabel.c
index c62dd247774..7712578bdc6 100644
--- a/net/ipv6/ip6_flowlabel.c
+++ b/net/ipv6/ip6_flowlabel.c
@@ -323,17 +323,21 @@ static struct ip6_flowlabel *
 fl_create(struct net *net, struct in6_flowlabel_req *freq, char __user *optval,
           int optlen, int *err_p)
 {
-        struct ip6_flowlabel *fl;
+        struct ip6_flowlabel *fl = NULL;
         int olen;
         int addr_type;
         int err;
 
+        olen = optlen - CMSG_ALIGN(sizeof(*freq));
+        err = -EINVAL;
+        if (olen > 64 * 1024)
+                goto done;
+
         err = -ENOMEM;
         fl = kzalloc(sizeof(*fl), GFP_KERNEL);
         if (fl == NULL)
                 goto done;
 
-        olen = optlen - CMSG_ALIGN(sizeof(*freq));
         if (olen > 0) {
                 struct msghdr msg;
                 struct flowi flowi;
diff --git a/net/ipv6/ip6_input.c b/net/ipv6/ip6_input.c
index 936f48946e2..f171e8dbac9 100644
--- a/net/ipv6/ip6_input.c
+++ b/net/ipv6/ip6_input.c
@@ -255,6 +255,7 @@ int ip6_mc_input(struct sk_buff *skb)
          *      IPv6 multicast router mode is now supported ;)
          */
         if (dev_net(skb->dev)->ipv6.devconf_all->mc_forwarding &&
+            !(ipv6_addr_type(&hdr->daddr) & IPV6_ADDR_LINKLOCAL) &&
             likely(!(IP6CB(skb)->flags & IP6SKB_FORWARDED))) {
                 /*
                  * Okay, we try to forward - split and duplicate
@@ -316,7 +317,6 @@ int ip6_mc_input(struct sk_buff *skb)
                 }
 
                 if (skb2) {
-                        skb2->dev = skb2->dst->dev;
                         ip6_mr_input(skb2);
                 }
         }
diff --git a/net/ipv6/ip6_output.c b/net/ipv6/ip6_output.c
index 4b15938bef4..9fb49c3b518 100644
--- a/net/ipv6/ip6_output.c
+++ b/net/ipv6/ip6_output.c
@@ -1105,6 +1105,18 @@ static inline int ip6_ufo_append_data(struct sock *sk,
         return err;
 }
 
+static inline struct ipv6_opt_hdr *ip6_opt_dup(struct ipv6_opt_hdr *src,
+                                               gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
+static inline struct ipv6_rt_hdr *ip6_rthdr_dup(struct ipv6_rt_hdr *src,
+                                                gfp_t gfp)
+{
+        return src ? kmemdup(src, (src->hdrlen + 1) * 8, gfp) : NULL;
+}
+
 int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         int offset, int len, int odd, struct sk_buff *skb),
         void *from, int length, int transhdrlen,
@@ -1130,17 +1142,37 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
                  * setup for corking
                  */
                 if (opt) {
-                        if (np->cork.opt == NULL) {
-                                np->cork.opt = kmalloc(opt->tot_len,
-                                                       sk->sk_allocation);
-                                if (unlikely(np->cork.opt == NULL))
-                                        return -ENOBUFS;
-                        } else if (np->cork.opt->tot_len < opt->tot_len) {
-                                printk(KERN_DEBUG "ip6_append_data: invalid option length\n");
+                        if (WARN_ON(np->cork.opt))
                                 return -EINVAL;
-                        }
-                        memcpy(np->cork.opt, opt, opt->tot_len);
-                        inet->cork.flags |= IPCORK_OPT;
+
+                        np->cork.opt = kmalloc(opt->tot_len, sk->sk_allocation);
+                        if (unlikely(np->cork.opt == NULL))
+                                return -ENOBUFS;
+
+                        np->cork.opt->tot_len = opt->tot_len;
+                        np->cork.opt->opt_flen = opt->opt_flen;
+                        np->cork.opt->opt_nflen = opt->opt_nflen;
+
+                        np->cork.opt->dst0opt = ip6_opt_dup(opt->dst0opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst0opt && !np->cork.opt->dst0opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->dst1opt = ip6_opt_dup(opt->dst1opt,
+                                                            sk->sk_allocation);
+                        if (opt->dst1opt && !np->cork.opt->dst1opt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->hopopt = ip6_opt_dup(opt->hopopt,
+                                                           sk->sk_allocation);
+                        if (opt->hopopt && !np->cork.opt->hopopt)
+                                return -ENOBUFS;
+
+                        np->cork.opt->srcrt = ip6_rthdr_dup(opt->srcrt,
+                                                            sk->sk_allocation);
+                        if (opt->srcrt && !np->cork.opt->srcrt)
+                                return -ENOBUFS;
+
                         /* need source address above miyazawa*/
                 }
                 dst_hold(&rt->u.dst);
@@ -1167,8 +1199,7 @@ int ip6_append_data(struct sock *sk, int getfrag(void *from, char *to,
         } else {
                 rt = (struct rt6_info *)inet->cork.dst;
                 fl = &inet->cork.fl;
-                if (inet->cork.flags & IPCORK_OPT)
-                        opt = np->cork.opt;
+                opt = np->cork.opt;
                 transhdrlen = 0;
                 exthdrlen = 0;
                 mtu = inet->cork.fragsize;
@@ -1407,9 +1438,15 @@ error:
 
 static void ip6_cork_release(struct inet_sock *inet, struct ipv6_pinfo *np)
 {
-        inet->cork.flags &= ~IPCORK_OPT;
-        kfree(np->cork.opt);
-        np->cork.opt = NULL;
+        if (np->cork.opt) {
+                kfree(np->cork.opt->dst0opt);
+                kfree(np->cork.opt->dst1opt);
+                kfree(np->cork.opt->hopopt);
+                kfree(np->cork.opt->srcrt);
+                kfree(np->cork.opt);
+                np->cork.opt = NULL;
+        }
+
         if (inet->cork.dst) {
                 dst_release(inet->cork.dst);
                 inet->cork.dst = NULL;
diff --git a/net/ipv6/ip6_tunnel.c b/net/ipv6/ip6_tunnel.c
index 58e2b0d9375..d994c55a5b1 100644
--- a/net/ipv6/ip6_tunnel.c
+++ b/net/ipv6/ip6_tunnel.c
@@ -249,8 +249,8 @@ static struct ip6_tnl *ip6_tnl_create(struct net *net, struct ip6_tnl_parm *p)
         }
 
         t = netdev_priv(dev);
-        ip6_tnl_dev_init(dev);
         t->parms = *p;
+        ip6_tnl_dev_init(dev);
 
         if ((err = register_netdevice(dev)) < 0)
                 goto failed_free;
diff --git a/net/ipv6/ip6mr.c b/net/ipv6/ip6mr.c
index 3c51b2d827f..228be551e9c 100644
--- a/net/ipv6/ip6mr.c
+++ b/net/ipv6/ip6mr.c
@@ -48,6 +48,7 @@
 #include <linux/pim.h>
 #include <net/addrconf.h>
 #include <linux/netfilter_ipv6.h>
+#include <net/ip6_checksum.h>
 
 /* Big lock, protecting vif table, mrt cache and mroute socket state.
    Note that the changes are semaphored via rtnl_lock.
@@ -365,7 +366,9 @@ static int pim6_rcv(struct sk_buff *skb)
         pim = (struct pimreghdr *)skb_transport_header(skb);
         if (pim->type != ((PIM_VERSION << 4) | PIM_REGISTER) ||
             (pim->flags & PIM_NULL_REGISTER) ||
-            (ip_compute_csum((void *)pim, sizeof(*pim)) != 0 &&
+            (csum_ipv6_magic(&ipv6_hdr(skb)->saddr, &ipv6_hdr(skb)->daddr,
+                             sizeof(*pim), IPPROTO_PIM,
+                             csum_partial((void *)pim, sizeof(*pim), 0)) &&
              csum_fold(skb_checksum(skb, 0, skb->len, 0))))
                 goto drop;
 
@@ -392,7 +395,7 @@ static int pim6_rcv(struct sk_buff *skb)
         skb_pull(skb, (u8 *)encap - skb->data);
         skb_reset_network_header(skb);
         skb->dev = reg_dev;
-        skb->protocol = htons(ETH_P_IP);
+        skb->protocol = htons(ETH_P_IPV6);
         skb->ip_summed = 0;
         skb->pkt_type = PACKET_HOST;
         dst_release(skb->dst);
@@ -481,6 +484,7 @@ static int mif6_delete(struct net *net, int vifi)
 {
         struct mif_device *v;
         struct net_device *dev;
+        struct inet6_dev *in6_dev;
         if (vifi < 0 || vifi >= net->ipv6.maxvif)
                 return -EADDRNOTAVAIL;
 
@@ -513,6 +517,10 @@ static int mif6_delete(struct net *net, int vifi)
 
         dev_set_allmulti(dev, -1);
 
+        in6_dev = __in6_dev_get(dev);
+        if (in6_dev)
+                in6_dev->cnf.mc_forwarding--;
+
         if (v->flags & MIFF_REGISTER)
                 unregister_netdevice(dev);
 
@@ -622,6 +630,7 @@ static int mif6_add(struct net *net, struct mif6ctl *vifc, int mrtsock)
         int vifi = vifc->mif6c_mifi;
         struct mif_device *v = &net->ipv6.vif6_table[vifi];
         struct net_device *dev;
+        struct inet6_dev *in6_dev;
         int err;
 
         /* Is vif busy ? */
@@ -662,6 +671,10 @@ static int mif6_add(struct net *net, struct mif6ctl *vifc, int mrtsock)
                 return -EINVAL;
         }
 
+        in6_dev = __in6_dev_get(dev);
+        if (in6_dev)
+                in6_dev->cnf.mc_forwarding++;
+
         /*
          *      Fill in the VIF structures
          */
@@ -838,8 +851,6 @@ static int ip6mr_cache_report(struct net *net, struct sk_buff *pkt, mifi_t mifi,
 
         skb->dst = dst_clone(pkt->dst);
         skb->ip_summed = CHECKSUM_UNNECESSARY;
-
-        skb_pull(skb, sizeof(struct ipv6hdr));
         }
 
         if (net->ipv6.mroute6_sk == NULL) {
@@ -1222,8 +1233,10 @@ static int ip6mr_sk_init(struct sock *sk)
 
         rtnl_lock();
         write_lock_bh(&mrt_lock);
-        if (likely(net->ipv6.mroute6_sk == NULL))
+        if (likely(net->ipv6.mroute6_sk == NULL)) {
                 net->ipv6.mroute6_sk = sk;
+                net->ipv6.devconf_all->mc_forwarding++;
+        }
         else
                 err = -EADDRINUSE;
         write_unlock_bh(&mrt_lock);
@@ -1242,6 +1255,7 @@ int ip6mr_sk_done(struct sock *sk)
         if (sk == net->ipv6.mroute6_sk) {
                 write_lock_bh(&mrt_lock);
                 net->ipv6.mroute6_sk = NULL;
+                net->ipv6.devconf_all->mc_forwarding--;
                 write_unlock_bh(&mrt_lock);
 
                 mroute_clean_tables(net);
diff --git a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
index c455cf4ee75..c323643ffcf 100644
--- a/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
+++ b/net/ipv6/netfilter/nf_conntrack_proto_icmpv6.c
@@ -49,8 +49,19 @@ static bool icmpv6_pkt_to_tuple(const struct sk_buff *skb,
 static const u_int8_t invmap[] = {
         [ICMPV6_ECHO_REQUEST - 128]     = ICMPV6_ECHO_REPLY + 1,
         [ICMPV6_ECHO_REPLY - 128]       = ICMPV6_ECHO_REQUEST + 1,
-        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_QUERY + 1,
-        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_REPLY +1
+        [ICMPV6_NI_QUERY - 128]         = ICMPV6_NI_REPLY + 1,
+        [ICMPV6_NI_REPLY - 128]         = ICMPV6_NI_QUERY +1
+};
+
+static const u_int8_t noct_valid_new[] = {
+        [ICMPV6_MGM_QUERY - 130] = 1,
+        [ICMPV6_MGM_REPORT -130] = 1,
+        [ICMPV6_MGM_REDUCTION - 130] = 1,
+        [NDISC_ROUTER_SOLICITATION - 130] = 1,
+        [NDISC_ROUTER_ADVERTISEMENT - 130] = 1,
+        [NDISC_NEIGHBOUR_SOLICITATION - 130] = 1,
+        [NDISC_NEIGHBOUR_ADVERTISEMENT - 130] = 1,
+        [ICMPV6_MLD2_REPORT - 130] = 1
 };
 
 static bool icmpv6_invert_tuple(struct nf_conntrack_tuple *tuple,
@@ -178,6 +189,7 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
 {
         const struct icmp6hdr *icmp6h;
         struct icmp6hdr _ih;
+        int type;
 
         icmp6h = skb_header_pointer(skb, dataoff, sizeof(_ih), &_ih);
         if (icmp6h == NULL) {
@@ -194,6 +206,15 @@ icmpv6_error(struct net *net, struct sk_buff *skb, unsigned int dataoff,
                 return -NF_ACCEPT;
         }
 
+        type = icmp6h->icmp6_type - 130;
+        if (type >= 0 && type < sizeof(noct_valid_new) &&
+            noct_valid_new[type]) {
+                skb->nfct = &nf_conntrack_untracked.ct_general;
+                skb->nfctinfo = IP_CT_NEW;
+                nf_conntrack_get(skb->nfct);
+                return NF_ACCEPT;
+        }
+
         /* is not error message ? */
         if (icmp6h->icmp6_type >= 128)
                 return NF_ACCEPT;
diff --git a/net/ipv6/route.c b/net/ipv6/route.c
index c4a59824ac2..9c574235c90 100644
--- a/net/ipv6/route.c
+++ b/net/ipv6/route.c
@@ -794,7 +794,7 @@ void ip6_route_input(struct sk_buff *skb)
                 .proto = iph->nexthdr,
         };
 
-        if (rt6_need_strict(&iph->daddr))
+        if (rt6_need_strict(&iph->daddr) && skb->dev->type != ARPHRD_PIMREG)
                 flags |= RT6_LOOKUP_F_IFACE;
 
         skb->dst = fib6_rule_lookup(net, &fl, flags, ip6_pol_route_input);
diff --git a/net/netfilter/nf_conntrack_netlink.c b/net/netfilter/nf_conntrack_netlink.c
index c32a7e8e3a1..cb78aa00399 100644
--- a/net/netfilter/nf_conntrack_netlink.c
+++ b/net/netfilter/nf_conntrack_netlink.c
@@ -434,7 +434,7 @@ static int ctnetlink_conntrack_event(struct notifier_block *this,
         } else
                 return NOTIFY_DONE;
 
-        if (!nfnetlink_has_listeners(group))
+        if (!item->report && !nfnetlink_has_listeners(group))
                 return NOTIFY_DONE;
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
@@ -1215,6 +1215,16 @@ ctnetlink_create_conntrack(struct nlattr *cda[],
                 }
         }
 
+#ifdef CONFIG_NF_NAT_NEEDED
+        if (cda[CTA_NAT_SEQ_ADJ_ORIG] || cda[CTA_NAT_SEQ_ADJ_REPLY]) {
+                err = ctnetlink_change_nat_seq_adj(ct, cda);
+                if (err < 0) {
+                        rcu_read_unlock();
+                        goto err;
+                }
+        }
+#endif
+
         if (cda[CTA_PROTOINFO]) {
                 err = ctnetlink_change_protoinfo(ct, cda);
                 if (err < 0) {
@@ -1492,7 +1502,8 @@ static int ctnetlink_expect_event(struct notifier_block *this,
         } else
                 return NOTIFY_DONE;
 
-        if (!nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
+        if (!item->report &&
+            !nfnetlink_has_listeners(NFNLGRP_CONNTRACK_EXP_NEW))
                 return NOTIFY_DONE;
 
         skb = alloc_skb(NLMSG_GOODSIZE, GFP_ATOMIC);
diff --git a/net/netfilter/xt_sctp.c b/net/netfilter/xt_sctp.c
index e223cb43ae8..a189ada9128 100644
--- a/net/netfilter/xt_sctp.c
+++ b/net/netfilter/xt_sctp.c
@@ -105,7 +105,7 @@ match_packet(const struct sk_buff *skb,
 
         switch (chunk_match_type) {
         case SCTP_CHUNK_MATCH_ALL:
-                return SCTP_CHUNKMAP_IS_CLEAR(info->chunkmap);
+                return SCTP_CHUNKMAP_IS_CLEAR(chunkmapcopy);
         case SCTP_CHUNK_MATCH_ANY:
                 return false;
         case SCTP_CHUNK_MATCH_ONLY:
diff --git a/net/packet/af_packet.c b/net/packet/af_packet.c
index 5f94db2f3e9..1fc4a7885c4 100644
--- a/net/packet/af_packet.c
+++ b/net/packet/af_packet.c
@@ -77,6 +77,7 @@
 #include <linux/poll.h>
 #include <linux/module.h>
 #include <linux/init.h>
+#include <linux/mutex.h>
 
 #ifdef CONFIG_INET
 #include <net/inet_common.h>
@@ -175,6 +176,7 @@ struct packet_sock {
 #endif
         struct packet_type      prot_hook;
         spinlock_t              bind_lock;
+        struct mutex            pg_vec_lock;
         unsigned int            running:1,      /* prot_hook is attached*/
                                 auxdata:1,
                                 origdev:1;
@@ -220,13 +222,13 @@ static void *packet_lookup_frame(struct packet_sock *po, unsigned int position,
         h.raw = po->pg_vec[pg_vec_pos] + (frame_offset * po->frame_size);
         switch (po->tp_version) {
         case TPACKET_V1:
-                if (status != h.h1->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL)
+                if (status != (h.h1->tp_status ? TP_STATUS_USER :
+                                                TP_STATUS_KERNEL))
                         return NULL;
                 break;
         case TPACKET_V2:
-                if (status != h.h2->tp_status ? TP_STATUS_USER :
-                                                TP_STATUS_KERNEL)
+                if (status != (h.h2->tp_status ? TP_STATUS_USER :
+                                                TP_STATUS_KERNEL))
                         return NULL;
                 break;
         }
@@ -1069,6 +1071,7 @@ static int packet_create(struct net *net, struct socket *sock, int protocol)
          */
 
         spin_lock_init(&po->bind_lock);
+        mutex_init(&po->pg_vec_lock);
         po->prot_hook.func = packet_rcv;
 
         if (sock->type == SOCK_PACKET)
@@ -1865,6 +1868,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
         synchronize_net();
 
         err = -EBUSY;
+        mutex_lock(&po->pg_vec_lock);
         if (closing || atomic_read(&po->mapped) == 0) {
                 err = 0;
 #define XC(a, b) ({ __typeof__ ((a)) __t; __t = (a); (a) = (b); __t; })
@@ -1886,6 +1890,7 @@ static int packet_set_ring(struct sock *sk, struct tpacket_req *req, int closing
                 if (atomic_read(&po->mapped))
                         printk(KERN_DEBUG "packet_mmap: vma is busy: %d\n", atomic_read(&po->mapped));
         }
+        mutex_unlock(&po->pg_vec_lock);
 
         spin_lock(&po->bind_lock);
         if (was_running && !po->running) {
@@ -1918,7 +1923,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
 
         size = vma->vm_end - vma->vm_start;
 
-        lock_sock(sk);
+        mutex_lock(&po->pg_vec_lock);
         if (po->pg_vec == NULL)
                 goto out;
         if (size != po->pg_vec_len*po->pg_vec_pages*PAGE_SIZE)
@@ -1941,7 +1946,7 @@ static int packet_mmap(struct file *file, struct socket *sock, struct vm_area_st
         err = 0;
 
 out:
-        release_sock(sk);
+        mutex_unlock(&po->pg_vec_lock);
         return err;
 }
 #endif
diff --git a/net/rxrpc/af_rxrpc.c b/net/rxrpc/af_rxrpc.c
index d7d2bed7a69..eac5e7bb736 100644
--- a/net/rxrpc/af_rxrpc.c
+++ b/net/rxrpc/af_rxrpc.c
@@ -284,13 +284,13 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
                 if (IS_ERR(trans)) {
                         call = ERR_CAST(trans);
                         trans = NULL;
-                        goto out;
+                        goto out_notrans;
                 }
         } else {
                 trans = rx->trans;
                 if (!trans) {
                         call = ERR_PTR(-ENOTCONN);
-                        goto out;
+                        goto out_notrans;
                 }
                 atomic_inc(&trans->usage);
         }
@@ -315,6 +315,7 @@ struct rxrpc_call *rxrpc_kernel_begin_call(struct socket *sock,
         rxrpc_put_bundle(trans, bundle);
 out:
         rxrpc_put_transport(trans);
+out_notrans:
         release_sock(&rx->sk);
         _leave(" = %p", call);
         return call;
diff --git a/net/sunrpc/Kconfig b/net/sunrpc/Kconfig
index dcef600d0bf..5592883e1e4 100644
--- a/net/sunrpc/Kconfig
+++ b/net/sunrpc/Kconfig
@@ -6,7 +6,7 @@ config SUNRPC_GSS
 
 config SUNRPC_XPRT_RDMA
         tristate
-        depends on SUNRPC && INFINIBAND && EXPERIMENTAL
+        depends on SUNRPC && INFINIBAND && INFINIBAND_ADDR_TRANS && EXPERIMENTAL
         default SUNRPC && INFINIBAND
         help
           This option allows the NFS client and server to support
diff --git a/net/wimax/debugfs.c b/net/wimax/debugfs.c
index 87cf4430079..94d216a4640 100644
--- a/net/wimax/debugfs.c
+++ b/net/wimax/debugfs.c
@@ -28,17 +28,6 @@
 #include "debug-levels.h"
 
 
-/* Debug framework control of debug levels */
-struct d_level D_LEVEL[] = {
-        D_SUBMODULE_DEFINE(debugfs),
-        D_SUBMODULE_DEFINE(id_table),
-        D_SUBMODULE_DEFINE(op_msg),
-        D_SUBMODULE_DEFINE(op_reset),
-        D_SUBMODULE_DEFINE(op_rfkill),
-        D_SUBMODULE_DEFINE(stack),
-};
-size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
-
 #define __debugfs_register(prefix, name, parent)                        \
 do {                                                                    \
         result = d_level_register_debugfs(prefix, name, parent);        \
diff --git a/net/wimax/stack.c b/net/wimax/stack.c
index d4da92f8981..3869c032788 100644
--- a/net/wimax/stack.c
+++ b/net/wimax/stack.c
@@ -516,6 +516,19 @@ void wimax_dev_rm(struct wimax_dev *wimax_dev)
 }
 EXPORT_SYMBOL_GPL(wimax_dev_rm);
 
+
+/* Debug framework control of debug levels */
+struct d_level D_LEVEL[] = {
+        D_SUBMODULE_DEFINE(debugfs),
+        D_SUBMODULE_DEFINE(id_table),
+        D_SUBMODULE_DEFINE(op_msg),
+        D_SUBMODULE_DEFINE(op_reset),
+        D_SUBMODULE_DEFINE(op_rfkill),
+        D_SUBMODULE_DEFINE(stack),
+};
+size_t D_LEVEL_SIZE = ARRAY_SIZE(D_LEVEL);
+
+
 struct genl_family wimax_gnl_family = {
         .id = GENL_ID_GENERATE,
         .name = "WiMAX",
diff --git a/net/wireless/reg.c b/net/wireless/reg.c
index bc494cef210..85c9034c59b 100644
--- a/net/wireless/reg.c
+++ b/net/wireless/reg.c
@@ -498,6 +498,7 @@ static struct ieee80211_regdomain *country_ie_2_rd(
          * calculate the number of reg rules we will need. We will need one
          * for each channel subband */
         while (country_ie_len >= 3) {
+                int end_channel = 0;
                 struct ieee80211_country_ie_triplet *triplet =
                         (struct ieee80211_country_ie_triplet *) country_ie;
                 int cur_sub_max_channel = 0, cur_channel = 0;
@@ -509,9 +510,25 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         continue;
                 }
 
+                /* 2 GHz */
+                if (triplet->chans.first_channel <= 14)
+                        end_channel = triplet->chans.first_channel +
+                                triplet->chans.num_channels;
+                else
+                        /*
+                         * 5 GHz -- For example in country IEs if the first
+                         * channel given is 36 and the number of channels is 4
+                         * then the individual channel numbers defined for the
+                         * 5 GHz PHY by these parameters are: 36, 40, 44, and 48
+                         * and not 36, 37, 38, 39.
+                         *
+                         * See: http://tinyurl.com/11d-clarification
+                         */
+                        end_channel =  triplet->chans.first_channel +
+                                (4 * (triplet->chans.num_channels - 1));
+
                 cur_channel = triplet->chans.first_channel;
-                cur_sub_max_channel = ieee80211_channel_to_frequency(
-                        cur_channel + triplet->chans.num_channels);
+                cur_sub_max_channel = end_channel;
 
                 /* Basic sanity check */
                 if (cur_sub_max_channel < cur_channel)
@@ -590,15 +607,6 @@ static struct ieee80211_regdomain *country_ie_2_rd(
                         end_channel = triplet->chans.first_channel +
                                 triplet->chans.num_channels;
                 else
-                        /*
-                         * 5 GHz -- For example in country IEs if the first
-                         * channel given is 36 and the number of channels is 4
-                         * then the individual channel numbers defined for the
-                         * 5 GHz PHY by these parameters are: 36, 40, 44, and 48
-                         * and not 36, 37, 38, 39.
-                         *
-                         * See: http://tinyurl.com/11d-clarification
-                         */
                         end_channel =  triplet->chans.first_channel +
                                 (4 * (triplet->chans.num_channels - 1));
 
@@ -1276,7 +1284,7 @@ static void reg_country_ie_process_debug(
         if (intersected_rd) {
                 printk(KERN_DEBUG "cfg80211: We intersect both of these "
                         "and get:\n");
-                print_regdomain_info(rd);
+                print_regdomain_info(intersected_rd);
                 return;
         }
         printk(KERN_DEBUG "cfg80211: Intersection between both failed\n");
diff --git a/scripts/gcc-x86_32-has-stack-protector.sh b/scripts/gcc-x86_32-has-stack-protector.sh
new file mode 100644
index 00000000000..29493dc4528
--- /dev/null
+++ b/scripts/gcc-x86_32-has-stack-protector.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+if [ "$?" -eq "0" ] ; then
+        echo y
+else
+        echo n
+fi
diff --git a/scripts/gcc-x86_64-has-stack-protector.sh b/scripts/gcc-x86_64-has-stack-protector.sh
index 325c0a1b03b..afaec618b39 100644
--- a/scripts/gcc-x86_64-has-stack-protector.sh
+++ b/scripts/gcc-x86_64-has-stack-protector.sh
@@ -1,6 +1,8 @@
 #!/bin/sh
 
-echo "int foo(void) { char X[200]; return 3; }" | $1 -S -xc -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
+echo "int foo(void) { char X[200]; return 3; }" | $* -S -xc -c -O0 -mcmodel=kernel -fstack-protector - -o - 2> /dev/null | grep -q "%gs"
 if [ "$?" -eq "0" ] ; then
-        echo $2
+        echo y
+else
+        echo n
 fi
diff --git a/scripts/kernel-doc b/scripts/kernel-doc
index 8bb83a100ed..0f11870116d 100755
--- a/scripts/kernel-doc
+++ b/scripts/kernel-doc
@@ -1827,6 +1827,40 @@ sub reset_state {
     $state = 0;
 }
 
+sub syscall_munge() {
+        my $void = 0;
+
+        $prototype =~ s@[\r\n\t]+@ @gos; # strip newlines/CR's/tabs
+##      if ($prototype =~ m/SYSCALL_DEFINE0\s*\(\s*(a-zA-Z0-9_)*\s*\)/) {
+        if ($prototype =~ m/SYSCALL_DEFINE0/) {
+                $void = 1;
+##              $prototype = "long sys_$1(void)";
+        }
+
+        $prototype =~ s/SYSCALL_DEFINE.*\(/long sys_/; # fix return type & func name
+        if ($prototype =~ m/long (sys_.*?),/) {
+                $prototype =~ s/,/\(/;
+        } elsif ($void) {
+                $prototype =~ s/\)/\(void\)/;
+        }
+
+        # now delete all of the odd-number commas in $prototype
+        # so that arg types & arg names don't have a comma between them
+        my $count = 0;
+        my $len = length($prototype);
+        if ($void) {
+                $len = 0;       # skip the for-loop
+        }
+        for (my $ix = 0; $ix < $len; $ix++) {
+                if (substr($prototype, $ix, 1) eq ',') {
+                        $count++;
+                        if ($count % 2 == 1) {
+                                substr($prototype, $ix, 1) = ' ';
+                        }
+                }
+        }
+}
+
 sub process_state3_function($$) {
     my $x = shift;
     my $file = shift;
@@ -1839,11 +1873,15 @@ sub process_state3_function($$) {
     elsif ($x =~ /([^\{]*)/) {
         $prototype .= $1;
     }
+
     if (($x =~ /\{/) || ($x =~ /\#\s*define/) || ($x =~ /;/)) {
         $prototype =~ s@/\*.*?\*/@@gos; # strip comments.
         $prototype =~ s@[\r\n]+@ @gos; # strip newlines/cr's.
         $prototype =~ s@^\s+@@gos; # strip leading spaces
-        dump_function($prototype,$file);
+        if ($prototype =~ /SYSCALL_DEFINE/) {
+                syscall_munge();
+        }
+        dump_function($prototype, $file);
         reset_state();
     }
 }
diff --git a/scripts/mod/modpost.c b/scripts/mod/modpost.c
index 88921611b22..7e62303133d 100644
--- a/scripts/mod/modpost.c
+++ b/scripts/mod/modpost.c
@@ -415,8 +415,9 @@ static int parse_elf(struct elf_info *info, const char *filename)
                 const char *secstrings
                         = (void *)hdr + sechdrs[hdr->e_shstrndx].sh_offset;
                 const char *secname;
+                int nobits = sechdrs[i].sh_type == SHT_NOBITS;
 
-                if (sechdrs[i].sh_offset > info->size) {
+                if (!nobits && sechdrs[i].sh_offset > info->size) {
                         fatal("%s is truncated. sechdrs[i].sh_offset=%lu > "
                               "sizeof(*hrd)=%zu\n", filename,
                               (unsigned long)sechdrs[i].sh_offset,
@@ -425,6 +426,8 @@ static int parse_elf(struct elf_info *info, const char *filename)
                 }
                 secname = secstrings + sechdrs[i].sh_name;
                 if (strcmp(secname, ".modinfo") == 0) {
+                        if (nobits)
+                                fatal("%s has NOBITS .modinfo\n", filename);
                         info->modinfo = (void *)hdr + sechdrs[i].sh_offset;
                         info->modinfo_len = sechdrs[i].sh_size;
                 } else if (strcmp(secname, "__ksymtab") == 0)
diff --git a/sound/arm/aaci.c b/sound/arm/aaci.c
index 89096e811a4..772901e41ec 100644
--- a/sound/arm/aaci.c
+++ b/sound/arm/aaci.c
@@ -90,7 +90,7 @@ static void aaci_ac97_write(struct snd_ac97 *ac97, unsigned short reg,
          */
         do {
                 v = readl(aaci->base + AACI_SLFR);
-        } while ((v & (SLFR_1TXB|SLFR_2TXB)) && timeout--);
+        } while ((v & (SLFR_1TXB|SLFR_2TXB)) && --timeout);
 
         if (!timeout)
                 dev_err(&aaci->dev->dev,
@@ -126,7 +126,7 @@ static unsigned short aaci_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
          */
         do {
                 v = readl(aaci->base + AACI_SLFR);
-        } while ((v & SLFR_1TXB) && timeout--);
+        } while ((v & SLFR_1TXB) && --timeout);
 
         if (!timeout) {
                 dev_err(&aaci->dev->dev, "timeout on slot 1 TX busy\n");
@@ -147,7 +147,7 @@ static unsigned short aaci_ac97_read(struct snd_ac97 *ac97, unsigned short reg)
         do {
                 cond_resched();
                 v = readl(aaci->base + AACI_SLFR) & (SLFR_1RXV|SLFR_2RXV);
-        } while ((v != (SLFR_1RXV|SLFR_2RXV)) && timeout--);
+        } while ((v != (SLFR_1RXV|SLFR_2RXV)) && --timeout);
 
         if (!timeout) {
                 dev_err(&aaci->dev->dev, "timeout on RX valid\n");
diff --git a/sound/core/oss/pcm_oss.c b/sound/core/oss/pcm_oss.c
index e17836680f4..0a1798eafb0 100644
--- a/sound/core/oss/pcm_oss.c
+++ b/sound/core/oss/pcm_oss.c
@@ -1767,7 +1767,7 @@ static int snd_pcm_oss_get_formats(struct snd_pcm_oss_file *pcm_oss_file)
                        AFMT_S8 | AFMT_U16_LE |
                        AFMT_U16_BE |
                         AFMT_S32_LE | AFMT_S32_BE |
-                        AFMT_S24_LE | AFMT_S24_LE |
+                        AFMT_S24_LE | AFMT_S24_BE |
                         AFMT_S24_PACKED;
         params = kmalloc(sizeof(*params), GFP_KERNEL);
         if (!params)
diff --git a/sound/drivers/Kconfig b/sound/drivers/Kconfig
index 0bcf14640fd..84714a65e5c 100644
--- a/sound/drivers/Kconfig
+++ b/sound/drivers/Kconfig
@@ -33,7 +33,7 @@ if SND_DRIVERS
 
 config SND_PCSP
         tristate "PC-Speaker support (READ HELP!)"
-        depends on PCSPKR_PLATFORM && X86_PC && HIGH_RES_TIMERS
+        depends on PCSPKR_PLATFORM && X86 && HIGH_RES_TIMERS
         depends on INPUT
         depends on EXPERIMENTAL
         select SND_PCM
diff --git a/sound/pci/hda/hda_codec.c b/sound/pci/hda/hda_codec.c
index b7bba7dc7cf..0b708134d12 100644
--- a/sound/pci/hda/hda_codec.c
+++ b/sound/pci/hda/hda_codec.c
@@ -487,7 +487,6 @@ int /*__devinit*/ snd_hda_bus_new(struct snd_card *card,
 {
         struct hda_bus *bus;
         int err;
-        char qname[8];
         static struct snd_device_ops dev_ops = {
                 .dev_register = snd_hda_bus_dev_register,
                 .dev_free = snd_hda_bus_dev_free,
@@ -517,10 +516,12 @@ int /*__devinit*/ snd_hda_bus_new(struct snd_card *card,
         mutex_init(&bus->cmd_mutex);
         INIT_LIST_HEAD(&bus->codec_list);
 
-        snprintf(qname, sizeof(qname), "hda%d", card->number);
-        bus->workq = create_workqueue(qname);
+        snprintf(bus->workq_name, sizeof(bus->workq_name),
+                 "hd-audio%d", card->number);
+        bus->workq = create_singlethread_workqueue(bus->workq_name);
         if (!bus->workq) {
-                snd_printk(KERN_ERR "cannot create workqueue %s\n", qname);
+                snd_printk(KERN_ERR "cannot create workqueue %s\n",
+                           bus->workq_name);
                 kfree(bus);
                 return -ENOMEM;
         }
diff --git a/sound/pci/hda/hda_codec.h b/sound/pci/hda/hda_codec.h
index 5810ef58840..09a332ada0c 100644
--- a/sound/pci/hda/hda_codec.h
+++ b/sound/pci/hda/hda_codec.h
@@ -614,6 +614,7 @@ struct hda_bus {
 
         /* unsolicited event queue */
         struct hda_bus_unsolicited *unsol;
+        char workq_name[16];
         struct workqueue_struct *workq; /* common workqueue for codecs */
 
         /* assigned PCMs */
diff --git a/sound/pci/hda/hda_proc.c b/sound/pci/hda/hda_proc.c
index 7ca66d65414..144b85276d5 100644
--- a/sound/pci/hda/hda_proc.c
+++ b/sound/pci/hda/hda_proc.c
@@ -399,7 +399,8 @@ static void print_conn_list(struct snd_info_buffer *buffer,
 {
         int c, curr = -1;
 
-        if (conn_len > 1 && wid_type != AC_WID_AUD_MIX)
+        if (conn_len > 1 && wid_type != AC_WID_AUD_MIX &&
+            wid_type != AC_WID_VOL_KNB)
                 curr = snd_hda_codec_read(codec, nid, 0,
                                           AC_VERB_GET_CONNECT_SEL, 0);
         snd_iprintf(buffer, "  Connection: %d\n", conn_len);
diff --git a/sound/pci/hda/patch_realtek.c b/sound/pci/hda/patch_realtek.c
index 7884a4e0706..ae5c8a0d147 100644
--- a/sound/pci/hda/patch_realtek.c
+++ b/sound/pci/hda/patch_realtek.c
@@ -1037,6 +1037,7 @@ do_sku:
                 case 0x10ec0267:
                 case 0x10ec0268:
                 case 0x10ec0269:
+                case 0x10ec0272:
                 case 0x10ec0660:
                 case 0x10ec0662:
                 case 0x10ec0663:
@@ -1065,6 +1066,7 @@ do_sku:
                 case 0x10ec0882:
                 case 0x10ec0883:
                 case 0x10ec0885:
+                case 0x10ec0887:
                 case 0x10ec0889:
                         snd_hda_codec_write(codec, 0x20, 0,
                                             AC_VERB_SET_COEF_INDEX, 7);
@@ -7012,6 +7014,7 @@ static int patch_alc882(struct hda_codec *codec)
                         break;
                 case 0x106b1000: /* iMac 24 */
                 case 0x106b2800: /* AppleTV */
+                case 0x106b3e00: /* iMac 24 Aluminium */
                         board_config = ALC885_IMAC24;
                         break;
                 case 0x106b00a1: /* Macbook (might be wrong - PCI SSID?) */
@@ -8514,6 +8517,8 @@ static struct snd_pci_quirk alc883_cfg_tbl[] = {
         SND_PCI_QUIRK(0x1558, 0, "Clevo laptop", ALC883_LAPTOP_EAPD),
         SND_PCI_QUIRK(0x15d9, 0x8780, "Supermicro PDSBA", ALC883_3ST_6ch),
         SND_PCI_QUIRK(0x161f, 0x2054, "Medion laptop", ALC883_MEDION),
+        SND_PCI_QUIRK(0x1734, 0x1107, "FSC AMILO Xi2550",
+                      ALC883_FUJITSU_PI2515),
         SND_PCI_QUIRK(0x1734, 0x1108, "Fujitsu AMILO Pi2515", ALC883_FUJITSU_PI2515),
         SND_PCI_QUIRK(0x1734, 0x113d, "Fujitsu AMILO Xa3530",
                 ALC888_FUJITSU_XA3530),
diff --git a/sound/pci/hda/patch_sigmatel.c b/sound/pci/hda/patch_sigmatel.c
index b787b3cc096..38428e22428 100644
--- a/sound/pci/hda/patch_sigmatel.c
+++ b/sound/pci/hda/patch_sigmatel.c
@@ -1804,6 +1804,8 @@ static struct snd_pci_quirk stac92hd71bxx_cfg_tbl[] = {
                       "HP dv4", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x30fc,
                       "HP dv7", STAC_HP_M4),
+        SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3600,
+                      "HP dv5", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x3603,
                       "HP dv5", STAC_HP_DV5),
         SND_PCI_QUIRK(PCI_VENDOR_ID_HP, 0x361a,
diff --git a/sound/pci/intel8x0.c b/sound/pci/intel8x0.c
index 19d3391e229..e900cdc8484 100644
--- a/sound/pci/intel8x0.c
+++ b/sound/pci/intel8x0.c
@@ -617,7 +617,7 @@ static int snd_intel8x0_ali_codec_semaphore(struct intel8x0 *chip)
         int time = 100;
         if (chip->buggy_semaphore)
                 return 0; /* just ignore ... */
-        while (time-- && (igetdword(chip, ICHREG(ALI_CAS)) & ALI_CAS_SEM_BUSY))
+        while (--time && (igetdword(chip, ICHREG(ALI_CAS)) & ALI_CAS_SEM_BUSY))
                 udelay(1);
         if (! time && ! chip->in_ac97_init)
                 snd_printk(KERN_WARNING "ali_codec_semaphore timeout\n");
diff --git a/sound/soc/atmel/atmel_ssc_dai.c b/sound/soc/atmel/atmel_ssc_dai.c
index c5d67900d66..ff0054b7650 100644
--- a/sound/soc/atmel/atmel_ssc_dai.c
+++ b/sound/soc/atmel/atmel_ssc_dai.c
@@ -10,7 +10,7 @@
  * Based on at91-ssc.c by
  * Frank Mandarino <fmandarino@endrelia.com>
  * Based on pxa2xx Platform drivers by
- * Liam Girdwood <liam.girdwood@wolfsonmicro.com>
+ * Liam Girdwood <lrg@slimlogic.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/sound/soc/atmel/atmel_ssc_dai.h b/sound/soc/atmel/atmel_ssc_dai.h
index a828746e8a2..391135f9c6c 100644
--- a/sound/soc/atmel/atmel_ssc_dai.h
+++ b/sound/soc/atmel/atmel_ssc_dai.h
@@ -10,7 +10,7 @@
  * Based on at91-ssc.c by
  * Frank Mandarino <fmandarino@endrelia.com>
  * Based on pxa2xx Platform drivers by
- * Liam Girdwood <liam.girdwood@wolfsonmicro.com>
+ * Liam Girdwood <lrg@slimlogic.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
diff --git a/sound/soc/codecs/wm8350.c b/sound/soc/codecs/wm8350.c
index e3989d406f5..35d99750c38 100644
--- a/sound/soc/codecs/wm8350.c
+++ b/sound/soc/codecs/wm8350.c
@@ -3,7 +3,7 @@
  *
  * Copyright (C) 2007, 2008 Wolfson Microelectronics PLC.
  *
- * Author: Liam Girdwood <lg@opensource.wolfsonmicro.com>
+ * Author: Liam Girdwood <lrg@slimlogic.co.uk>
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License version 2 as
diff --git a/sound/soc/codecs/wm8990.c b/sound/soc/codecs/wm8990.c
index 5b5afc14447..1cbb7b9b51c 100644
--- a/sound/soc/codecs/wm8990.c
+++ b/sound/soc/codecs/wm8990.c
@@ -2,8 +2,7 @@
  * wm8990.c  --  WM8990 ALSA Soc Audio driver
  *
  * Copyright 2008 Wolfson Microelectronics PLC.
- * Author: Liam Girdwood
- *         lg@opensource.wolfsonmicro.com or linux@wolfsonmicro.com
+ * Author: Liam Girdwood <lrg@slimlogic.co.uk>
  *
  *  This program is free software; you can redistribute  it and/or modify it
  *  under  the terms of  the GNU General  Public License as published by the
diff --git a/sound/soc/omap/omap-pcm.c b/sound/soc/omap/omap-pcm.c
index b0362dfd5b7..dd3bb293376 100644
--- a/sound/soc/omap/omap-pcm.c
+++ b/sound/soc/omap/omap-pcm.c
@@ -175,9 +175,10 @@ static int omap_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
 {
         struct snd_pcm_runtime *runtime = substream->runtime;
         struct omap_runtime_data *prtd = runtime->private_data;
+        unsigned long flags;
         int ret = 0;
 
-        spin_lock_irq(&prtd->lock);
+        spin_lock_irqsave(&prtd->lock, flags);
         switch (cmd) {
         case SNDRV_PCM_TRIGGER_START:
         case SNDRV_PCM_TRIGGER_RESUME:
@@ -195,7 +196,7 @@ static int omap_pcm_trigger(struct snd_pcm_substream *substream, int cmd)
         default:
                 ret = -EINVAL;
         }
-        spin_unlock_irq(&prtd->lock);
+        spin_unlock_irqrestore(&prtd->lock, flags);
 
         return ret;
 }
diff --git a/sound/usb/usbaudio.c b/sound/usb/usbaudio.c
index c709b956322..2ab83129d9b 100644
--- a/sound/usb/usbaudio.c
+++ b/sound/usb/usbaudio.c
@@ -2966,6 +2966,7 @@ static int create_fixed_stream_quirk(struct snd_usb_audio *chip,
                 return -EINVAL;
         }
         alts = &iface->altsetting[fp->altset_idx];
+        fp->maxpacksize = le16_to_cpu(get_endpoint(alts, 0)->wMaxPacketSize);
         usb_set_interface(chip->dev, fp->iface, 0);
         init_usb_pitch(chip->dev, fp->iface, alts, fp);
         init_usb_sample_rate(chip->dev, fp->iface, alts, fp, fp->rate_max);